Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Year-End Letter from our Executive Director

letsencrypt.org

Post reply on HN
Print view View original

61–70 of 155 posts

Re: A Year-End Letter from our Executive Director

#61

Post by nicce »

DiggyJohnson wrote: post #55
stolen_biscuit wrote: post #44

Earlier quoted context omitted.

What a bizarre comment. These two aren't competing?

Wikipedia Foundation and Firefox are some of the most well known internet/tech services non-profits out there. This person is advertising their consideration of donating to LE instead of Wikipedia, and by doing so encouraging others to consider the same. That’s allllll that’s happening here.

Firefox is made by for-profit Mozilla Corporation and non-profit parent Mozilla Foundation has quite little role in these days.

Re: A Year-End Letter from our Executive Director

#62

Post by lelandfe »

dmix wrote: post #59
dado3212 wrote: post #56

Earlier quoted context omitted.

Can also attest to them having comfy t-shirts if you're interested in that option.

How do you get a t-shirt? Is there a merch store or just via donations?

Looks like it's just for occasional donation drives. They apparently had one earlier this year: https://news.ycombinator.com/item?id=32003246

Re: A Year-End Letter from our Executive Director

#63

Post by TillE »

bogwog wrote: post #58
kevinh wrote: post #18

Earlier quoted context omitted.

It's perfectly reasonable for someone to be into programming and not want to have to care about the details of setting up a networking stack.

Ok I get not wanting to pick on the guy, but is that really reasonable? Engineering is about solving problems by designing/implementing systems. The more you know about the system(s) you're working with, the better the solutions you can build. Even if you're "just" working at a high level and maximally specialized to a single niche, not knowing how the underlying parts work will really limit you. Pick the brain of an…

Right obviously very few people will be deep experts on the nitty gritty details of any particular thing, but it's weird to work with computers and not have a broad high-level understanding of something as crucial as TLS and PKI.

Re: A Year-End Letter from our Executive Director

#64

Post by ipaddr »

jjulius wrote: post #25
ipaddr wrote: post #12

Earlier quoted context omitted.

An Ex-facebook ml engineer who doesn't know what ssl is and takes pride in not having to learn it? Not sure it's a downside/upside thing. It might shed light on the types of people who get hired at facebook.

Sorry, we're giving an ML engineer grief for not knowing much about SSL? Should we tease dentists for not knowing how to grow oranges, too?

Not for not knowing but for being proud that they don't have to.

Re: A Year-End Letter from our Executive Director

#65

Post by duskwuff »

bombcar wrote: post #48
piperswe wrote: post #41

Earlier quoted context omitted.

If people want longer certificate lifespans, they can get their certificates elsewhere. Part of the deal with getting a free certificate is that you're supposed to set up autorenewal with ACME. If you can't or don't want to do that, there are plenty of other CAs out there that will get you a long-life certificate.

Nobody offers more than a year now. It’s annoying. So many old devices still need to be supported and can’t automatically update.

> Nobody offers more than a year now.

Correct, because the CA/Browser Forum no longer permits CAs to issue certificates with validity longer than 13 months:

https://pkic.org/2020/07/09/one-year-certs/

Re: A Year-End Letter from our Executive Director

#66

Post by Thiez »

doublerabbit wrote: post #53
ethbr0 wrote: post #13

Earlier quoted context omitted.

Indeed! It's how security should work, and should be the default dual-goal of any piece of security software: provide as much security as possible to as many people as possible.

Quoted post unavailable.

I should hope HN hashes our passwords, instead of encrypting them. And for encrypted data I would expect them to use symmetric key encryption, rather than certificates with RSA or another form of public key cryptography.

Your post contains some very basic misconceptions. This is going to sound harsh, but I would recommend not putting too much stock in your own opinions on security, and instead to trust the experts.

Re: A Year-End Letter from our Executive Director

#67

Post by anderspitman »

We need someone to pull a Let's Encrypt in the identity space. A nonprofit that provides the convenience of single-click social login without the tracking. All it would need to do is provide a domain that verifies you control an email address, then let's services do OIDC flows to that domain to log you in.

Re: A Year-End Letter from our Executive Director

#68

Post by ay »

In all the excitement (I too think that they did massive strides in usability of https to the masses), nobody mentions of systems-level consequences of a single entity holding the keys to 300000000 servers on the internet. They’re now in a “don’t be evil” phase. But the people move on, change, etc. And the companies get sold, rogue, bankrupt…

I realize an org itself won’t fancy ponder its inevitable deviation from today’s course at some point in the future, but the netizens probably should…

(Sorry for sounding gloomy. :)

Re: A Year-End Letter from our Executive Director

#69

Post by shepherdjerred »

jmathai wrote: post #14
andirk wrote: post #8

Before Letsencrypt, SSL signing was cumbersome and downright scary sometimes. With cPanel + letsencrypt (or whatever their default Auto SSL provider is [0]), it's a few clicks and done. If there's a downside, I have never seen nor heard of it. Side note: I was expecting this CEO letter to end with layoffs. [0] https://docs.cpanel.net/whm/ssl-tls/manage-autossl/

I used to configure all of this manually on Apache following crappy instructions from online certificate providers. Copying .pem, .key, .csr files PRAYING Apache would start without complaining. I'm still old school but can set this up all using the letsencrypt command line utilities that configure everything for me. Oh, and whatever the hell GoDaddy's intermediate chain certificate was.

SSL with Apache gives me PTSD

Re: A Year-End Letter from our Executive Director

#70

Post by doublerabbit »

Thiez wrote: post #66
doublerabbit wrote: post #53

Earlier quoted context omitted.

Quoted post unavailable.

I should hope HN hashes our passwords, instead of encrypting them. And for encrypted data I would expect them to use symmetric key encryption, rather than certificates with RSA or another form of public key cryptography. Your post contains some very basic misconceptions. This is going to sound harsh, but I would recommend not putting too much stock in your own opinions on security, and instead to trust the experts.

Not harsh at all. I understand I am no security expert, bores the heck out of me. Sadly, you shouldn't trust the "experts" to be if that's LetsEncrypt. No one can be trusted apart from yourself when implementing security.

If LE is ran with the following companies, "Electronic Frontier Foundation; Mozilla Foundation; University of Michigan; Akamai Technologies; Cisco Systems"

What makes them all trade worthy, especially when they're all American? Especially after the whole Richard Stallman. Mozilla, maybe because they were netscape. I have more than enough experience working within security to know that.

I've seen SysOps leak DB's, Passwords in plaintext.. and I've seen it from the age of where such didn't exist to where companies are now installing X security appliances to safe guard there networks. I'm not newb, from 2004 to now, counted 15 years of System and Network engineer experience. Fair from experienced but well seasoned.

Why isn't HackerNews using LetsEncrypt, Google, Netflix, Amazon, if promoted as a great thing. Is what I want to know.

Post reply on HN