Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Year-End Letter from our Executive Director

letsencrypt.org

Post reply on HN
Print view View original

131–140 of 155 posts

Re: A Year-End Letter from our Executive Director

#131

Post by kelnos »

doublerabbit wrote: post #86
spicybright wrote: post #77

Earlier quoted context omitted.

So for one, if you're looking for an actual answer, dial it down a few notches. Your post is 18 minutes old as of me writing and you're already boasting about a lack of replies. Two, you're likely misunderstanding the purpose of SSL and Let's Encrypt. It's not to protect you against the site you're talking to, it's to prevent man in the middle attacks on the way. It ensures you can't walk into a starbucks for an hour…

> Before Let's Encrypt, certs cost money from certificate authorities, so not many smaller companies would bother. Now it's streamlined enough that browsers throw scary warnings if you don't have it, which is a massive improvement for everyone using the web. But should they? I never had any issues running an internet site before this was required. A blog doesn't need SSL. Why are ISP's not more scrutinized to ensure…

Putting a TLS cert on your blog also allows visitors to (mostly[0]) hide their traffic and activities from entities that might want to snoop on them, like their ISP. You as the blog owner might not care, but your visitors might. If you don't care about your visitors, that's fine, but some people do.

As for who uses LetsEncrypt, there are a lot of businesses and organizations in between the size of a Microsoft and a small blog that use it. If you read the article, you'll note that LE is celebrating 300M websites protected with their certs. So quite a lot of people find LE useful and want to protect connections to their sites with TLS. If you can't figure out why, perhaps that's more a lack of imagination on your part, than misplaced time and effort on theirs.

As an aside, can you lay off with all the aggressive nonsense? People are replying to you (despite your whining about downvotes). Chill out and maybe take some time away from the keyboard when you're all worked up like that.

[0] Unfortunately SNI will often still leak the domain name of the TLS-protected site being visited, but an encrypted version of SNI is being worked on to close that hole.

Re: A Year-End Letter from our Executive Director

#132

Post by kelnos »

CodesInChaos wrote: post #16
otachack wrote: post #11

Earlier quoted context omitted.

As someone that supports Let's Encrypt's efforts and playing devil's advocate, I imagine a downside is that the bar is lowered and nefarious websites can easily get SSL-equipped channels compared to the high paywall of prior.

A plain domain validated certificate cost like $10 for a year or two. So roughly the same cost as the domain name. Hardly a "high paywall".

Don't most domains cost $5 or less? I think it's pretty outrageous to have to spend 2x (or more) of the domain name cost to secure connections to it.

Re: A Year-End Letter from our Executive Director

#133

Post by kelnos »

bogwog wrote: post #58
kevinh wrote: post #18

Earlier quoted context omitted.

It's perfectly reasonable for someone to be into programming and not want to have to care about the details of setting up a networking stack.

Ok I get not wanting to pick on the guy, but is that really reasonable? Engineering is about solving problems by designing/implementing systems. The more you know about the system(s) you're working with, the better the solutions you can build. Even if you're "just" working at a high level and maximally specialized to a single niche, not knowing how the underlying parts work will really limit you. Pick the brain of an…

Or maybe we should just avoid judging people based on what they do and don't think is worth their time learning, especially when all we know about them is a previous job title and a short message on an internet message board?

I mean, c'mon, it takes quite a bit of arrogance to condemn someone for some little facet of their life when you know next to nothing about them.

Re: A Year-End Letter from our Executive Director

#134

Post by kelnos »

ipaddr wrote: post #116
jjulius wrote: post #108

Earlier quoted context omitted.

"I don't care to" != "I'm proud I haven't" You don't know why they haven't taken the time to learn. At least they know enough to know they need an SSL cert. Should I not buckle up in a car if I don't understand the mechanics of how the buckle snaps together? I don't understand why you're harping on this person for this.

The full quote was: "frankly I don't care to know the details" I take issue with that statement not the person. The statement was honest and matter of fact. Few know how SSLs work, few have time or opportunity or even desire to learn it. Not 'wanting' to understand the details goes against what I would expect. A programmer tries to/needs to understand how the world works. Not wanting to understand the entire stack is…

> Not wanting to understand the entire stack is a new concept to me.

Then I'd suggest that your experience about the world, and about people in general, is severely lacking.

There aren't enough hours in a day or years in a life to learn everything, so we have to be selective.

Do you know how CPUs work, down to the various functional units and pipeline stages and how they work together? Can you explain to me how transistors work on an electrochemical level? Can you explain how silicon wafers are fabricated? Hell, I took those classes in college as a part of my EE degree, and I can't really remember it well enough to explain without cheating and looking at Wikipedia. (And even then...)

And guess what? That's just fine. I have no need or desire to dive that deeply back into that stuff.

Why should the minutiae around TLS certs be any different? I do know how TLS cert provisioning works, and to be honest, it's boring and tedious. And I do it so infrequently that I have to look up a tutorial every time I do it. It's just not worth keeping in my head. If I could use LE for everything, and never try to remember the right `openssl req` command ever again, that would be great.

> A programmer tries to/needs to understand how the world works.

No, a programmer is someone who solves problems with code. How they do it, and what types of knowledge they pursue, runs the entire gamut of possibilities.

Bottom line: knowing technical minutiae doesn't make you cool or special or better than other people. It just makes you someone who's interested in that stuff, or someone who needs to understand it as a part of work they do. Let's not elevate it to something it's not.

Re: A Year-End Letter from our Executive Director

#135

Post by kelnos »

progmetaldev wrote: post #84
kevinh wrote: post #18

Earlier quoted context omitted.

It's perfectly reasonable for someone to be into programming and not want to have to care about the details of setting up a networking stack.

I agree somewhat, but this is about programming in the web stack. SSL should be familiar, we aren't speaking about general programming here.

I think there are a lot of perfectly good programmers who work at the level of the web stack, but couldn't set up a web server with TLS to save their life. There's nothing wrong with that, and suggesting that there is, is just a form of technology elitism and gatekeeping.

Re: A Year-End Letter from our Executive Director

#136

Post by kelnos »

comex wrote: post #105
rainsford wrote: post #71

Earlier quoted context omitted.

I'll admit I haven't spent a ton of time thinking through all the implications, but that proposal seems like it comes with some significant security tradeoffs. In particular, you'd lose the ability to prove you control the domain name at the time of certificate renewal. Instead, the key pair approach shows you controlled the DNS records for the domain at some point and your entry has yet to be deleted. From the certi…

To be fair, “you controlled the DNS records for the domain at some point and your entry has yet to be deleted” could also describe the HTTP-01 challenge. Admittedly, having the A/AAAA record point to the wrong place is much more likely to be noticed than having a stray TXT record lying around. Perhaps more worrying is the possibility of having a keypair that is legitimately being used to sign certificate requests, bu…

Does it? Under the approach of storing a public key in DNS, certs can be issued long after the person asking for one has lost access to the website, if the pubkey record hasn't been deleted.

With http-01, ownership has to be proven every time a new cert is issued.

> Such an attacker would likely have also stolen the TLS private key, but that only stays valid for 90 days

That doesn't have to be the case; the private key can be valid for as long as someone wants it to be, unrelated to the validation period of the cert that is issued. Yes, it does look like certbot generates a new keypair for every renewal, but in a world where we were putting a pubkey in a DNS record, the private key would certainly have a much longer validity, as otherwise there'd be no point to doing it this way in the first place.

Re: A Year-End Letter from our Executive Director

#137

Post by kelnos »

vbezhenar wrote: post #28
jiggawatts wrote: post #9

Earlier quoted context omitted.

> some shady websites What are you talking about? A clever design aspect of Let’s Encrypt is the deliberately short expiry. That forces administrators to automate the issuance and renewal process. Not to mention that you’re not supposed to “download” the private key! The whole idea of PKI is to generate the private key locally and then have a CA sign only the public part. If you’re doing anything else you’ve undermin…

I know better what am I supposed to do. Type "download letsencrypt certificate online" in the Google and you'll find out what I'm talking about. You can think of forcing administrators all the day while Internet is full of expired letsencrypt websites that I regularly stumble upon. The world does not work like that. Letsencrypt should serve its users, not force them onto anything. If I think that I should generate ke…

No one is stopping you from getting a 1-year cert from another CA and using that.

If you do not like the process LetsEncrypt uses, then you are not in their target market. That's fine; move on and use something else.

> I remember chinese websites issuing 3-year certificates. Wosign or something like that. That was the best experience I've ever had.

I remember Wosign! Man, what a terrible experience. The last thing I want is be forced to do system administration tasks manually by clicking around on a website. To be fair, it was great that it was available for its time, but I would never want to go back to something like that.

Re: A Year-End Letter from our Executive Director

#138

Post by tomnipotent »

belorn wrote: post #92
0goel0 wrote: post #78

Earlier quoted context omitted.

> stopped donating to Wikipedia after the size of their cash reserves were revealed. After I read your comment, I thought they had 10x annual expenses or something but really they have 18 months of runway. That's not that long IMO. https://www.washingtonpost.com/news/the-intersect/wp/2015/12...

18 months runway is included all expenses including wages, awards (that Mozilla gives out, for example to political initiatives), travel, social events and so on. If we only looked at costs related to hosting the website they have almost 100 years. They got total assets of 191 millions, and the website hosting costs are 2.4 millions each year. 55 millions each year goes to wages (up from 46 millions previous year). h…

That's the cost of hosting, not the cost of operations. A business the size of Wikipedia doesn't run itself, and being a nonprofit doesn't magically make operations disappear.

Re: A Year-End Letter from our Executive Director

#139

Post by manuelmoreale »

kelnos wrote: post #132
CodesInChaos wrote: post #16

Earlier quoted context omitted.

A plain domain validated certificate cost like $10 for a year or two. So roughly the same cost as the domain name. Hardly a "high paywall".

Don't most domains cost $5 or less? I think it's pretty outrageous to have to spend 2x (or more) of the domain name cost to secure connections to it.

Not sure where you found that figure but most domains definitely don’t cost 5 or less. Most domains are 10+ in my experience.
Post reply on HN