3 ms·

I can't believe that they not only decided not to implement ACME (the protocol behind Let's Encrypt), but also not to at least reuse large portions of ACME, lik

by pfg 10y ago

I can't believe that they not only decided not to implement ACME (the protocol behind Let's Encrypt), but also not to at least reuse large portions of ACME, like the way HTTP ownership validation was implemented. It's simply mind-boggling how they would discard a protocol that has received a lot of attention from various security experts. What's more, this design could not have been reviewed by anyone familiar with how the web works - allowing users to chose the path for HTTP domain validation is so incredibly dangerous ... sigh. If you're curious if there are any rules for CAs that describe how domain validation must be performed, the current Baseline Requirements can be summarized with "do something that's safe" on that topic. A working group within the CA/B Forum[1] is currently working on revising the document and adding explicit rules declaring which methods are permitted. I believe [2] is the latest draft. [1]: https://cabforum.org/mailman/listinfo/validation https://cabforum.org/mailman/listinfo/validation [2]: https://github.com/cabforum/documents/pull/25/files?short_path=7f6d14a#diff-7f6d14a20e7f3beb696b45e1bf8196f2 https://github.com/cabforum/documents/pull/25/files?short_pa...

ComodoHacker 10y ago
My guess is simple. As software design and development was not part of their product life-cycle, they outsourced both client and API to whomever bid least on Upwork.
regecks 10y ago
FWIW I got in contact with their R&D team earlier last week and they told me: no StartEncrypt API now, later it will support IETF ACME, maybe open source.
- dopamean 10y ago
  I really don't understand why they wouldn't just implement ACME first if they really do plan on getting around to it. What benefit do they really have of trying to go out on their own on this?
  - jerf 10y ago
    "What benefit do they really have of trying to go out on their own on this?" Apparently, "substantially negative". Grabbing an open-source ACME implementation really is the canonical value proposition for open source. Work together to make it secure, every individual contributor (once it exists) does less work over all, and even had they successfully implemented StartEncrypt the first time, the value would be in hosting it and attaching their reputation to it, not the API design. So even the usual objections to using open source in a commercial setting hardly apply. There's not much in the way of "look and feel", and no matter how this was going to happen the actual "polish" was going to be done by creating a new website that they could make as polished as they like with no trouble. In other words, they have comprehensively flubbed this. Even once the code is fixed, the reputation damage is done. Don't. Implement. Crypto.
- TD-Linux 10y ago
  Neat. Maybe they can even put license compliance on their roadmap (they statically linked in OpenSSL).

by pfg 10y ago

ComodoHacker 10y ago

My guess is simple. As software design and development was not part of their product life-cycle, they outsourced both client and API to whomever bid least on Upwork.

regecks 10y ago

FWIW I got in contact with their R&D team earlier last week and they told me: no StartEncrypt API now, later it will support IETF ACME, maybe open source.

dopamean 10y ago
I really don't understand why they wouldn't just implement ACME first if they really do plan on getting around to it. What benefit do they really have of trying to go out on their own on this?
- jerf 10y ago
  "What benefit do they really have of trying to go out on their own on this?" Apparently, "substantially negative". Grabbing an open-source ACME implementation really is the canonical value proposition for open source. Work together to make it secure, every individual contributor (once it exists) does less work over all, and even had they successfully implemented StartEncrypt the first time, the value would be in hosting it and attaching their reputation to it, not the API design. So even the usual objections to using open source in a commercial setting hardly apply. There's not much in the way of "look and feel", and no matter how this was going to happen the actual "polish" was going to be done by creating a new website that they could make as polished as they like with no trouble. In other words, they have comprehensively flubbed this. Even once the code is fixed, the reputation damage is done. Don't. Implement. Crypto.
TD-Linux 10y ago
Neat. Maybe they can even put license compliance on their roadmap (they statically linked in OpenSSL).