If you want to email me, use: nick (-at-) nickf (-dot-) net
- nickf parentI was mostly just typing out what they had listed under 'products' on their pages. I'm aware of what Mozilla do, know folks there and that have been there. They've been roundly criticised for adding 'products' of questionable value to their core userbase, rightly so in my opinion.
- It might never 'touch' the internet, but the certificates can be easily automated. They don't have to be reachable on the internet, they don't have to have access to modify DNS - but if you want any machine in the world to trust it by default, then yes - there'll need to be some effort to get a certificate there (which is an attestation that you control that FQDN at a point-in-time).
- Can I ask - if you're using publicly-trusted TLS server certificates for client authentication...what are you actually authenticating? Just that someone has a certificate that can be chained back to a trust-anchor in a common trust-store? (ie your authentication is that they have an internet connection and perhaps the ability to read).
- Don't. Don't pin to public certificates. You're binding your app to third-party infrastructure beyond your control. Things change, and often. Note that pinning to a root or intermediate seems 'sensible' - but it isn't. Roots are going to start changing every couple of years. Issuing/intermediate CAs will be down to 6 months, and may even need to be randomised so when you request a new cert, there's no guarantee it'll be from the same CA as before.
Don't pin to certs you don't control.
- Weird - in an incredibly similar situation and my RICs are overdue an upgrade (Oticon Opn 3). I've been keeping an eye on developments for some time, and I've been looking for something ideally CIC, though I do like the RIC Opns. However, nothing has had the feature set I wanted - bluetooth, auracast, Apple MFI and being CIC.
Oticon just announced/released their 'Zeal' product - a non-custom CIC, with seemingly all the bells and whistles, including bluetooth. Planning to try them soon.
I have tried a few aids before (Starkey and some older Phonak) and I do really like the Oticon 'sound'. They work for me, but of course YMMV. I think many aid manufacturers (many of them the same company - WDH!) do 60 day trials. Worth a shot.
My only dislike is the new fad, particularly of Oticon, of stopping disposable batteries and only going rechargeable. Disposable zinc-air cells have great life (I'd get a week on the Opns at least, with a few hours streaming per day). I travel for work a lot, so carrying a couple of tiny 312's in my wallet or keychain was perfect. The Zeal look to have what Oticon think is a 'compact' charger - but it ain't small. My kingdom for a charger the size of the AirPods Pro case...
- Azure Key Vault - even in the ‘premium’ HSM flavour can’t actually prove the HSM exists or is used, which doesn’t satisfy the requirements the CA has. In theory, it shouldn’t work - but some CAs choose to ignore the letter and the spirit of the rules. Even Azure’s $2400a month managed HSM isn’t acceptable, as they don’t run them in FIPS mode.
- If there are systems that are that resistant to automation, the question should be 'does this system need a publicly-trusted server certificate, the same as a blog about cats or a Shopify shop?'. The answer is no. If it can't practically be automated, it near-certainly doesn't need to have a public cert on it.