Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let’s Encrypt in the spotlight

dancvrcek.com

Post reply on HN
Print view View original

21–30 of 51 posts

Re: Let’s Encrypt in the spotlight

#21

Post by duskwuff »

hoopyfrood wrote: post #20

Every time LetsEncrypt is brought up I am reminded of "if it's for free, You are the product". In this case it is one's servers. A single company has a hand on the pulse and runs software on your server in exchange for continuous "convenience". I am still NOT buying in, diversifying SSL certs from reputable companies with 12 (or sometimes 13) months validity are still ok for me in 2017.

This seems a little tin-foil-hatty. The only information which Let's Encrypt receives is the domain name that the certificate is for (which is public anyways for any CA implementing certificate transparency). The Certbot software is open-source and easily verifiable, and there's multiple independently developed alternatives available if you don't like it.

Re: Let’s Encrypt in the spotlight

#22

Post by finnn »

This seems like a basic explanation of some of the stuff on the Let's Encrypt rate limit page (with some funny stuff mixed in to make it sounds like the rate limits for IPv6 are somehow higher), followed by a link to a product.

Re: Let’s Encrypt in the spotlight

#23

Post by dfcowell »

bryanlarsen wrote: post #19
ams6110 wrote: post #2

Like with a lot of tech trends, I seem to be one of those people who doesn't "get" the excitement about letsencrypt. I don't find the process of generating a CSR and submitting it to a CA for signing to be more complicated than setting up letsencrypt. In fact I think it's quite a bit easier.

If the acme client is integrated into your web server, then there's literally zero effort to use let's encrypt. Either use Caddy (1) or integrate with nginx, traefik, gke or any other kubernetes ingress server via kube-lego (2). 1: https://caddyserver.com/ 2: https://github.com/jetstack/kube-lego

The nginx ingress controller with kube-lego is officially my new favourite thing. Got it up and running on three clusters I manage a month or so ago and haven't looked back.

So great to just push an ingress manifest and 10 minutes later suddenly get redirected to HTTPS.

Re: Let’s Encrypt in the spotlight

#24

Post by wereHamster »

hoopyfrood wrote: post #20

Every time LetsEncrypt is brought up I am reminded of "if it's for free, You are the product". In this case it is one's servers. A single company has a hand on the pulse and runs software on your server in exchange for continuous "convenience". I am still NOT buying in, diversifying SSL certs from reputable companies with 12 (or sometimes 13) months validity are still ok for me in 2017.

> runs software on your server

letsencrypt doesn't require you to run anything on your server.

Re: Let’s Encrypt in the spotlight

#25

Post by technion »

hoopyfrood wrote: post #20

Every time LetsEncrypt is brought up I am reminded of "if it's for free, You are the product". In this case it is one's servers. A single company has a hand on the pulse and runs software on your server in exchange for continuous "convenience". I am still NOT buying in, diversifying SSL certs from reputable companies with 12 (or sometimes 13) months validity are still ok for me in 2017.

I don't like the idea of a monopoly either.

But the issue here is what is "reputable". Most of (all?) the major commercial suppliers that I am aware of have been involved in major incidents.

The only reputable supplier I could name, is LE.

Re: Let’s Encrypt in the spotlight

#26

Post by schoen »

duskwuff wrote: post #21
hoopyfrood wrote: post #20

Every time LetsEncrypt is brought up I am reminded of "if it's for free, You are the product". In this case it is one's servers. A single company has a hand on the pulse and runs software on your server in exchange for continuous "convenience". I am still NOT buying in, diversifying SSL certs from reputable companies with 12 (or sometimes 13) months validity are still ok for me in 2017.

This seems a little tin-foil-hatty. The only information which Let's Encrypt receives is the domain name that the certificate is for (which is public anyways for any CA implementing certificate transparency). The Certbot software is open-source and easily verifiable, and there's multiple independently developed alternatives available if you don't like it.

Certbot developer here.

If you don't like Certbot, we definitely encourage you to use one of the many other implementations:

https://community.letsencrypt.org/t/list-of-client-implement...

Some of these are much lighter weight than Certbot and have many fewer dependencies. You can also take your pick of what language they are written in and how they are installed on your system.

You're also welcome to write your own client that speaks the ACME protocol. Let's Encrypt is near to rolling out an API endpoint that will speak the IETF-standardized version of ACME, developed through an open standards process and in consultation with other implementers.

I know that some people have said they don't like running a large new application as root, even when it's open source. So, please have a look at some of the other clients and see if one of them strikes your fancy!

Let's Encrypt's operational funding is thanks to these entities

https://letsencrypt.org/sponsors/

which view the service as worthwhile and important and have chosen to donate funds to support its operation. The organization is overseen by these people

https://letsencrypt.org/isrg/

In this model there is no need to charge users for certificates or try to indirectly monetize the use of the service, although users are very welcome to donate if they find the service useful, and Let's Encrypt may be more sustainable if some users choose to do so.

Re: Let’s Encrypt in the spotlight

#27

Post by jaas »

hoopyfrood wrote: post #20

Every time LetsEncrypt is brought up I am reminded of "if it's for free, You are the product". In this case it is one's servers. A single company has a hand on the pulse and runs software on your server in exchange for continuous "convenience". I am still NOT buying in, diversifying SSL certs from reputable companies with 12 (or sometimes 13) months validity are still ok for me in 2017.

I don't really understand what you're implying but here's some information that might help.

Let's Encrypt is a non-profit service and we don't use your data for our benefit. We work hard to collect and retain as little of your data as possible.

We do not require you to run software from us on your server. You can use any client you want. In fact, we don't even produce client software -- all Let's Encrypt clients are built and maintained by our community (the client we often recommend, Certbot, is an EFF project).

Re: Let’s Encrypt in the spotlight

#29

Post by sliken »

wereHamster wrote: post #24
hoopyfrood wrote: post #20

Every time LetsEncrypt is brought up I am reminded of "if it's for free, You are the product". In this case it is one's servers. A single company has a hand on the pulse and runs software on your server in exchange for continuous "convenience". I am still NOT buying in, diversifying SSL certs from reputable companies with 12 (or sometimes 13) months validity are still ok for me in 2017.

> runs software on your server letsencrypt doesn't require you to run anything on your server.

Cronjob != anything?

Re: Let’s Encrypt in the spotlight

#30

Post by zegl »

sliken wrote: post #29
wereHamster wrote: post #24

Earlier quoted context omitted.

> runs software on your server letsencrypt doesn't require you to run anything on your server.

Cronjob != anything?

They are not running anything on the server, you can implement your own renewal software with their protocols.
Post reply on HN