31–40 of 155 posts
Quoted post unavailable.
What is shady ?
Earlier quoted context omitted.
What's a downside of that?
Downside existed before Let's Encrypt, it just got amplified with it. General public does not differentiate between the SSL certificate validation level. Let's Encrypt provides domain validation certificates, which only validates that one owns the domain in question. There is another level - Organization Validation SSL certificates, which involves manual checking that this is the legal entity it claims to be. I would…
I love them. I'm not really sure how SSL works or what it is (and frankly I don't care to know the details) but with 2 commands I can get that magical lock on any website. I'm glad they're doing well. Thank you!
I don't understand why Let's Encrypt is OK but DANE isn't. They both use DNS to authenticate certificates, why not cut out the middleman?
Sometimes some things catch on and others don't.
I'm just really grateful for the service, and glad to see the Prossimo work continuing as well.
(On a tangential note, I suspect the way Let's Encrypt makes me feel is the thing that people wish Mozilla still had whenever there is a Firefox thread that turns bitter. Like a breathe of fresh air on a cynical internet.)
Earlier quoted context omitted.
As someone that supports Let's Encrypt's efforts and playing devil's advocate, I imagine a downside is that the bar is lowered and nefarious websites can easily get SSL-equipped channels compared to the high paywall of prior.
A plain domain validated certificate cost like $10 for a year or two. So roughly the same cost as the domain name. Hardly a "high paywall".
Earlier quoted context omitted.
I used to configure all of this manually on Apache following crappy instructions from online certificate providers. Copying .pem, .key, .csr files PRAYING Apache would start without complaining. I'm still old school but can set this up all using the letsencrypt command line utilities that configure everything for me. Oh, and whatever the hell GoDaddy's intermediate chain certificate was.
Those instructions were always so clunky as was the process. Re: Godaddy, I was using their "EV" (Extended Validation) cert which added a company name indicator in the address bar. I then learned that it's unwise to bring up security when someone isn't thinking about it because it puts them on undue alert. A couple years ago the browsers have done away with that EV badge altogether.
Customers were seeing the prominent green text and assuming a heightened level of security and trust.
Legal names are also not unique, and this loophole could be used for phishing.
Instead, what browsers did was promote SSL as a default (regardless of certificate type) and point out HTTP connections as insecure.
Earlier quoted context omitted.
I used to configure all of this manually on Apache following crappy instructions from online certificate providers. Copying .pem, .key, .csr files PRAYING Apache would start without complaining. I'm still old school but can set this up all using the letsencrypt command line utilities that configure everything for me. Oh, and whatever the hell GoDaddy's intermediate chain certificate was.
> I'm still old school but can set this up all using the letsencrypt command line utilities that configure everything for me. Actually Apache recently introduced mod_md, which allows provisioning certificates from Let's Encrypt directly (or anything else that supports ACME): https://httpd.apache.org/docs/2.4/mod/mod_md.html Because of this, you no longer need external software like certbot for Apache (though it's goo…
Earlier quoted context omitted.
What's a downside of that?
Downside existed before Let's Encrypt, it just got amplified with it. General public does not differentiate between the SSL certificate validation level. Let's Encrypt provides domain validation certificates, which only validates that one owns the domain in question. There is another level - Organization Validation SSL certificates, which involves manual checking that this is the legal entity it claims to be. I would…
Let's Encrypt has had such a positive impact, I think I'll start donating to them instead of Wikipedia. They're a lot more subtle with their calls to donate, but they seem to deliver a lot of good things to a lot of users, with a much smaller budget. I'm just really grateful for the service, and glad to see the Prossimo work continuing as well. (On a tangential note, I suspect the way Let's Encrypt makes me feel is t…