Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Year-End Letter from our Executive Director

letsencrypt.org

Post reply on HN
Print view View original

121–130 of 155 posts

Re: A Year-End Letter from our Executive Director

#121

Post by acdha »

Dylan16807 wrote: post #119
acdha wrote: post #111

Earlier quoted context omitted.

I think the worst-case would be a mistake/malice issuing revocations for all of those certificates — that'd take out a ton of different sites and there'd be plenty of chaos around cleaning that up. For example, I note that stackoverflow.com, httpd.apache.org, and nginx.org all use LE certificates which would mean a fair number of people would struggle to install a replacement.

In practice I think that gets a few through, then the mozilla and google servers that push revocation lists start to overload and the admins notice what's going on and shut things down.

Oh, sure but if we’re talking worst-case we’ll assume that the server infrastructure is bulletproof and the admins are all distracted by (maybe Musk just tweeted again).

Re: A Year-End Letter from our Executive Director

#122

Post by Dylan16807 »

acdha wrote: post #121
Dylan16807 wrote: post #119

Earlier quoted context omitted.

In practice I think that gets a few through, then the mozilla and google servers that push revocation lists start to overload and the admins notice what's going on and shut things down.

Oh, sure but if we’re talking worst-case we’ll assume that the server infrastructure is bulletproof and the admins are all distracted by (maybe Musk just tweeted again).

If we're assuming worst case about multiple separate companies then we might as well posit the power grid goes down.

Re: A Year-End Letter from our Executive Director

#123

Post by doublerabbit »

Dylan16807 wrote: post #118
doublerabbit wrote: post #117

Earlier quoted context omitted.

> That's not you winning. You made things worse for everyone. I've made nothing worse for anyone. Those who made it worse for everyone are internet walled gardens and monopolies. If the internet wasn't as corrupted as it now and you deny, telling me Google isn't evil? We would be in a better place with enhancements without the the need for SSL. However not so, evil and mass greed ruined the internet for all since the…

> Those who made it worse for everyone are internet walled gardens and monopolies. I'm just talking about this conversation being worse. > you deny, telling me Google isn't evil? I didn't say anything about Google. > No, not flame-baiting. Am I not allowed my own view based on my own thoughts? Or am I not allowed free-thought? I'm happy to read everyone's else and take that in. But your denying my own? There's no fla…

> You posted "No answers for me? Just what I thought." with the specific intent of annoying people into replying.

I'll agree to disagree on that, the reason is that folk blindly down-vote. It's infuriating. If I hold opinion A which is incorrect, when opinion B could be correct, I then wouldn't get possibly a corrected perspective. At least it sparks a reaction and sights conversation, regardless if annoyance. It allows myself to express how I feel and why I feel. Rather than the hive-mind mentality that if everyone is doing it, its the right think.

> I'm just talking about this conversation being worse.

How? I expressed my opinion. It may not be right, it may be controversial, you may disagree. Yet your post came off as you should have supreme control, you do have many karma points but that still doesn't dictate. I don't doubt your intelligence, nor interactions, myself I am only 33, still learning the world. For all I know you could be god if you believe in such a thing.

> you deny, telling me Google isn't evil?

I'm was laying my beliefs based on the misunderstanding of your post. I misunderstood how "conversation being worse" it happens. However that again is another controversial opinion that the internet is within a very crippled state, for such pointed out above. Again, you may disagree.

Your entitled to such opinion you believe, I'm disappointed that if you did flag me, or that such a feature blocks because what I laid out wasn't out to be argumentative but as free-thought opinion. Maybe more emotional and cynical of than what it should of been but still. Words are tricky and no one person is an expert.

Regardless, mutually. Have a good night

Re: A Year-End Letter from our Executive Director

#124

Post by NavinF »

anderspitman wrote: post #67

We need someone to pull a Let's Encrypt in the identity space. A nonprofit that provides the convenience of single-click social login without the tracking. All it would need to do is provide a domain that verifies you control an email address, then let's services do OIDC flows to that domain to log you in.

Aren't there too many free services that already do that? LE won on cost, automation, and no upselling

Re: A Year-End Letter from our Executive Director

#125

Post by doublerabbit »

shepherdjerred wrote: post #74
doublerabbit wrote: post #53

Earlier quoted context omitted.

Quoted post unavailable.

> No thanks. Why doesn't Google, Microsoft, HackerNews use LetsEncrypt? Why does Bill Gates use Windows? There must be some fatal flaw in macOS if so many are choosing other operating systems!

I doubt that he does just use Windows. I could see him use Linux and MacOS. Those days are over.

Re: A Year-End Letter from our Executive Director

#126

Post by doublerabbit »

fudgefactorfive wrote: post #99
doublerabbit wrote: post #70

Earlier quoted context omitted.

Not harsh at all. I understand I am no security expert, bores the heck out of me. Sadly, you shouldn't trust the "experts" to be if that's LetsEncrypt. No one can be trusted apart from yourself when implementing security. If LE is ran with the following companies, "Electronic Frontier Foundation; Mozilla Foundation; University of Michigan; Akamai Technologies; Cisco Systems" What makes them all trade worthy, especial…

HN: Pretty sure their relationship with DigiCert predates LE, why change if the current relationship is functional. Google: Browser Maintainer that runs entire TLDs, doesn't need a third party, it could just decide to trust itself and 60+% of the market follows. Amazon: Runs a massive chunk of the internet, it's already MitM'd itself and most other things, doesn't really need a third party for Certs but still uses Di…

> Why so salty about LE? Especially from a "seasoned" SysEng? Didn't it just make your job easier and safer for those with slightly less experience?

Because it's required, I don't know the companies, I can't trust the companies. I just not happy that four companies run the worlds SSL. There should be another technology that caters to such without having to put all the keys in one basket.

Re: A Year-End Letter from our Executive Director

#127

Post by doublerabbit »

fudgefactorfive wrote: post #99
doublerabbit wrote: post #70

Earlier quoted context omitted.

Not harsh at all. I understand I am no security expert, bores the heck out of me. Sadly, you shouldn't trust the "experts" to be if that's LetsEncrypt. No one can be trusted apart from yourself when implementing security. If LE is ran with the following companies, "Electronic Frontier Foundation; Mozilla Foundation; University of Michigan; Akamai Technologies; Cisco Systems" What makes them all trade worthy, especial…

HN: Pretty sure their relationship with DigiCert predates LE, why change if the current relationship is functional. Google: Browser Maintainer that runs entire TLDs, doesn't need a third party, it could just decide to trust itself and 60+% of the market follows. Amazon: Runs a massive chunk of the internet, it's already MitM'd itself and most other things, doesn't really need a third party for Certs but still uses Di…

> Why so salty about LE? Especially from a "seasoned" SysEng? Didn't it just make your job easier and safer for those with slightly less experience?

Because it's required, I don't know the companies, I can't trust the companies. I just not happy that four companies run the worlds SSL. There should be another technology that caters to such without having to put all the keys in one basket.

> Didn't it just make your job easier and safer for those with slightly less experience?

No. It makes it harder, because your not teaching someone anyone thing you tell them "click here, click that, done"

Re: A Year-End Letter from our Executive Director

#128

Post by Moru »

Dylan16807 wrote: post #96
ay wrote: post #68

In all the excitement (I too think that they did massive strides in usability of https to the masses), nobody mentions of systems-level consequences of a single entity holding the keys to 300000000 servers on the internet. They’re now in a “don’t be evil” phase. But the people move on, change, etc. And the companies get sold, rogue, bankrupt… I realize an org itself won’t fancy ponder its inevitable deviation from to…

Could you be more specific about "holding the keys"? Sure it's annoying to change to a different service, but they don't have access to any server secrets and all their certificates are logged.

Not the GP but some guesses:

If they disappear or change something, it will effectively shut down a lot of sites that does not have access to someone knowing how to update to a new cert after three months. Sure, the page will work but most browsers will block the users to get to it or require them to click things with scary messages on them.

Holding the key also means they start your engine for you.

Re: A Year-End Letter from our Executive Director

#129

Post by KronisLV »

progmetaldev wrote: post #51
KronisLV wrote: post #27

Earlier quoted context omitted.

> I'm still old school but can set this up all using the letsencrypt command line utilities that configure everything for me. Actually Apache recently introduced mod_md, which allows provisioning certificates from Let's Encrypt directly (or anything else that supports ACME): https://httpd.apache.org/docs/2.4/mod/mod_md.html Because of this, you no longer need external software like certbot for Apache (though it's goo…

I have absolutely no issue with Nginx, and still use it here and there. It's just good to see something public about the use of Apache that's current, as I'm more comfortable with its usage and configuration.

Nginx is also great and will without a doubt stick around for a long time, probably longer than Apache! However there definitely are aspects which can be a little bit annoying: https://blog.kronis.dev/everything%20is%20broken/nginx-confi...

That said, I like its configuration format a bit more than Apache and there's just way less ceremony around it in those cases where it's suitable for any of your projects - you just install it and run it, with any config you might need typically in a single file.

With Apache, you find yourself needing to think a little bit more about what modules you have installed and enabled, although there are actually plenty of those out there, for most things you might want to do (e.g. an authentication gateway or something to make it act as a simple web application firewall).

Re: A Year-End Letter from our Executive Director

#130

Post by orthecreedence »

anderspitman wrote: post #67

We need someone to pull a Let's Encrypt in the identity space. A nonprofit that provides the convenience of single-click social login without the tracking. All it would need to do is provide a domain that verifies you control an email address, then let's services do OIDC flows to that domain to log you in.

Bonus points if it doesn't use blockchain...
Post reply on HN