3 ms·

You can run the letsencrypt client as non-root, but it takes a greater degree of system configuration first. letsencrypt-auto in its current incarnation sure d

by jepler 11y ago

You can run the letsencrypt client as non-root, but it takes a greater degree of system configuration first. letsencrypt-auto in its current incarnation sure does run as root, however. The current state of affairs is to prioritize ease over running with the lowest degree of privilege that is feasible. (and there are other ACME-protocol implementations you can choose if you prefer not to run the letsencrypt client; ISTR reading about one implemented in Ruby) I do feel more negatively about their choice to use a third-party list of domains to blacklist, particularly since they can't offer any effective appeals process (they can't afford to have people in the loop AT ALL at a price of zero)

JoshTriplett 11y ago
> I do feel more negatively about their choice to use a third-party list of domains to blacklist, particularly since they can't offer any effective appeals process If your site appears on the malware list, then both Firefox and Chrome will produce giant warnings on your site that will cause almost everyone to refuse to browse there. So you'll have much bigger problems than not getting a certificate, and you will need to get yourself removed from that list anyway. (And, for that matter, figure out what got you on that list, such as running an ad script that serves malware, or having your server compromised and serving malware you don't know about.)
- jepler 11y ago
  I agree, if Google decides to blacklist your domain you basically own a pile of bitter bitter ashes. Is there an effective appeals process if this happens? I looked into it when LetsEncrypt announced their plans to use Google's backlists. Here's what I found for myself, copied from there [https://community.letsencrypt.org/t/the-cas-role-in-fighting-phishing-and-malware/2409/22 https://community.letsencrypt.org/t/the-cas-role-in-fighting...]: Google's Safe Browsing FAQ [https://developers.google.com/safe-browsing/safebrowsing_faq https://developers.google.com/safe-browsing/safebrowsing_faq] lists three types of sites which receive advisories: Phishing, Malware, and Unwanted Software. Two of the three types provide an appeals/delisting process, but "Unwanted Software" does not. However, it may be that LE's proposed use of the Safe Browsing API is only looking at the first two types.

by jepler 11y ago

JoshTriplett 11y ago

> I do feel more negatively about their choice to use a third-party list of domains to blacklist, particularly since they can't offer any effective appeals process If your site appears on the malware list, then both Firefox and Chrome will produce giant warnings on your site that will cause almost everyone to refuse to browse there. So you'll have much bigger problems than not getting a certificate, and you will need to get yourself removed from that list anyway. (And, for that matter, figure out what got you on that list, such as running an ad script that serves malware, or having your server compromised and serving malware you don't know about.)

jepler 11y ago
I agree, if Google decides to blacklist your domain you basically own a pile of bitter bitter ashes. Is there an effective appeals process if this happens? I looked into it when LetsEncrypt announced their plans to use Google's backlists. Here's what I found for myself, copied from there [https://community.letsencrypt.org/t/the-cas-role-in-fighting-phishing-and-malware/2409/22 https://community.letsencrypt.org/t/the-cas-role-in-fighting...]: Google's Safe Browsing FAQ [https://developers.google.com/safe-browsing/safebrowsing_faq https://developers.google.com/safe-browsing/safebrowsing_faq] lists three types of sites which receive advisories: Phishing, Malware, and Unwanted Software. Two of the three types provide an appeals/delisting process, but "Unwanted Software" does not. However, it may be that LE's proposed use of the Safe Browsing API is only looking at the first two types.