3 ms·

Let's encrypt really helps get ssl everywhere. It is not super easy to set it up, but I am sure this will get better as time goes, this is huge.

RKearney 11y ago
Let's Encrypt makes an effort not to use "ssl" anywhere on their site when they really mean tls or https. I'd also hope that no one helps get ssl anywhere given the vulnerabilities that come with it.
- desireco42 11y ago
  Can you explain me a little, I am not sure I understand all the points. I can't say I follow everything that is happening in crypto world, I just know I could use free ssl cert for small sites and I have one personal one that I was able to 'secure' with Let's Encrypt cert. As someone said, if it could work, just by saying SSL yes, it would help a lot.
  - mholt 11y ago
    Technically, SSL is the name of the older protocol that TLS replaced. TLS builds upon SSL so that it's more secure. Unfortunately, SSL is still the ubiquitous term, it seems, but we really should start saying TLS now so as not to confuse unsuspecting site owners / sysadmins.
  - _fs 11y ago
    SSL is a dead protocol that has major vulnerabilities. It no longer has support and anyone still using it should really move on. TLS is the recommended replacement protocol that is still secure. HTTPS can be thought of as secure http, regardless of protocol.
  - desireco42 11y ago
    Thank you both. Understand.
cm2187 11y ago
It will have to. Where it will add value is making https available at the fingertips of website creators who don't really know what it does and have no idea of how to set it up. They are the one responsible for the current amount of unencrypted traffic. Making free certificates available to hackernews readers who are already convinced of the need for encryption, are tech savy enough to implement it themselves following best practices isn't helping much to encrease encrypted traffic. These users would have used a commercial certificate anyway. Which is why it is crucial that the client be integrated by default in the web server (apache, IIS, etc) for the target audience to use it without having to understand how it works.

RKearney 11y ago

Let's Encrypt makes an effort not to use "ssl" anywhere on their site when they really mean tls or https. I'd also hope that no one helps get ssl anywhere given the vulnerabilities that come with it.

desireco42 11y ago
Can you explain me a little, I am not sure I understand all the points. I can't say I follow everything that is happening in crypto world, I just know I could use free ssl cert for small sites and I have one personal one that I was able to 'secure' with Let's Encrypt cert. As someone said, if it could work, just by saying SSL yes, it would help a lot.
- mholt 11y ago
  Technically, SSL is the name of the older protocol that TLS replaced. TLS builds upon SSL so that it's more secure. Unfortunately, SSL is still the ubiquitous term, it seems, but we really should start saying TLS now so as not to confuse unsuspecting site owners / sysadmins.
- _fs 11y ago
  SSL is a dead protocol that has major vulnerabilities. It no longer has support and anyone still using it should really move on. TLS is the recommended replacement protocol that is still secure. HTTPS can be thought of as secure http, regardless of protocol.
- desireco42 11y ago
  Thank you both. Understand.

cm2187 11y ago

It will have to. Where it will add value is making https available at the fingertips of website creators who don't really know what it does and have no idea of how to set it up. They are the one responsible for the current amount of unencrypted traffic. Making free certificates available to hackernews readers who are already convinced of the need for encryption, are tech savy enough to implement it themselves following best practices isn't helping much to encrease encrypted traffic. These users would have used a commercial certificate anyway. Which is why it is crucial that the client be integrated by default in the web server (apache, IIS, etc) for the target audience to use it without having to understand how it works.