Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Year-End Letter from our Executive Director

letsencrypt.org

Post reply on HN
Print view View original

111–120 of 155 posts

Re: A Year-End Letter from our Executive Director

#111

Post by acdha »

wtetzner wrote: post #75
ay wrote: post #68

In all the excitement (I too think that they did massive strides in usability of https to the masses), nobody mentions of systems-level consequences of a single entity holding the keys to 300000000 servers on the internet. They’re now in a “don’t be evil” phase. But the people move on, change, etc. And the companies get sold, rogue, bankrupt… I realize an org itself won’t fancy ponder its inevitable deviation from to…

Just curious what you think the consequences could be? Worst case scenario people would need to find a new CA the next time they need a certificate, right?

I think the worst-case would be a mistake/malice issuing revocations for all of those certificates — that'd take out a ton of different sites and there'd be plenty of chaos around cleaning that up. For example, I note that stackoverflow.com, httpd.apache.org, and nginx.org all use LE certificates which would mean a fair number of people would struggle to install a replacement.

Re: A Year-End Letter from our Executive Director

#112

Post by tptacek »

candiddevmike wrote: post #94
tptacek wrote: post #82

Earlier quoted context omitted.

There are a lot of reasons. The real reason DANE isn't deployed is that DNSSEC isn't deployed, and DNSSEC isn't deployed because (1) it's not an operational security win for most companies, and (2) it has an earned reputation for causing nightmare outages. That's why nothing uses DANE: because there are no DANE records to look up, and the most important (high-traffic, whatever) sites on the Internet disproportionatel…

All of the problems you listed around trusting TLDs applies to Let's Encrypt/ACME DNS-01 validation though...

No, they don't. Browsers can dis-trust LetsEncrypt; inclusion in the Mozilla and Google root programs is at their discretion.

Re: A Year-End Letter from our Executive Director

#113

Post by rossy »

iuafhiuah wrote: post #43

I am glad it looks like the IETF ACME specification only addresses the HTTP-01 challenge. I really would like to see improvements made to the DNS-01 challenge before it's ratified, namely, let us publish a public key to a TXT record and use the private key to sign the renewal request. Then I can revoke certbot's access to my DNS records and stop hacking the `.well-known` path.

If your concern is that certbot has access to your DNS records, you can set up a CNAME or NS record on _acme-challenge.your-domain and serve the TXT record from a separate, isolated DNS server.

Re: A Year-End Letter from our Executive Director

#114

Post by ggm »

phasmantistes wrote: post #102
ggm wrote: post #93

Can somebody from LE explain why "Rust in the kernel" is a story for LE, rather than for Linux itself? Did LE e.g. do the coding? or help? is this a cross-product activity? LE is a system for bootstrapping CA certification, Rust in the kernel is a generalized memory/systems security & safety coding activity. Not that it isn't good, but "why talk about it in a letsencrypt end of year message" -is this the wider "we" a…

It's because it's not just a Let's Encrypt end-of-year message: it's an ISRG (Internet Security Research Group) end-of-year message. ISRG runs multiple projects, including both Let's Encrypt and Prossimo. Prossimo is all about using memory-safe languages to replace critical memory-unsafe code, and Prossimo funded a significant chunk of the work to get Rust into the Linux kernel.

Thanks! good explanation.

Re: A Year-End Letter from our Executive Director

#115

Post by yencabulator »

thesimon wrote: post #97
throwntoday wrote: post #85

Earlier quoted context omitted.

Based on what the parent said only 3% of that $77m is to run the site. The rest is spent on frivolous things I imagine if that's all it takes and they're still soliciting donations.

> 3% of that $77m is to run the site And that are outdated numbers from 2015. 2021 report: $153m dollars in donations spent on $67m in salaries, $10m in grants (surprisingly low, in 2020 it was $20m), $2m in hosting and like $10-20m in other professional expenses. Net assets at the end of 2021 now at $231 mio. https://upload.wikimedia.org/wikipedia/foundation/1/1e/Wikim...

Well that's even worse! If they now have $231M and use $2M a year on hosting, that's under 0.9%.

Re: A Year-End Letter from our Executive Director

#116

Post by ipaddr »

jjulius wrote: post #108
ipaddr wrote: post #80

Earlier quoted context omitted.

Not understanding something is to be expected but being proud you don't have to goes against the core of what a programmer is.. curious.

"I don't care to" != "I'm proud I haven't" You don't know why they haven't taken the time to learn. At least they know enough to know they need an SSL cert. Should I not buckle up in a car if I don't understand the mechanics of how the buckle snaps together? I don't understand why you're harping on this person for this.

The full quote was:

"frankly I don't care to know the details"

I take issue with that statement not the person. The statement was honest and matter of fact.

Few know how SSLs work, few have time or opportunity or even desire to learn it. Not 'wanting' to understand the details goes against what I would expect. A programmer tries to/needs to understand how the world works. Not wanting to understand the entire stack is a new concept to me.

Re: A Year-End Letter from our Executive Director

#117

Post by doublerabbit »

Dylan16807 wrote: post #100
doublerabbit wrote: post #86

Earlier quoted context omitted.

> Before Let's Encrypt, certs cost money from certificate authorities, so not many smaller companies would bother. Now it's streamlined enough that browsers throw scary warnings if you don't have it, which is a massive improvement for everyone using the web. But should they? I never had any issues running an internet site before this was required. A blog doesn't need SSL. Why are ISP's not more scrutinized to ensure…

> I'm sure I might be "flagged" soon too. Yes if you're going to deliberately flamebait I will flag you. That's not you winning. You made things worse for everyone.

> That's not you winning. You made things worse for everyone.

I've made nothing worse for anyone. Those who made it worse for everyone are internet walled gardens and monopolies. If the internet wasn't as corrupted as it now and you deny, telling me Google isn't evil? We would be in a better place with enhancements without the the need for SSL. However not so, evil and mass greed ruined the internet for all since the 80's; heck the 70's.

No, not flame-baiting. Am I not allowed my own view based on my own thoughts? Or am I not allowed free-thought? I'm happy to read everyone's else and take that in. But your denying my own? There's no flame, those opinions are of my own and may not be correct in your eyes but I am still allowed to have.

Re: A Year-End Letter from our Executive Director

#118

Post by Dylan16807 »

doublerabbit wrote: post #117
Dylan16807 wrote: post #100

Earlier quoted context omitted.

> I'm sure I might be "flagged" soon too. Yes if you're going to deliberately flamebait I will flag you. That's not you winning. You made things worse for everyone.

> That's not you winning. You made things worse for everyone. I've made nothing worse for anyone. Those who made it worse for everyone are internet walled gardens and monopolies. If the internet wasn't as corrupted as it now and you deny, telling me Google isn't evil? We would be in a better place with enhancements without the the need for SSL. However not so, evil and mass greed ruined the internet for all since the…

> Those who made it worse for everyone are internet walled gardens and monopolies.

I'm just talking about this conversation being worse.

> you deny, telling me Google isn't evil?

I didn't say anything about Google.

> No, not flame-baiting. Am I not allowed my own view based on my own thoughts? Or am I not allowed free-thought? I'm happy to read everyone's else and take that in. But your denying my own? There's no flame, those opinions are of my own and may not be correct in your eyes but I am still allowed to have.

You posted "No answers for me? Just what I thought." with the specific intent of annoying people into replying.

Re: A Year-End Letter from our Executive Director

#119

Post by Dylan16807 »

acdha wrote: post #111
wtetzner wrote: post #75

Earlier quoted context omitted.

Just curious what you think the consequences could be? Worst case scenario people would need to find a new CA the next time they need a certificate, right?

I think the worst-case would be a mistake/malice issuing revocations for all of those certificates — that'd take out a ton of different sites and there'd be plenty of chaos around cleaning that up. For example, I note that stackoverflow.com, httpd.apache.org, and nginx.org all use LE certificates which would mean a fair number of people would struggle to install a replacement.

In practice I think that gets a few through, then the mozilla and google servers that push revocation lists start to overload and the admins notice what's going on and shut things down.

Re: A Year-End Letter from our Executive Director

#120

Post by NavinF »

progmetaldev wrote: post #98
Cogito wrote: post #73

Earlier quoted context omitted.

I partly agree with you, however it's possible for devices to have limited access to the internet, or even no direct access but still be accessible to devices that are on the internet. If I have a smart device at home I may put it on a network that has no outgoing access to the internet, but it would still be nice to be able to connect to it with a web browser without getting angry expired certificate warnings. It's…

A company extranet locked by a whitelist of IP addresses comes to mind. You still want a SSL installed for security.

Yeah but that's a lot less common these days: https://www.usenix.org/system/files/login/articles/login_dec...

I don't want LE to waste money supporting such use cases.

Post reply on HN