Hacker News Reader

Bogus nonsense. Sign your internal certs with an internal CA, make your clients trust the CA. Use it properly.

> "make your clients trust the CA"

There's no single trust store: the OS has one, Firefox, Java (cacerts), Python (certifi), Node, Go containers, all your Docker images, ...

Failure? People just toggle TLS verification off.

Easy to do in a one-man shop, but almost impossible in any big company. Try grepping for verify=False / -k / InsecureSkipVerify in any fortune 500 and you'll find plenty

Yes, it feels like I echo the same sentiment at work every few weeks. No, we can’t tick the PR with verify=false. Yes, you have to configure the trust store. Yes, it’ll take maybe an hour to work this out. Go do so please.

The only reason is laziness.

Reply on news.ycombinator.com