Rate Limits • Hacker News Board

Re: Rate Limits

#21

Post by toomuchtodo » Wed, Aug 17, 2016, 5:03 PM UTC

devy wrote: post #19

toomuchtodo wrote: post #16

Earlier quoted context omitted.

I appreciate what Let's Encrypt is doing, and have even donated, but internally at our org (as a DevOps), I cannot sell certs that expire every 90 days; $300/year for a wildcard cert is a small price to pay for 1 year expirations.

I think LE's 90-day expiration reason #2 is really the key: encouraging automation. So what it really is investing effort once and working for arbitrarily period of time. If the TLS certificate renewal process cannot be automated but must be manually done for some reason, that perhaps LE certificates are really not what you are looking for.

The chances of automation failing is higher than the chance our SSL certs will need revocation.

With that said, still a big supporter of Let's Encrypt for folks who can tolerate the constraints.

Re: Rate Limits

#22

Post by Achshar » Wed, Aug 17, 2016, 5:03 PM UTC

verandaguy wrote: post #14

Achshar wrote: post #9

Earlier quoted context omitted.

In fact isn't shared hosting the most common type of hosting? Any larger sites can afford paid certs anyways so letsencrypt is especially suited for smaller sites like mine, that can't afford the cert but also don't have the luxury of a dedicated machine/vps.

@Achshar: VPSes have gotten exceptionally affordable lately. DO and AWS -- some of the current market leaders for cloud instances -- both offer reasonably-performant setups with high uptime for about $5/month, and that includes command-line access. I'd argue that among people who know about Let's Encrypt, VPS hosting is more popular than cPanel-style shared hosting.

I am a tiny single person company, VPS require a ton of setup and maintenance (for me, a noob). Believe me, I tried. I bought a vps with the intention to move over, but it was too much. I am not a unix user, I can manage xampp, but installing and making changes via command line, setting up php/mysql/apache/whatever else is more work than I get paid for. Something that just works is far more preferable to me as a college student.

Re: Rate Limits

#23

Post by Achshar » Wed, Aug 17, 2016, 5:05 PM UTC

reacweb wrote: post #18

Achshar wrote: post #4

Earlier quoted context omitted.

I can't run those scripts. My site runs on shared hosting, I don't have command line access. All I have is a file manager for my 'htdocs' and standard cpanel stuff.

Even if you do not have command line, you probably have ftp or sftp access. If you search for filezilla in your share hosting forums, you will probably find the protocol and url.

Yeah I have FTP. But can I install certs via ftp? I mean yeah sure I guess since they are just files but won't that be like too much work? Knowing what to put where and how. cPanel is a lot simpler. Paste cert and private key, press submit.

Re: Rate Limits

#24

Post by jcoffland » Wed, Aug 17, 2016, 5:09 PM UTC

Achshar wrote: post #2

What I personally find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? Not to mention the whole process is so very incredibly fugly. For something as important as it is why is there not an official online UI to manag…

I find the command line interface much less "fugly" than a GUI would be.

Re: Rate Limits

#25

Post by Achshar » Wed, Aug 17, 2016, 5:18 PM UTC

jaas wrote: post #20

Achshar wrote: post #2

What I personally find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? Not to mention the whole process is so very incredibly fugly. For something as important as it is why is there not an official online UI to manag…

Regarding your experience getting and managing certificates, I'm sorry to hear that you're having a difficult time. Our goal is to encrypt the entire Web, and that means working with an almost innumerable combination of operating systems, server software, hosting providers, management interfaces, permissions, deployment strategies... Most people have a very positive experience using Let's Encrypt but it's difficult t…

I was on that very page a few weeks ago. I used ZeroSSL to generate my last cert. It works great! And I understand your strategy, providing an API and letting the community work over is the absolute best you can do with the resources you have. My frustration was as a newbie fiddling with command line tools. Being completely lost. I had to read up for two straight days. Then give up for a few months. Return back, read up for two days again, discover ZeroSSL and finally have my cert. Barrier to entry was very high. Now that I'm in, it's a lot better.

Re: Rate Limits

#26

Post by jaas » Wed, Aug 17, 2016, 5:20 PM UTC

toomuchtodo wrote: post #16

jaas wrote: post #5

Earlier quoted context omitted.

We could very easily make the cert lifetimes one year, or anything else. We chose 90 days for the reasons outlined here: https://letsencrypt.org/2015/11/09/why-90-days.html Additionally, long cert lifetimes are dangerous because revocation is ineffective and things like heartbleed happen.

I appreciate what Let's Encrypt is doing, and have even donated, but internally at our org (as a DevOps), I cannot sell certs that expire every 90 days; $300/year for a wildcard cert is a small price to pay for 1 year expirations.

Yeah, I hear that frequently and I get it. The important thing, really, is that you have a cert and that you deploy HTTPS. If you can afford it and it's what you need to do to deploy HTTPS, then whether or not you get your cert from Let's Encrypt is not so important.

There are some good reasons behind the automation practices we encourage though, and if you're doing that stuff then the lifetime doesn't matter much. Worth considering regardless of who your CA is.

Thanks for your support!

Re: Rate Limits

#27

Post by bcoates » Wed, Aug 17, 2016, 5:21 PM UTC

I'll bite: sliding windows are a pain, if you hit them by accident they result in a weird self-DoS. Why not token bucket? It's a simpler algorithm to implement and less pain for the client.

If I'm unaware of these limits and use them up all at once, I'm locked out for a week instead of having to wait 1/rate to issue just one more.

Re: Rate Limits

#28

Post by Achshar » Wed, Aug 17, 2016, 5:21 PM UTC

jcoffland wrote: post #24

Achshar wrote: post #2

What I personally find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? Not to mention the whole process is so very incredibly fugly. For something as important as it is why is there not an official online UI to manag…

I find the command line interface much less "fugly" than a GUI would be.

I don't know, a service like ZeroSSL (email/domains, submit, upload verification, submit, that's all) very much simpler than any command line utility, especially for simple tasks, to be done my newbies.

Re: Rate Limits

#29

Post by j4cob » Wed, Aug 17, 2016, 5:31 PM UTC

bcoates wrote: post #27

I'll bite: sliding windows are a pain, if you hit them by accident they result in a weird self-DoS. Why not token bucket? It's a simpler algorithm to implement and less pain for the client. If I'm unaware of these limits and use them up all at once, I'm locked out for a week instead of having to wait 1/rate to issue just one more.

(Let's Encrypt engineer)

Token bucket is a good idea, and I agree that it would make the user experience of hitting rate limits less onerous. We implemented sliding windows because they were straightforward to implement based on our long-term database state. I'll do some thinking about whether we can emulate a token bucket style on top of that without having to add another source of truth for rate limit information.

Re: Rate Limits

#30

Post by cortesoft » Wed, Aug 17, 2016, 5:33 PM UTC

Achshar wrote: post #28

jcoffland wrote: post #24

Earlier quoted context omitted.

I find the command line interface much less "fugly" than a GUI would be.

I don't know, a service like ZeroSSL (email/domains, submit, upload verification, submit, that's all) very much simpler than any command line utility, especially for simple tasks, to be done my newbies.

I think you are going to have a tough time convincing the HN crowd that a web GUI is simpler than a CLI utility; it is much more difficult to automate web GUIs than CLI utilities, and doing something like this by hand is going to seem unnecessary, given how rote this sort of task is.