F-Droid site certificate expired

Being entirely based on FOSS is the #1 overarching priority of the entire F-Droid project and always has been. The person who blatantly didn't even bother to check the organization they're talking to, and offered up unsolicited spam for a pointless service... is the one engaging in snobbery.

> Some progress is better than none, and it's still nice that my ISP can't snoop on me any more. Unfortunate, TLS also took away my ability to inspect my own traffic! This makes it more difficult for me to monitor what my OS and browser vendor are doing, and as I've said previously, i trust these parties comparatively less than my ISP.

It might be more correct to say that Certificate Pinning made it so you can't inspect your own traffic - for sites with TLS but without certificate pinning, you can just as easily create your own root certificate and force the browser and OS to trust the cert by installing it at the OS level. This is (part of, atleast) how tools like Fiddler and Charles Proxy allow you to inspect HTTPS traffic, the other part being a mitm proxy that replaces the server's actual cert with one the mitm proxy generates [0]

[0]: https://www.charlesproxy.com/documentation/proxying/ssl-prox...

In caddy it takes more effort to NOT have https.

> I still don't understand why this is so terrible.

While I don't really have a scary threat model, I don't love the idea that my ISP could have been watching my traffic. Maybe there's a world where my government has ordered ISPs to log specifics about traffic in order to trap dissidents doing things they don't like. But sure, I live in the US, which isn't (yet) an authoritarian nightmare (yet!). But maybe I live in Texas, and I'm searching for information about getting an abortion (illegal to have one there in most cases). Maybe I'm a schoolteacher in Florida, and I'm searching information on critical race theory (a topic banned from instruction in Florida schools). I want that traffic to be private.

> Even with HTTPS, the companies behind my OS and web browser can still see everything I do, so in exchange for all this work we've removed maybe 1 out of 3 parties from the equation

I mean, that's on you for using a proprietary OS owned by a for-profit corporation. I get that desktop Linux or a de-Googled Android phone isn't for everyone, but those are options you have, if you're really worried.

And there are quite a few major browsers that are open source, so even if you can't inspect their traffic at runtime, if you really are truly serious about this, you can audit their source code and do your own builds. Yes, I would consider that unnecessarily paranoid, but the option is there for you, and you can even run these browsers on proprietary OSes. And honestly, I assume you use Chrome anyway; if that's the case then you clearly are not serious about this if you're using a web browser made by an advertising company. (If you're using something else: awesome, and apologies for the bad assumption.)

> Unfortunate, TLS also took away my ability to inspect my own traffic! This makes it more difficult for me to monitor what my OS and browser vendor are doing

You can still do this, but it does require more work setting up your own CA and installing it as trusted in your own devices, and them MitM'ing your traffic at the router in order to present a cert from your CA before forwarding the connection on to the real site.

Yes, this is out of reach for the average home internet user, but if you are the kind of person who is thinking about doing traffic monitoring on your home network, then you have the skills to do this. Meanwhile, the other 99% of us get better privacy online; I think that's a perfectly fine trade off.

> and as I've said previously, I trust [my OS and browser vendor] comparatively less than my ISP.

My ISP is Comcast; even if my OS and browser vendor was Microsoft or Apple, I think I'd probably still trust Comcast less. Fortunately my OS and browser vendors are not Microsoft or Apple, so I don't have to worry about that, but still.

> Sure, but it's also trivial to just throw up a website on Github Pages, or forgo the website completely and use Instagram. TLS is "trivial" if you rely the infrastructure of a specific external party.

Running a website, even from your home internet connection, still means relying on the infrastructure of a third party. There's no way to get away from that.

And you still can run one without TLS. Browsers will still display unencrypted pages, though I'll admit that I'd be unsurprised if some future versions of major browsers stopped allowing that, or made it look scary to your average user.

> Please help me understand what I'm missing because I find this really frustrating!

I think what you are missing is that people actually do value connection encryption, for real reasons, not paranoid, tin-foil-hat reasons. And while you do present some valid downsides, we believe those downsides are overblown, or at the very least worth it in the trade off. It's fine for you to not agree with that trade off, which is a shame, but... that's life.

> We now provide a completely free certs for a malicious web-sites

Malicious websites never had a problem buying certs before. Sure, the bar is lower now, but I don't think it was a particularly meaningful bar before. Besides, the most common ways to get malicious websites shut down are to get their webhost to cut them off, or get a court order to seize their domain name. Getting their TLS cert revoked isn't common, and doesn't really do the job anyway.

> Degraded encryption value so much it's not even indicated anymore (remember the green bar for EV?)

No, we've degraded the identity verification afforded by EV and those former browser features. Remember that the promise of SSL/TLS was two things: 1) your traffic is private, 2) it verifies that the server you thought you were contacting is actually the one you reached.

I think (2) was always going to be difficult: either you make it hard and expensive to acquire TLS certificates, and (2) has value, or you don't, and it doesn't. I think pervasive encryption is way more important than site owner identity validation. And I don't think the value of an EV cert was even all that high back when browsers called them out in their UI. There are lots of examples of people trivially managing to get an EV cert from somewhere, with their locally-registered "Stripe, LLC" or whatever in the "validated" company name field of their cert.

> Pavlov-trained everyone to dumb-click through 'this page is not secure' warnings

Not sure what that has to do with this. That was more of a problem back when we didn't have Let's Encrypt, so lots of people were using self-signed certs, or let their certs expire and didn't fix it, or whatever. These days I expect certificate warnings are fairly rare, and so users might actually start paying attention to them again.

> SNI exists and even without it anything not on CDN is blocked very easily

ESNI also exists, and while not being available everywhere, it'll get there. But this is a bizarre complaint, as it's entirely trivial to block traffic when there's no TLS at all.