Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Year-End Letter from our Executive Director

letsencrypt.org

Post reply on HN
Print view View original

141–150 of 155 posts

Re: A Year-End Letter from our Executive Director

#141

Post by belorn »

tomnipotent wrote: post #138
belorn wrote: post #92

Earlier quoted context omitted.

18 months runway is included all expenses including wages, awards (that Mozilla gives out, for example to political initiatives), travel, social events and so on. If we only looked at costs related to hosting the website they have almost 100 years. They got total assets of 191 millions, and the website hosting costs are 2.4 millions each year. 55 millions each year goes to wages (up from 46 millions previous year). h…

That's the cost of hosting, not the cost of operations. A business the size of Wikipedia doesn't run itself, and being a nonprofit doesn't magically make operations disappear.

There is no upper bound on how much profit they can take out as wages, and there is no lower bound either. They don't need to match wages with oil companies.

Charities have a common guideline that a maximum of 25% of donations is allowed to go to operations of the charity and minimum of 75% must go to the purpose of the charity. That mean if you donate to cancer research, 75% should go to cancer research and a maximum 25% to operational costs of the charity. I personally find 25% to still be too high.

Re: A Year-End Letter from our Executive Director

#142

Post by gray_charger »

throw0101c wrote: post #60
tux3 wrote: post #35

Let's Encrypt has had such a positive impact, I think I'll start donating to them instead of Wikipedia. They're a lot more subtle with their calls to donate, but they seem to deliver a lot of good things to a lot of users, with a much smaller budget. I'm just really grateful for the service, and glad to see the Prossimo work continuing as well. (On a tangential note, I suspect the way Let's Encrypt makes me feel is t…

> Let's Encrypt has had such a positive impact, I think I'll start donating to them instead of Wikipedia. If you want a web-related alternative also consider archive.org (and their Wayback Machine).

They are not an archive the web, instead electing to remove websites they find distasteful. Not a reliable source of information thus not worth the donation.

Re: A Year-End Letter from our Executive Director

#143

Post by iuafhiuah »

rainsford wrote: post #71
iuafhiuah wrote: post #43

I am glad it looks like the IETF ACME specification only addresses the HTTP-01 challenge. I really would like to see improvements made to the DNS-01 challenge before it's ratified, namely, let us publish a public key to a TXT record and use the private key to sign the renewal request. Then I can revoke certbot's access to my DNS records and stop hacking the `.well-known` path.

I'll admit I haven't spent a ton of time thinking through all the implications, but that proposal seems like it comes with some significant security tradeoffs. In particular, you'd lose the ability to prove you control the domain name at the time of certificate renewal. Instead, the key pair approach shows you controlled the DNS records for the domain at some point and your entry has yet to be deleted. From the certi…

I don't see announcing a public key being much different to PGP or other trust systems. If I say I sign my messages with `63847B4B83930F0C` and you save that information you'll continue to trust that it's me in the future even though there is no proof I still control the private key.

If anything, as far as I'm concerned, DNS-based challenges are a stronger proof that I own the domain as it requires access to the nameserver. HTTP-based challenges just prove that I have access to a computer pointed to by a DNS record which is far easier to get wrong. This is why wildcard domains cannot be issued to HTTP challenges, just because I can serve a file on a subdomain doesn't mean I own the parent domain.

But I agree, using a key-based DNS challenge would be a new feature. It was discussed before but at the time LE devs didn't come to a consensus with how to move it forwards.

Re: A Year-End Letter from our Executive Director

#144

Post by iuafhiuah »

rossy wrote: post #113
iuafhiuah wrote: post #43

I am glad it looks like the IETF ACME specification only addresses the HTTP-01 challenge. I really would like to see improvements made to the DNS-01 challenge before it's ratified, namely, let us publish a public key to a TXT record and use the private key to sign the renewal request. Then I can revoke certbot's access to my DNS records and stop hacking the `.well-known` path.

If your concern is that certbot has access to your DNS records, you can set up a CNAME or NS record on _acme-challenge.your-domain and serve the TXT record from a separate, isolated DNS server.

That's an interesting solution to mitigating risk. I wasn't aware that LE would follow a CNAME to a different TXT record.

Although it does require an additional NS which is an additional maintenance overhead - that is preferable to leaving automated services sitting around with write access to important domains. At least until I can stop regularly writing DNS records.

Re: A Year-End Letter from our Executive Director

#145

Post by ipaddr »

kelnos wrote: post #134
ipaddr wrote: post #116

Earlier quoted context omitted.

The full quote was: "frankly I don't care to know the details" I take issue with that statement not the person. The statement was honest and matter of fact. Few know how SSLs work, few have time or opportunity or even desire to learn it. Not 'wanting' to understand the details goes against what I would expect. A programmer tries to/needs to understand how the world works. Not wanting to understand the entire stack is…

> Not wanting to understand the entire stack is a new concept to me. Then I'd suggest that your experience about the world, and about people in general, is severely lacking. There aren't enough hours in a day or years in a life to learn everything, so we have to be selective. Do you know how CPUs work, down to the various functional units and pipeline stages and how they work together? Can you explain to me how trans…

Are programmers losing that childhood curiosity for how things work? Do programmers even value that anymore? Should that be the filter employers use to select candidates vs leetcode?

People may think they are Cool or special for millions of reasons (like not knowing what ssl is for example).

Re: A Year-End Letter from our Executive Director

#146

Post by ipaddr »

kelnos wrote: post #135
progmetaldev wrote: post #84

Earlier quoted context omitted.

I agree somewhat, but this is about programming in the web stack. SSL should be familiar, we aren't speaking about general programming here.

I think there are a lot of perfectly good programmers who work at the level of the web stack, but couldn't set up a web server with TLS to save their life. There's nothing wrong with that, and suggesting that there is, is just a form of technology elitism and gatekeeping.

This isn't about being able to. I've love to setup machine learning but lack the understanding. It's about taking pride in not having to learn.. taking pride in not having to understand how things work.

Technology shouldn't be a blackbox and shouldn't be celebrated as such.

Re: A Year-End Letter from our Executive Director

#147

Post by jjulius »

ipaddr wrote: post #145
kelnos wrote: post #134

Earlier quoted context omitted.

> Not wanting to understand the entire stack is a new concept to me. Then I'd suggest that your experience about the world, and about people in general, is severely lacking. There aren't enough hours in a day or years in a life to learn everything, so we have to be selective. Do you know how CPUs work, down to the various functional units and pipeline stages and how they work together? Can you explain to me how trans…

Are programmers losing that childhood curiosity for how things work? Do programmers even value that anymore? Should that be the filter employers use to select candidates vs leetcode? People may think they are Cool or special for millions of reasons (like not knowing what ssl is for example).

Who says they've lost the curiosity? What if all of their programming effort and energy is put into whatever the website is for? Why should they shift their focus over to learning all about SSL when that's not the point of whatever the project is and it will suck up too much time?

I could absolutely be wrong about that reasoning, though, but that's my point - we don't know why, so why assume a negative and then lean into that?

Re: A Year-End Letter from our Executive Director

#148

Post by [deleted] »

meepmorp wrote: post #57
HWR_14 wrote: post #46

Earlier quoted context omitted.

And make it almost impossible to use an out of date or self-signed cert. Some browsers make you click 3 times you know what you are doing, others don't seem to let you at all.

From the client perspective, the difference between a self-signed certificate and a fake one that's part of MITM, etc., is completely invisible. It should be hard to get to ostensibly secured sites that can't prove they are who they say they are, and you don't want to train uses to just click through.

[deleted]

Re: A Year-End Letter from our Executive Director

#149

Post by HWR_14 »

meepmorp wrote: post #57
HWR_14 wrote: post #46

Earlier quoted context omitted.

And make it almost impossible to use an out of date or self-signed cert. Some browsers make you click 3 times you know what you are doing, others don't seem to let you at all.

From the client perspective, the difference between a self-signed certificate and a fake one that's part of MITM, etc., is completely invisible. It should be hard to get to ostensibly secured sites that can't prove they are who they say they are, and you don't want to train uses to just click through.

It's not invisible. An expired certificate is treated as worse than no certificate. All I want is for it to be easy enough to view it as an insecure site and stop trying to force me to https when there is a bad cert.

Re: A Year-End Letter from our Executive Director

#150

Post by tomnipotent »

belorn wrote: post #141
tomnipotent wrote: post #138

Earlier quoted context omitted.

That's the cost of hosting, not the cost of operations. A business the size of Wikipedia doesn't run itself, and being a nonprofit doesn't magically make operations disappear.

There is no upper bound on how much profit they can take out as wages, and there is no lower bound either. They don't need to match wages with oil companies. Charities have a common guideline that a maximum of 25% of donations is allowed to go to operations of the charity and minimum of 75% must go to the purpose of the charity. That mean if you donate to cancer research, 75% should go to cancer research and a maximu…

You've confused some words and missed the forest for the trees. It's recommended they spend 65% on program activities for certain third party charity ratings, for which Wikimedia Foundation passes.
Post reply on HN