7 ms·

So unfair! Comodo once, a while ago, also thought about using IPv6! But seriously: letsencrypt is doing excellent work. It's a great case study in how ineffici

So unfair! Comodo once, a while ago, also thought about using IPv6! But seriously: letsencrypt is doing excellent work. It's a great case study in how inefficient a mostly-free market can be: SSL adoption doubled within a year. All that was previously deadweight loss.

mtgx 10y ago
> So unfair! Comodo once, a while ago, also thought about using IPv6! In case anyone doesn't get it: http://arstechnica.com/tech-policy/2016/06/800-pound-comodo-tries-to-trademark-upstart-rivals-lets-encrypt-name/ http://arstechnica.com/tech-policy/2016/06/800-pound-comodo-...
yuhong 10y ago
This also reminds me of SGC certificates where browsers only trusted a limited number of roots.
- DanielDent 10y ago
  SGC certificates were entirely a result of bizarre US export restrictions.
icebraining 10y ago
1It's a great case study in how inefficient a mostly-free market can be: SSL adoption doubled within a year. All that was previously deadweight loss. And also in how a market fixes itself :)
- nightpool 10y ago
  Let's Encrypt is a non-profit organization run as a public service by the Internet Security Research Group. Not exactly the same thing as a competing company. Market forces are not compelling these people to donate money, they're doing it because they believe in the goals of the organization.
  - teekert 10y ago
    Nicely enough, this is made possible by the freedoms in the current market (economic system.) One should not forget that the freedom to donate ones' work is also part of a free market. I like this interview with Linus Torvalds [0, 1] where he admits it was for his pleasure and thus for his personal gain that he made Linux. Rational self-interest does not require financial rewards to be satisfactory. It did make him a millionaire in the end though (because Red Hat gave him stock options). This also show how he can be a dick sometimes while still being of immeasurable value to the global economy. He does it because he likes it, not because he likes you or wants you to like him. [0] https://www.theobjectivestandard.com/2012/06/linux-creator-linus-torvalds-celebrates-rational-selfishness/ https://www.theobjectivestandard.com/2012/06/linux-creator-l... [1] http://www.bbc.com/news/technology-18419231 http://www.bbc.com/news/technology-18419231
    - vertex-four 10y ago
      While true, the economic environment is also geared towards an assumption that you'll provide the vast majority of your work to a company that takes ownership of the results and directly pays you for it. In my country, the majority of the current generation will likely never own a house, let alone be financially comfortable enough to work on a social project full-time. The result is that the only way for someone who isn't wealthy to do charitable work is to get either Government or companies to pay you to do it. Companies will generally only pay you to do work if they're getting something out of it, and Government has its own interests at heart. Getting people to pay you to do something is very, very difficult - it's hard enough if you're selling them something directly and right now, significantly harder if you're still working on a project, and harder still if there might not be anything concretely benefiting the person donating at the end of it. Charities largely manage by not paying many of the people who perform work for them, along with begging money from Government and companies, and their volunteers primarily depend on Government welfare. It's not a perfect system in the slightest - it's incredibly hard work to be able to perform any sort of charitable work, at least as hard as running a business, and is heavily subsidized. A system which ensured that everyone's needs were met by default, rather than requiring you to prove that you deserve to have your needs met, would allow significantly more charitable work - specifically, it would allow for work that rewards the worker in ways other than monetary pay.
zanny 10y ago
There is no such thing as a free market when certificates were only created and issued by those who had the political clout to get their authority in the Microsoft / Google / Mozilla trusted keyring or in the trust network of another trusted provider. A free market is one where you can compete independently. If anything, it is a demonstration of why faux-markets with monopoly control (or in this case, the collusion between established and trusted authorities to prevent competition) are dangerous.
- iancarroll 10y ago
  What? Anyone can become a certificate authority, so long as you'll take the time to document your procedures, store the private key securely, and be externally audited. You probably want an insurance policy as well. The only program that charges money to be included is/was Oracle, as far as I know. Everyone else is free.
  - Chlorus 10y ago
    What's the premium look like for an insurance policy for a private key?
    - cmdrfred 10y ago
      What does it cover, exactly? Every loss from misuse of the key? Sounds expensive.
  - viraptor 10y ago
    Everyone else charges indirectly. Inclusion is free, you "only" need to go through someone like webtrust who will charge you $100k+ for an audit.
    - superuser2 10y ago
      So? Relying on commercial auditors to verify compliance with published industry standards is a pretty common free-market solution to problems of trust.
lmm 10y ago
Was it the same market though? Or is the shift largely driven by Google's ranking changes in that period?

mtgx 10y ago

> So unfair! Comodo once, a while ago, also thought about using IPv6! In case anyone doesn't get it: http://arstechnica.com/tech-policy/2016/06/800-pound-comodo-tries-to-trademark-upstart-rivals-lets-encrypt-name/ http://arstechnica.com/tech-policy/2016/06/800-pound-comodo-...

yuhong 10y ago

This also reminds me of SGC certificates where browsers only trusted a limited number of roots.

DanielDent 10y ago
SGC certificates were entirely a result of bizarre US export restrictions.

icebraining 10y ago

1It's a great case study in how inefficient a mostly-free market can be: SSL adoption doubled within a year. All that was previously deadweight loss. And also in how a market fixes itself :)

nightpool 10y ago
Let's Encrypt is a non-profit organization run as a public service by the Internet Security Research Group. Not exactly the same thing as a competing company. Market forces are not compelling these people to donate money, they're doing it because they believe in the goals of the organization.
- teekert 10y ago
  Nicely enough, this is made possible by the freedoms in the current market (economic system.) One should not forget that the freedom to donate ones' work is also part of a free market. I like this interview with Linus Torvalds [0, 1] where he admits it was for his pleasure and thus for his personal gain that he made Linux. Rational self-interest does not require financial rewards to be satisfactory. It did make him a millionaire in the end though (because Red Hat gave him stock options). This also show how he can be a dick sometimes while still being of immeasurable value to the global economy. He does it because he likes it, not because he likes you or wants you to like him. [0] https://www.theobjectivestandard.com/2012/06/linux-creator-linus-torvalds-celebrates-rational-selfishness/ https://www.theobjectivestandard.com/2012/06/linux-creator-l... [1] http://www.bbc.com/news/technology-18419231 http://www.bbc.com/news/technology-18419231
  - vertex-four 10y ago
    While true, the economic environment is also geared towards an assumption that you'll provide the vast majority of your work to a company that takes ownership of the results and directly pays you for it. In my country, the majority of the current generation will likely never own a house, let alone be financially comfortable enough to work on a social project full-time. The result is that the only way for someone who isn't wealthy to do charitable work is to get either Government or companies to pay you to do it. Companies will generally only pay you to do work if they're getting something out of it, and Government has its own interests at heart. Getting people to pay you to do something is very, very difficult - it's hard enough if you're selling them something directly and right now, significantly harder if you're still working on a project, and harder still if there might not be anything concretely benefiting the person donating at the end of it. Charities largely manage by not paying many of the people who perform work for them, along with begging money from Government and companies, and their volunteers primarily depend on Government welfare. It's not a perfect system in the slightest - it's incredibly hard work to be able to perform any sort of charitable work, at least as hard as running a business, and is heavily subsidized. A system which ensured that everyone's needs were met by default, rather than requiring you to prove that you deserve to have your needs met, would allow significantly more charitable work - specifically, it would allow for work that rewards the worker in ways other than monetary pay.

zanny 10y ago

There is no such thing as a free market when certificates were only created and issued by those who had the political clout to get their authority in the Microsoft / Google / Mozilla trusted keyring or in the trust network of another trusted provider. A free market is one where you can compete independently. If anything, it is a demonstration of why faux-markets with monopoly control (or in this case, the collusion between established and trusted authorities to prevent competition) are dangerous.

iancarroll 10y ago
What? Anyone can become a certificate authority, so long as you'll take the time to document your procedures, store the private key securely, and be externally audited. You probably want an insurance policy as well. The only program that charges money to be included is/was Oracle, as far as I know. Everyone else is free.
- Chlorus 10y ago
  What's the premium look like for an insurance policy for a private key?
  - cmdrfred 10y ago
    What does it cover, exactly? Every loss from misuse of the key? Sounds expensive.
- viraptor 10y ago
  Everyone else charges indirectly. Inclusion is free, you "only" need to go through someone like webtrust who will charge you $100k+ for an audit.
  - superuser2 10y ago
    So? Relying on commercial auditors to verify compliance with published industry standards is a pretty common free-market solution to problems of trust.

lmm 10y ago

Was it the same market though? Or is the shift largely driven by Google's ranking changes in that period?