Tell HN: Thanks to thehodge and littlewarden.com, this site is up today

4 years ago

A few days ago we got an email from HN user thehodge (https://news.ycombinator.com/user?id=thehodge), aka Dom Hodgson, telling us that HN's SSL cert was about to expire—as indeed it was. All the renewal notices had been going to Scott's old YC email, which no longer works.

Dom runs https://littlewarden.com/, which monitors sites for upcoming issues and lets you know when you're about to publicly embarrass yourself. In a twist on eat-your-own-dog-food (eat someone else's dog food as a service?), he had set up alerts for HN in their system. Lo and behold, it delivered the goods, and that is why you're reading HN as usual today instead of certificate scoldings, and therefore also why my ass is in a saved state, which is how I like it.

I figure the least we can do is proclaim our thanks, so all hail Dom and Little Warden! Yes, I know most of you can do this in 3 lines of Python and a cron job, and yes yes, there are other alert services—but only one has personally helped you waste time unimpeded on the internet. That is all.

80 comments

dang

Reply
thehodge  4 years ago

Thanks for the mention Dang, I monitor a few hundred sites of 'importance' and see stuff like this all the time, you are the first one however to thank me for an email saying 'you might want to look into this!'

  • perryh2  4 years ago

    I've thought about building a similar service before and I'm really impressed with all the features you offer, including many that I haven't even thought about before. Many companies use services like Pingdom for uptime monitoring but they don't have nearly as many features. I think you will do really well!

  • Abishek_Muthian  4 years ago

    Thanks Hodgson, SSL certificate expiring before the times of Let's Encrypt was the stuff for nightmare. I had to dedicate some day every 3 months to renew SSL certificates for my websites.

    But now with Lets Encrypt & autocert(Go) it's not the case anymore. But still Little Warden would be useful to detect nasty surprises and besides you're offering other features.

    P.S. I've added Little Warden to my curated list of startup tools - https://startuptoolchain.com/#website .

  • gavinray  4 years ago

    Wow that's really shitty of all the other ones.

    Will you name drop them so I can be angry at their ethics for you?

petercooper  4 years ago

As an aside, I've known thehodge for about fifteen years and he's a total mensch. He ran a popular annual hackathon (an actual ethical one where everyone won a prize) here in the UK, raises money seemingly non-stop for a children's hospice, and has launched perhaps 102 random businesses (including an online candy store!) and side projects over the years both for his own and our entertainment :-D If you want to patronize or support a business that's actually run by a good, ethical person, this is the one for you.

cedricd  4 years ago

So does that mean that YC is now a paid subscriber to the service? ;).

Very classy callout in any case. I love the story of a startup getting good press for doing something nice. Also this sounds like a really good case study for them to put up.

  • dmurray  4 years ago

    If YC were a paid subscriber, the mail would presumably have gone to the same defunct email address that the cert expiry notice went to.

    How does Littlewarden solve that problem? "Personally contacting the face of the site through a back channel" is a great answer, but not so scalable.

    • thehodge  4 years ago

      We allow multiple emails to be notified for issues, as well as the pretty popular Slack integration (along with other messaging services)

      1 reply →

Zealotux  4 years ago

Amusing, I embarrassed myself today as I forgot to renew a client's certificate. This kind of service is unfortunately too expensive for my needs (2 small websites to monitor), wouldn't that be possible to have a small software run on my laptop that checks a list of websites every day for upcoming expiration?

  • geofft  4 years ago

    You can do this with the following crappy cronjob (monitoring the machine where your cronjobs run is left as an exercise to the reader / is why you'd want to pay someone to deal with it):

        0 0 * * * openssl s_client -showcerts -connect news.ycombinator.com:443 </dev/null 2>/dev/null | openssl x509 -checkend 864000 >/dev/null || echo "Certificate is expiring"

    Assuming your system has local mail (via the sendmail command) working, this will send you an email if your certificate expires in the next 864000 seconds = 10 days. If you have an MTA installed but don't use local mail on the machine, you can use the MAILTO feature to send it to your normal email address.

    • atok1  4 years ago

      That's pretty useful, thanks.

      I can setup a monitor (FOSS) for the computer that is doing the site monitoring, since I only use open source software that I can inspect.

  • dharmab  4 years ago

    In addition to monitoring the cert, consider using Let's Encrypt/ACME to auto-rotate certificates.

    • remram  4 years ago

      Unfortunately this also fails in interesting ways...

      Just recently, I let one of my certificates expire. The cronjob correctly renewed it, but nginx was not reloaded and kept using the previous certificate. This had never happened before, because I would usually make changes regularly and trigger a reload, which would load the new certificate. Therefore this website had run without issues for 2 years with an incomplete renewal configuration until it finally broke...

      1 reply →

  • cyberge99  4 years ago

    dnmin is a small shop that offers it free (I think). I donated the guy $10 for the service a couple of years ago. I got an alert recently, so it works.

  • amozoss  4 years ago

    Google cloud does checks (of endpoints or tcp connections). I've never been charged as far as I can tell. It sends me a text when my site is down, but it has tons of other notification options

polote  4 years ago

> Yes, I know most of you can do this in 3 lines of Python and a cron job, and yes yes, there are other alert services

Ultimate troll :) Maybe dang is the secret writer of n-gate

  • temp_praneshp  4 years ago

    I hope the writer of n-gate is fine. Nothing since mid-july.

    • isoprophlex  4 years ago

      Every week I still check, and leave slightly saddened, smirking "n-gate continues the war on it's users"

      Hope they're okay, and just bored with writing updates.

petecooper  4 years ago

https://crt.sh/?q=news.ycombinator.com

(for the curious)

endisneigh  4 years ago

This is an incredibly wholesome post all around. Wish all internet interactions were like this!

sundarurfriend  4 years ago

It's surprising how common this is, from big organizations: either letting the certificate expire, or have it be for the wrong domain that clearly belongs to the same org - but most users wouldn't know or care. So it's a good idea for a service, best of luck to thehodge.

  • thehodge  4 years ago

    It happens A LOT, it's mostly because domains, SSLs and other 'tedious' things like that tend to get lost in the business of 'building something billable' and it's easy to thank that a different department owns that bit.

  • type0  4 years ago

    It's even more common when the certificate is issued for longer than 1 year, that's a bad practice- don't do this!

dEnigma  4 years ago

Really cool of you to mention this publicly! As thehodge said in his comments this is far from usual, and most big websites would just silently renew their certificate without giving any credit.

> Yes, I know most of you can do this in 3 lines of Python and a cron job

At first I thought this was a tongue-in-cheek reference to the famous Dropbox dismissal by BrandonM https://news.ycombinator.com/item?id=9224

  • dang  4 years ago

    I actually stole that line from something Dom said in our email conversation...

    (Also, this is offtopic but I'm on a quest to get people to realize that BrandonM's comment has been unfairly characterized:

    https://news.ycombinator.com/item?id=23229275)

    • stanmancan  4 years ago

      I've caught a few of those once it's too late to reply, and I'm not sure I entirely agree with your sentiment.

      Unless I'm totally out of touch, I've always seen the comment referenced as either dismissing a simple solution because a complicated one exists, and/or now having a grasp on how complicated a solution is.

        1. For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem. From Windows or Mac, this FTP account could be accessed through built-in software.

      Most recently I referenced the comment in a discussion around Laravel Forge, which deploys and manages servers for hosting websites. I love it personally, but a friend was of the opinion that "it's unnecessary, all you have to do to setup a server is..."

      I get that he was trying to be helpful with his post, but that doesn't dismiss the fact that his very first point was "You can already do this by..." and then proceeding to provide a valid, but complicated solution that very few people could do.

      There's nothing wrong with his post, but it does act as a good reminder that there's room for products that provide a simple solution where only complicated options exist.

      1 reply →

    • dEnigma  4 years ago

      Funnily enough I just read some more of the context around that comment and have to agree that it wasn't that bad. I think people, including myself, mostly remember the "For a Linux user, you can already build such a system yourself quite trivially by[...]" part. Personally I always find that hilarious because e.g. my mother can trivially use Linux and Dropbox, but I would have an awful time trying to walk her through BrandonM's proposed setup.

mutagen  4 years ago

Looks like a great service, and it monitors quite a bit more than SSL / domain expiration.

jarofgreen  4 years ago

FYI the little warden menu doesn't work on Firefox or Chrome Android (at least I assume it's meant to be a menu?)

Your various site & DNS checks - do they work on IPv4 and V6? We recently managed to mess up our V6 records whilst our V4 were fine. Turns out our site checkers ran on V4! We've managed to get Prometheus to check on both now (kinda, there are some DNS caching issues somewhere) but now I'm surprised more checkers don't offer this feature.

  • thehodge  4 years ago

    Thanks for the heads up, I'll take a look at that and the good news is that we have a brand new marketing site launching very soon which IS much more mobile compatible!

    The IPv6 thing, tbh nobody has tried it yet, but it's certainly something that if it doesn't work, we will fix it so it does :)

    • jarofgreen  4 years ago

      To be clear, I'm suggesting that checkers should run the tests over both IP4 and IP6 to explicitly catch situations where one is set up correctly and one isn't.