Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ACME v2 and Wildcard Certificate Support is Live

community.letsencrypt.org

Post reply on HN
Print view View original

71–80 of 321 posts

Re: ACME v2 and Wildcard Certificate Support is Live

#71

Post by tomjakubowski »

eric_b wrote: post #65
ancarda wrote: post #62

Earlier quoted context omitted.

I wrote that in anger, and almost right away removed it when I calmed down. Please see my current comment.

But why did it make you so angry? My guess is because my viewpoint is completely unfathomable to you. You can't even believe that someone would advocate for it. In situations like that, I always try and put myself in the shoes of that person. Sometimes they are wrong, and sometimes they have a point. But it's always a useful exercise. To your parent comment - No, I don't think it's a cabal of "grumpy old men" - I thi…

> I think it's a cabal of morally righteous security-minded people who have never worked for small companies or realize that most dev teams don't have the time to deal with all this forced entropy.

This is just one anecdote, but I worked at a company small enough that I was the only developer/ops person. Time spent managing HTTPS infrastructure couldn't have been more than a handful of hours a year.

What is so painful to you about running your website(s) on HTTPS?

Re: ACME v2 and Wildcard Certificate Support is Live

#72

Post by greenhouse_gas »

eric_b wrote: post #43
mholt wrote: post #15

Earlier quoted context omitted.

> The preferable end-of-life date for ACMEv1 should be never. As would be the preferable end-of-life date for SSLv3 and HTTP.

The SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren'…

>developers who just want their software to work.

Do they keep their servers up to date? Why is it so much easier to do that than getting an SSL cert four times a year?

I hope they update their servers more often than that.

Re: ACME v2 and Wildcard Certificate Support is Live

#73

Post by floatboth »

eric_b wrote: post #43
mholt wrote: post #15

Earlier quoted context omitted.

> The preferable end-of-life date for ACMEv1 should be never. As would be the preferable end-of-life date for SSLv3 and HTTP.

The SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren'…

> marked ominously as "insecure"

It's not that ominous. It's not even red!

I think it's pretty obvious to most users that "Insecure" doesn't matter as much on some random blog, but does matter a lot on something that looks like a bank or a store.

Re: ACME v2 and Wildcard Certificate Support is Live

#74

Post by Jaruzel »

One of the wonderful aspects of this, that no-ones pointed out yet, is that these can used for INTERNAL domains, without you having to run your own internal CA.

i.e. lets say your internal network DNS domain is 'my-company-lan.com' - all you have to do is ensure that 'my-company-lan.com' is also registered in public DNS[1], and then you can secure ALL your internal services using a free LE wildcard cert, that's automatically trusted by all platforms and browsers[2]. For some companies that's going to be a BIG cost and resources saving.

--

[1] but not actually used for any public facing services.

[2] Mostly...

Re: ACME v2 and Wildcard Certificate Support is Live

#75

Post by Spivak »

orthecreedence wrote: post #24
kardos wrote: post #19

Earlier quoted context omitted.

Not sure how the availability of wildcard certs changes that scenario, if I can set the DNS record for secure-payments.yourbusiness.com then I can get a non-wildcard cert for it and get on with the spamming straight away

I think it's somewhat difficult to get a valid (CA-valid) certificate for a domain you don't own, though. At least, that's what the job of the CAs is: to verify that the certs they're issuing are for the actual owner of yourbusiness.com.

Nope, DV certs just verify that you control the domain (i.e you can place arbitrary content in a specific location). You don't need to own the domain otherwise SSL would be a lot harder for mysite.hostingcompany.com type providers.

Re: ACME v2 and Wildcard Certificate Support is Live

#76

Post by jsmthrowaway »

eric_b wrote: post #65
ancarda wrote: post #62

Earlier quoted context omitted.

I wrote that in anger, and almost right away removed it when I calmed down. Please see my current comment.

But why did it make you so angry? My guess is because my viewpoint is completely unfathomable to you. You can't even believe that someone would advocate for it. In situations like that, I always try and put myself in the shoes of that person. Sometimes they are wrong, and sometimes they have a point. But it's always a useful exercise. To your parent comment - No, I don't think it's a cabal of "grumpy old men" - I thi…

What the gently caress does encrypting an HTTP connection have to do with morals or age? You are way outside the realm of making sense, man, and offer commentary that is openly harmful to securing the Internet. Please step back and revisit your woefully misinformed opinion on this.

Most people who advocate for security, including myself, have worked on small teams and understand the resources involved. Putting a TLS certificate on your shit with LE takes minutes. Doing it through another CA is minutes, in a lot of cases. You spent more time downloading, installing, and configuring Apache, then configuring whatever backend you want to run, and writing your product or blog post or whatever it is you’re complaining about securing.

Honestly, in the time you’ve been commenting here, you could have gotten TLS working on several sites. Managing TLS for an operations person is like knowing git for a software developer. It’s a basic skill and is not difficult. If it’s truly that difficult for your team, (a) God help you when someone hacks you, they probably already have and (b) there are services available that will front you with a TLS certificate in even less time than it takes to install one. Cloudflare and done.

> Security can be a roadblock to releasing valuable software on time and within budget.

Great, you've pinpointed it. Step two is washing it off. Ignoring security directly impacts value, and I'm mystified that you don't see this.

But I guess I'm a zealot ¯\_(ツ)_/¯

Re: ACME v2 and Wildcard Certificate Support is Live

#77

Post by floatboth »

ocdtrekkie wrote: post #38
elahd wrote: post #37

Earlier quoted context omitted.

The encryption part is easy -- you don't need CAs for that -- but they're a necessary evil when it comes to verifying ownership. You need to delegate trust to someone , otherwise using the internet becomes too cumbersome.

Automated SSL providers effectively mitigate the idea of "verifying ownership" or "delegating trust", because for example, someone can buy a domain like... googIe.com, get an SSL cert for it, and it's "valid". We're right back to the same level of security of you just checking that the browser bar points at the domain you actually intended to go to. (In this example, bear in mind, Google doesn't use an EV cert, so th…

> someone can buy a domain like... googIe.com, get an SSL cert for it, and it's "valid"

Are you sure that all "old school" CAs wouldn't issue a cert for that?

They were never supposed to fight phishing. Domain Validation certificates literally validate… domains, and nothing more.

It would make more sense to prevent googIe.com from existing at the .com registry level, before any TLS is involved.

Re: ACME v2 and Wildcard Certificate Support is Live

#78

Post by pwnna »

mholt wrote: post #49
eric_b wrote: post #43

Earlier quoted context omitted.

The SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren'…

> developers who just want their software to work. Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. > they either don't know or don't care about all the effort and pain they're creating You have not been paying attention to the hundreds of tools available to make HTTPS painless. > until someone at Big G decided they weren't. And Mozilla. And countle…

What about hosting HTTP content because you verify GPG signatures upon download? These content would then be super easy to cache on the local network. HTTPS defeats this and makes it uncachable.

I hardly ever see people talk about this use case and how to solve it with https everywhere. AND it's super widely used: e.g. debian repositories.

Re: ACME v2 and Wildcard Certificate Support is Live

#79

Post by xenophonf »

eric_b wrote: post #60
ancarda wrote: post #57

Earlier quoted context omitted.

>Yeah, I realize they weren't competent, but I also realize that it had no practical effect on my site's security Can you explain why you think Symantec demonstrating incompetence is completely isolated from your Symantec SSL protected website? I sense a lot of hostility coming from you. It seems like you think we do these things for fun. Do you imagine a bunch of grumpy men get together, drink beer, and pick a new S…

> At the risk of all my karma, honestly, fuck off. Thin-skinned immature response aside, what you lack is empathy. You can't possibly understand why someone would take my stance. It's your lack of empathy I despise. Look at the replies to my comment - people are losing their minds. It's this rabid dogma that frightens me, and frankly makes me hate the infosec community in general. To you, security is the only thing t…

> You can't possibly understand...

Oh, I get it. I've worked with lots of people like you.

You're lazy.

As an infosec practitioner, I'm the one that cleans up after the people who claim good current infosec practices are "too hard" or "impractical" or "not cost-effective", which all boil down to sysadmins and developers like you creating negative externalities for people like me. I have heard all of these arguments before. "Oh, we can't risk patching our servers because something might break." "Oh, the millisecond overhead of TLS connection setup is too long and might drive users away." "Oh, this public-facing service doesn't do anything important, so it's no big deal if it gets hacked."

That's irresponsible.

I'm not at all sorry that the wider IT community has raised the standards for good (not best, just good) current infsec practices. If you're going to put stuff out there, for God's sake maintain it especially if it's public-facing. If using the right HTTPS config is that difficult for you, move your stuff behind CloudFront or Cloudflare or something and let them deal with it. If you can't be bothered with some minimal standard of care, you need to exit the IT market.

And good luck finding a job in any industry, in any market, where anyone will think that doing less than the minimal standard, or never improving those minimums, is OK.

Re: ACME v2 and Wildcard Certificate Support is Live

#80

Post by Jaruzel »

Jaruzel wrote: post #74

One of the wonderful aspects of this, that no-ones pointed out yet, is that these can used for INTERNAL domains, without you having to run your own internal CA. i.e. lets say your internal network DNS domain is 'my-company-lan.com' - all you have to do is ensure that 'my-company-lan.com' is also registered in public DNS[1], and then you can secure ALL your internal services using a free LE wildcard cert, that's autom…

Going to reply to my own comment here.

It's at this point that I swear profusely at Microsoft yet again, for pushing the concept of '.local' domain suffixes a decade ago. As it's not a legal TLD, I can't get certs for any of my internal services without rolling my own internal CA, which only works automatically for Windows domain machines, and not for anything else.

Post reply on HN