24 ms·
What It Costs to Run Let's Encrypt
- mimog 10y ago$2.06M for eight employees seems very steep
- hughes 10y agoApproximately 100% salary overhead is pretty standard, so eight $125k employees plus infrastructure and office costs sounds reasonable.
- unfunco 10y ago8 x $125K would be $1M, not the $2M that is currently being spent on employees. Edit: Missed the first part of that, I apologise. 100% overhead doesn't seem reasonable per employee to me though.
- klinskyc 10y agoit's (8125k) 2 since there is 100% overhead
- ddispaltro 10y agoHe said 100% overhead on top of salary
- cjbprime 10y agoYou missed the "100% salary overhead" part of the sentence. Consider taxes, benefits, insurance, other non-salary costs to employing people.
- jimktrains2 10y agoYou missed the 100% overhead. Even 50% overhead at a slightly higher salary wouldn't be surprising.
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- vtlynch 10y agoCan you explain why there would be 100% salary overhead? This seems quite high as a non business owner/operator.
- tjohns 10y agoTaxes, health care, other insurance (disability, etc.), and other benefits (401k, etc.) are a significant fraction of the cost to employ someone. These things are not cheap. The standard overhead is (I believe--correct me if I'm wrong!) anywhere from 25% to 100%, depending on your base salary and how competitive the benefits package is.
- bkanber 10y agoAt our company the overhead is about 40% of the salary, and could easily reach 80-100% with bigger and better benefits packages.
- zachlatta 10y agoEmployer taxes, standard benefits (health, vision, dental, etc), extra benefits (like free food, budget for books, and other niceties), and office space.
- morgante 10y agoNot really. Overhead doesn't scale linearly with pay. Once you're into 6 figures, it's definitely not equal. I'm guessing much more like $150-200k per employee in compensation.
- biztos 10y agoIs it really 100% in SF? That strikes me as high -- even in a lot of European countries it's not a full 100%. Anyway: considering what they do and where they do it, I don't find these numbers high at all. I would be shocked if they didn't have at least a couple engineers making over $200K in actual cash compensation if they're working in the Bay Area.
- PTRFRLL 10y agoMy thoughts as well. Roughly 250k per employee?
- wnevets 10y agoIf you want something this critical done correctly, is it really that steep?
- deleted 10y ago[deleted]
- unfunco 10y agoI'd like to see it broken down further by staff, it would be interesting to see the responsibilities of the "Executive Director" and weigh up the salary difference between that and the median salary of the rest of the team.
- adanto6840 10y ago250k per employee all-in (benefits, etc) doesn't seem that outrageous being in SF. Plus I'm guessing they're all high caliber employees given the scale of what they set out to do and what they've accomplished with a relatively small team.
- MustardTiger 10y ago"Being in SF" is a silly excuse. There is no reason for them to be in SF.
- ryanobjc 10y agoExcept the people already were there, and they want to stay there. The imaginary high caliber people who can do this in a low cost of living place are exactly that: imaginary.
- toomuchtodo 10y agoI fully endorse Let's Encrypt right to hire people solely from SF, but if you think high caliber people don't live in low cost of living places, you're either uneducated or purposely disingenuous. EDIT: Source: I work on a fully remote team (>50 people) with teammates around the world who are high caliber people.
- rrdharan 10y agoI think you can be more charitable in reading the GP's point; I certainly didn't interpret it the way you did or see it as a statement that high caliber people only live in SF or other high cost of living spaces. It was a response to the claim that "there's no reason for them to be in SF" which is an odd assertion. The point is that comparing an actual team with a purely hypothetical one is really just an exercise in imagination. These people exist, are competent, happen to live in San Francisco, and this organization has built a compelling product paying them what is likely lower than what they would earn at other employers in their region. As I understand it nothing is preventing another service from emerging that competes with Let's Encrypt and has a better cost structure. It may also be reasonable to refrain from donating to / funding Let's Encrypt if you feel that they are poorly managing their finances, but even that to is more productive than simply stating "this team should not be in SF".
- jedberg 10y agoThey have to compete with the rest of Silicon Valley. That's about what it costs to get a good engineer around here, when you count benefits.
- johansch 10y agoWhy would they have to be in Silicon Valley?
- jedberg 10y agoThey don't (and in fact I think they are mostly remote) but they still have to compete with it.
- RyJones 10y agoCorrect. LF has a small office in the Presidio, with perhaps a half dozen people living in SF proper and another dozen in the greater Bay Area. The rest of us are scattered around the US, Canada, Japan, and Australia.
- RyJones 10y agojust because LE competes with Silicon Valley in recruiting doesn't mean the employees are, or need to be, in Silicon Valley.
- bluedino 10y agoCouldn't this be ran out of Nowhere, Idaho though? Remote workers, etc.
- alan5 10y agoI assumed they were remote, otherwise I would have thought they would have premises costs stated. Rent, heating etc.
- jaas 10y agoThat's for ten employees, not eight. Salary + benefits. Could have been more clear in the post, but we have eight employees now and have budgeted for ten in 2017.
- zellyn 10y agoAssuming 100% overhead for benefits, etc., that's 100K per employee, which is quite low for Silicon Valley.
- jedberg 10y agoThe 100% overhead only applies to the "average" job. Health benefit costs are typically the biggest piece of the benefits puzzle and don't scale with salary. In SV the overhead is more like 25%.
- vtlynch 10y agoIts actually 2.06m for 10 employees: https://twitter.com/0xjosh/status/778283999609298944 https://twitter.com/0xjosh/status/778283999609298944
- alan5 10y agoI know in addition to salary there are other "hidden" costs like health care etc, but even taking that into account their employees must be taking home a pretty significant wage.
- lojack 10y agoWould the business perform any better if they were paying $2.05M for 20 employees? That's $100k per employee including overhead. Salaries would be significantly less than $100k. On paper it may sound better, but you end up with extra administrative overhead, and lower quality work. Could twice as many junior staff perform as well as that many senior staff? My guess would be no. Their staffing cost probably is on the higher end, but I'm guessing thats by design.
- jruroc 10y ago|$250k/employee hmmmm
- Descon 10y agoThey should consider running the service in Canada, where software engineer / programmer salaries are a third of that
- syshum 10y agoor 90% of the US that is not SF/Silicon Valley
- tjohns 10y agoBut they'd still be competing with Silicon Valley for top-end developers, who are going to be asking for a salary equivalent to their skills. You might save a little once you factor cost of living adjustments, though you'll also have to offset that with increased difficulty in finding the right person. Folks who know security well enough to do this correctly are rare. You don't want to farm out critical X.509 infrastructure to the lowest bidder.
- cc81 10y agoA follow up tweet clarified that it was 10 people and not eight. But even that is a pretty high cost per employee I agree. But the question is: Can you get a team of engineers that have the ability and crypto know-how to build something like Let's Encrypt in Canada for 1/3 of the salary?
- djaychela 10y agoI'm quite surprised - $2.06 on staffing seemed steep, so obviously read on as I was thinking that there must be a lot of employees. But 8? OK, I'm just a teacher, and I earn around £30k a year... not the kind of figures I've seen bandied about on here for graduate programmers who seem to be pulling in 8-10 times that for their first job... So I'd be interested to see a breakdown of the payroll (which I doubt would happen) - an average of $250k seem normal to others on here?
- walrus01 10y agopeople who seriously know how to code mission critical X.590 root CA PKI infrastructure are not cheap when you're looking at total benefits/compensation per head.
- MustardTiger 10y ago>people who seriously know how to code mission critical X.590 root CA PKI infrastructure are not cheap And they also aren't working at letsencrypt.
- eropple 10y agoYou've exhaustively enumerated those people, have you? I know a couple folks at Let's Encrypt in passing and they are at the top of my list of folks I would want writing code for me if I needed to trust it with, if not my life, most stuff up to that point.
- Dylan16807 10y agoI'm not saying they're right, but it's not hard to enumerate 3 or 8 people.
- MustardTiger 10y agoOk, but how little you value your life and how little you know about secure coding isn't useful to the rest of us.
- MichaelApproved 10y ago> We’re currently working to raise the money we need to operate through the next year. Please consider donating or becoming a sponsor if you’re able to do so! In the event that we end up being able to raise more money than we need to just keep Let’s Encrypt running we can look into adding other services to improve access to a more secure and privacy-respecting Web. Wouldn't they want to secure funding for 5+ years for existing services before considering adding other services?
- rocqua 10y agoI'd guess that the company-sponsors are on the hook for more than a year.
- mikeyouse 10y agoFunny to see people quibble over a few hundred thousand dollars when they're doing a substantial amount of the heavy lifting to encrypt the web. At over 10 million certificates issued in the past year, their staffing costs represent $0.20/cert. For those who've deployed with Let's Encrypt, did you get a quarter's worth of value from their service?
- 0xmohit 10y agoTo put in other words, if one considers donating a fraction of what would have been charged by any other certificate authority then we can be sure that LetsEncrypt would be able to continue to create a more secure web for all of us.
- koolba 10y ago> For those who've deployed with Let's Encrypt, did you get a quarter's worth of value from their service? The certificate price isn't even the issue. It's the signup + auto-renew! Before LE came out, I would have paid $100 to not have to 1) Not go through the hassle of manually ordering certs and 2) Not having to log back into servers to periodically update them. I get both of those with LE ... the fact that it's free? That's just icing on a very delicious cake!
- mrweasel 10y ago
- denfromufa 10y agono windows sadly
- denfromufa 10y agocan you explain why I'm downvoted?
- pfg 10y agoThere are a number of client options for windows[1]. [1]: https://letsencrypt.org/docs/client-options/#windows https://letsencrypt.org/docs/client-options/#windows
- denfromufa 10y agoseriously has anyone actually got to work any of these third-party options? Don't they all depend on IIS which is not free?
- pfg 10y agoMany of the clients above support something like certbot's webroot plugin, which is web server-agnostic and works by simply putting a verification file in your webroot and serving that to Let's Encrypt's validation server. Also: As far as I know, IIS is included with any Windows version (definitely any version of Windows Server).
- jimktrains2 10y ago"Hardware/Software" and "Hosting/Auditing" seem to be weird things to lump together. I wonder what software they pay for.
- hughes 10y agoThe services of Let's Encrypt, let alone the cause they stand for, is well worth a small recurring donation. I think this is totally reasonable to pledge even $2/mo.
- mrweasel 10y agoIf companies that uses Let's Encrypt would chip in just 1/10th of what they'd pay for certificate from for profit providers, then Let's Encrypt won't be in need of donation anytime soon.
- jedberg 10y agoTo everyone complaining about the $250K (see edit, it's actually 200K) per person in salary (which seems to be everyone at the moment), a few things to keep in mind: 1) That includes benefits 2) They are in Silicon Valley and have to compete with everyone else in Silicon Valley 3) Given what they have accomplished with such a small team, these are probably high caliber people. 4) In SV there is a good 25% premium you pay for engineers with security expertise. As someone who runs a business and has to hire talent, I can say that I'd consider myself lucky to get such a team for such a great price. Edit: A bunch of people are saying "why not remote". I think they are in fact mostly remote, but they still have to compete with SV wages because really good people command those wages whether they are here or not. Edit2: As has been pointed out multiple times, the blog post was not clear, and it is actually 200K per person, all in.
- vowelless 10y ago> I can say that I'd consider myself lucky to get such a team for such a great price I am concerned that they might be being underpaid for doing the type of work that they are. Let's Encrypt is not only a great service, but an important one too. I assume they have a good stock plan to make up.
- zachlatta 10y agoSince they're a project of the Linux Foundation, they most definitely don't have any sort of stock plan – since you can't have equity in nonprofits.
- generalledger 10y agoI don't want to put words in the parent commenter's mouth, but I think the implication was that they would need to make up for NOT having a stock plan.
- Anasufovic 10y agoNetflix level pay would seem about right to me.
- nappy-doo 10y agoFascinating. Everyone here is complaining that 2M for 8 employees seems steep, but I think this seems really cheap. Admittedly, I work at Google, but we bat around the number of 400-500k per employee when discussing them here. 250k/ in SV seems really reasonably priced in comparison.
- EugeneOZ 10y agoMaybe SV is not the best place then. Especially when they are working remotely. One thing is to make money and pay salary as you want, and another one is "we want such salaries, please donate". But don't get me wrong, I'm going to subscribe for monthly donation to them. They save a lot of my time monthly.
- deleted 10y ago[deleted]
- freehunter 10y agoI'd say it's a true statement. The reason you start a company in SV is to get access to the people who live and work in SV. If you don't use that pool of resources, there is no point in being in SV and paying to be in SV. Might as well move to Madison, WI and halve your expenses. And there you'd have access to University of Wisconsin graduates and can compete on wages with Epic instead of Google and Apple.
- autotune 10y ago400K per employee at a 32.7 billion dollar company is a vastly different ratio compared to spending ~250K per employee at a start-up with limited funds.
- robryan 10y agoBoth are competing for the same talent. Also in the Let's Encypt case there are no stock options to make up the difference with the big tech companies.
- juandazapata 10y agoThanks for doing such a great job. It's truly amazing what you have achieved with such a small team.
- maker1138 10y agoThey are not paying $250k per employee. You have to factor in payroll taxes, paying accountants to keep books and CPAs to do taxes, benefits, and a multitude of other regulation-imposed payroll costs. All of this is to support salaries of around $125k - $150k. The same goes for pretty much any employer. If a fast food restaurant hires someone at $8/hr, it actually costs them around $16/hr to hire the employee. In a free market Let's Encrypt could probably cut its expenses to close to half what it's at now.
- the_duke 10y agoThe post says that the Linux Foundation handles administration and accounting for them. But I assume payroll tax is by far the biggest amount.
- geofft 10y agoIn a "free market", I'd demand higher wages to cover medical expenses, my membership in the local road association so I could use the roads, etc. And I'd get it because I'd be in a union (as a programmer in this current non-free market, I don't feel super compelled to unionize, yet). But otherwise, yes, agreed.
- boodm 10y agoIn a "free market", I'd agree to do it for the same minus the local road association costs. Sorry, you're out of a job. Edit: People downvoting reality. OK.
- geofft 10y agoI'm only out of a job if you can successfully get to work without using the roads owned by the local road association. And if you can do that, so can I, so I wouldn't be paying that cost. But this is SF we're talking about, so that seems unlikely - transportation is extremely monetizable. Alternatively, maybe you're taking a worse route to work and willing to suffer a worse commute, in which case fine, you're just willing to work for lower pay than I am. I'm only out of a job if you're an equal-quality employee despite being willing to work for lower pay, in which case one of us is being stupid (either you are undercharging, or I am overcharging) and could just choose to stop being stupid.
- jmuguy 10y agoYa'll should get some swag for donors. I'd like a cool sticker :)
- nodesocket 10y agoCurious where the 20K a month in hosting is spent? Perhaps Google or Amazon could throw in some credits to help out?
- dublinben 10y agoIt is almost certainly necessary for them to have dedicated hardware in neutral datacenters. They can't just run their infrastructure on AWS or Google.
- artimaeis 10y agoMaybe there's something very obvious I'm missing - but why? If their environments are not bare-metal then moving from a virtual solution to a cloud one seems fairly simple. If they are bare-metal then it hardly seems necessary for issuing certs - but if you have more insight I'd love if you'd share it!
- detaro 10y agoCAs require special hardware security modules (HSM) to contain the signing keys and have to control the entire path to them, so yes, you need to own your hardware for a public CA. And independence from their sponsors is an important organisational feature for Let's Encrypt.
- fireflash38 10y agoThe second part of it is why they can't use cloud HSM products offered by various companies. If you're functioning as a CA, you absolutely want restricted physical access to your root keys, which you can't guarantee otherwise.
- nixgeek 10y agoSecurity sensitive workloads are often not virtualised because it opens them up to "What are the other virtual machines doing?". There've been a number of Xen and KVM issues over the years, including a couple which may have resulted in a bad actor having access to the hypervisor (and thus, all its guests). Attacks like Rowhammer also play in this space.
- sidlls 10y agoAll the complaints about salaries are dismaying. Why not consider that plenty of other places seriously undercompensate engineers instead of trying to cut this organization's pay structure down?
- amazingman 10y agoPeople overwhelmingly want others to have less than them more than they want themselves to have more. It's ridiculous, but true.
- sidlls 10y agoYep. The same phenomenon augmented by racism applies to certain demographic populations of the US with respect to minimum wage, welfare, etc. It's just completely irrational.
- ausjke 10y agoCan the business model be charging for the certificate directly, just cheaper than others? I'm fine with that.
- watwatwatwat 10y agoI'm not. I test a lot of ideas but don't have much money. I have already to pay for hosting and DNS. SSL is optional. I'm very thankful to let's encrypt for the opportunity to use SSL on my sites. Also SSL (and the web) is a broken technology, I'm not going to pay for something broken.
- ausjke 10y agothere is nothing really that is free beer in the world, the money has to come somewhere, either some "rich" guys donate the fund, so the rest gets a free ride, or everybody pays a little, say, $5 per year, what's wrong with that? I'm not a rich guy per se, but I want to pay reasonable fee for what I got.
- ersii 10y agoYou can still do so by donating 5$ per year or any other amount you'd like - which is awesome! More things should come around in this way. Talk about being inclusive.
- ausjke 10y agoyes but if you do the math since not everybody is paying whoever donates need pay more to take care of those who does not, which is really what the whole topic is about.
- jcoffland 10y agoThis does not instill confidence in Let's Encrypt's longevity. It sounds like a cry for help. $250k may be a reasonable sum for an established company to pay it's employees but for a company to have that kind of burn rate with out having next years funding secured is scary.
- imron 10y agoHave you seen their sponsors page? Multiply the cost of the various sponsorships by the relevant sponsors and I think you'll find they're doing alright. That doesn't even take in to account individual donations either. The point of this post was not just fundraising, it was because they believe in transparency and openness.
- jcoffland 10y agoIt reads like, oh shit, if you don't donate we might not be around next year.
- tschellenbach 10y ago2m - ~200k in benefits. Looks like 180k per engineer. Thats high, but looks like they've got the corporate sponsors to support those salaries.
- unabridged 10y agoHow many employees does it take to run Let's Encrypt? 8 2 to run the website 1 to ask for money 5 to say "are you sure you need a wildcard cert?"
- resmote 10y agoCrap, I recently switched to these guys because it has some big names behind it. I'd avoided it for a long time because I knew there would be a please donate, hard luck story at some point and I still fell for it. Now I'll have to consider going back to GoDaddy.
- dstroot 10y agoOffering an alternative viewpoint. Many seem to be focused on the cost/FTE. The alternative view is that if this was a business then $3m a year to run it is "peanuts" for the services provided. In fact I prefer the for profit model. I'd like them to charge for each account/cert to cover their costs.
- jitix 10y agoThe whole point of Lets Encrypt is not to charge people for the certificates. But I agree that the amount they are spending per year is very modest compared to what they are doing.
- bowmessage 10y agoBitcoin?
- mrb 10y agoTo Let's Encrypt: if you guys took bitcoins as donation I would give $10 in an instant. The friction of filling out this long Paypal form is just too high for $10... http://i.imgur.com/oZZWeuG.png http://i.imgur.com/oZZWeuG.png (And, no, I don't have a Paypal account.) Make it easy to give, and you will receive more donations! Edit: I am not the only one who wants to donate BTC! Bitcoin was the number one request asked last year: https://twitter.com/letsencrypt/status/581177744152784896 https://twitter.com/letsencrypt/status/581177744152784896
- teach 10y agoI'm in the same boat, though in my case I'd prefer Stripe for card processing rather than Paypal. Stripe already has my card on file from other sellers, and I trust them where I don't especially trust Paypal.
- pc86 10y agoWhy would you have any less reason to trust PayPal to process a credit card than Stripe or anyone else?
- Dylan16807 10y agoThat's an interesting way of putting it. I think I would spend longer double-checking a bitcoin transaction that I would one through paypal. Name/address are easy to autofill even if you don't want anything saving your card info.
- mrb 10y agoI'd do the bitcoin donation as such: unlock my phone, launch Bitcoin Wallet, capture on-screen QR code, type $10, hit send. Done.
- Dylan16807 10y agoI guess that's simple enough if you have two devices handy at the same time. But the simple flow for paypal is just as easy. Click to let my browser autofill payment info, type the CSC, hit submit.
- ceejayoz 10y agoIf any LE staff are in here, I'd happily chip in on a Patreon.
- imron 10y agoYou can donate directly, either once off or recurring monthly - https://letsencrypt.org/donate/ https://letsencrypt.org/donate/
- teach 10y agoMaybe I'm odd, but I don't trust Paypal with a recurring monthly debit. Their track record makes me doubt it would just be smooth and painless.
- ceejayoz 10y agoI'd rather avoid PayPal, and I like Patreon as a central clearinghouse for monthly donations.
- imron 10y agoOn the flipside, Patreon takes a 5% cut on top of whatever fees there are for the payment method you use, so there's less of your dollar reaching the intended recipient.
- ceejayoz 10y agohttps://cms.paypal.com/us/cgi-bin/?cmd=_render-content&content_ID=merchant%2Fdonations https://cms.paypal.com/us/cgi-bin/?cmd=_render-content&conte... says PayPal takes $0.30 per transaction plus 2.2%, so that's a full 1/3 of my dollar gone there.
- mmanfrin 10y agoIt is astounding to see so many people here who think employee cost == employee salary.
- jakewins 10y agoI wish there was a way to donate money towards a fund - like, give $100USD, that goes into some index fund, and then LetsEncrypt withdraws $3.50 (as per https://www.bogleheads.org/wiki/Safe_withdrawal_rates https://www.bogleheads.org/wiki/Safe_withdrawal_rates) a year until the sun burns out. I'd much rather spend my money knowing its a small ways toward making this kind of thing self sustainable.
- hiddenkrypt 10y agoYou could set such a thing up yourself. It's basically a trust. Put your money in the index fund, and have a process to automatically withdraw the safe amount and donate it. Now build a product around that idea, and be the next patreon. I heard of this great company that'll help you get ssh certs for free.
- jakewins 10y agoIt'd be a stellar price list: - $100: Donate $16,100,000,000 ($3.50/year for 4.6 billion years) - $200: Donate $32,200,000,000 ($7.00/year for 4.6 billion years)
- rabidrat 10y agoI've thought about this extensively, and it's actually not that easy to set one up yourself. For one thing, the overhead required to administer a trust is non-zero, and would be prohibitively expensive (non-sustainable) for a small amount. The barest minimum endowment is at least $10k, and possibly $100k. Best case, you find a way to align the trust with a university, who adds it to their portfolio and administers the funds according to your/their goals. This also presumes that there are public investment instruments which can get a reliably positive rate of return. In today's economy, it's difficult to get even a few percent reliably. Some places are toying with negative interest rates, even (which means that passive investments are deflationary).
- daeken 10y agoHow does the overhead scale when you go from, say, having $10k in the pool to $10m? If a service existed that ran a trust where you could put in money and then dictate where your share gets routed, would this overhead keep going up dramatically as it grows?
- gamedna 10y agoWhen considering the salary for their staff, it is important to point out that LetsEncrypt only works if there is trust. They need to have high caliber people that they can trust and this costs money. Hearing that LE Is paying their people a fairly good wage, makes me much more comfortable using and supporting them.
- lucb1e 10y agoLots of people are talking about how expensive Silicon Valley is and how they have to compete with other salaries... but this is the justifying reason to me. If you pay enough that money is off the table, you can trust them a lot better.
- red_blobs 10y agoMany people here don't realize what it costs a business, in taxes, to employ someone. I think if more people realized this, we would have less people demanding a $15 pay-raise for minimum wage workers.
- eropple 10y agoI strongly disagree. What the worker needs to make to have a puncher's chance at a life is not related to the amount paid in taxes.
- red_blobs 10y agoYes it does. As a business owner, more taxes means less money for employees (and less employees hired). People that don't understand taxes never consider this and immediately think employers are just greedy. Inflation is also never considered, which is exactly why we have to keep raising minimum wage in the first place. Minimum wage increase will not help anyone in the long-run. It will only inflate the cost of goods and services for everyone within a few years. The real answer is more education
- eropple 10y agoLet's be really real for a sec: minimum wage does not, in any meaningful way, drive demand-pull inflation. Minimum wage doesn't even track the rate of inflation. This is macro-averse horsepuckey. This position of abolition of minimum wage is not seriously held by any macroeconomic experts except on the extreme far right. There is a reason that wage floors, in lieu of GMI, are accepted by even centrists: because the alternatives are literally unconscionable. Further: capital is greedy. It's functionally unable to be anything else. Throwing labor a bone once in a while is not, desperate hair-shirting aside, going to somehow kill it and destroy the jobs, homgz.
- tmaly 10y agoI would be interested to know how many certificates they currently issue. I would have no problem paying a small annual rate for using the service.
- Grue3 10y agoSo, what's the plan for when the bubble pops, Let's Encrypt runs out of funding, and meanwhile all browsers have switched to requiring HTTPS for all websites?
- dopamean 10y agoWhat?
- freehunter 10y agoI'd assume people would have to start paying for certs.
- lucb1e 10y agoResume, not start. But yeah, simple as that I'd say. But I very much doubt it will get that far: the only cost they can't cut back on is hosting. The rest remains as-is if you don't touch it. Those hosting costs I feel like we could easily cover with the community, but they even have big corporations behind them to drive it when need be.
- dawnerd 10y agoMy guess is someone like Google would come in and fill the spot for free or very very cheap. I think Google/Microsoft/Apple/etc could donate the 10+ people they need without even batting an eye.
- TazeTSchnitzel 10y agoAnd Let's Encrypt have created open-source software and standard protocols for running an automated, free CA. So anyone (with sufficient money) could provide a drop-in replacement if needed or desired.
- desireco42 10y agoAt first glance, it looks huge. But then, honestly, when you just consider vast benefit all of us are getting from them, this is nothing and probably should be funded on a higher level. Like 10-15M.
- rexreed 10y agoGEEZ - Those Legal and Administrative costs are INSANE. Especially if a lot of their stuff is handled by Linux Foundation. What the heck? 12%+ of total spend to lawyers and admin, and this is not salary? What's going on here?
- sp527 10y agoSurprised no one is commenting that their software has really poor usability. It may work well in providing secure certificates, but setup is a PITA and the documentation is abysmal.
- lucb1e 10y agoAgreed. If I remember correctly it even destroyed a site once when it was attempting to make sure their validator could reach the verification file. I just did what everyone said: "it's so easy, just run it on auto mode with apache and it'll configure your cert for you". Turned out to be a huge PITA. Recently I had to renew that site again (I've been postponing and dreading it) and looked for a different client. The getssl bash script[1] had its own problems (all caused by me not taking the time to read the readme, but the default settings were a bit odd), but overall a 10× better experience than the official client. Much less magic, much more a unix-like tool ("it does only one thing, and one thing very well"). [1] https://github.com/srvrco/getssl https://github.com/srvrco/getssl
- tghw 10y agoI'm not sure I like their "we'll do it all for you" approach. It seems like there are a lot of ways to accidentally break config files. In general, I'd rather not anyone touch those without me knowing what it will do. Fortunately, the certonly script grabs the cert and puts it in an easy location. Updating the config from there is easy enough.
- tghw 10y agoReally?? I found it dead simple to use. 1. Install the app. 2. Run the certonly script, following the prompts. 3. Point the server at the certificates. The only hitch was stopping Nginx long enough to do the domain verification. A three line bash script fixed that.
- niij 10y agoCheck out Lego [0]. You can do DNS verification instead, no need to restart nginx :) [0]: https://github.com/xenolf/lego https://github.com/xenolf/lego
- deleted 10y ago[deleted]
- mmkx 10y agoThey need to spend less or they're the next Tor foundation, an ineffective black hole of hacker wannabes and hanger-ons. Running high performance services don't cost very much as evidenced by their hosting entry. Maybe 5 engineers max. No way they are working on features every day. Should be very slow outside of patches. CA/SSL specification does not change weekly...
- bracewel 10y ago> CA/SSL specification does not change weekly... The draft ACME specification does though.
- matt_wulfeck 10y ago$20m is such a great bargain to how much value LetsEncrypt provides to the world at large. I can hardly think of better money spent. They have a donation page here: https://letsencrypt.org/donate/ https://letsencrypt.org/donate/ Let's keep it going.
- test6554 10y agoIf the market crashes or they cannot raise needed funds, they could easily turn around and begin charging $1 per certificate per year and still be a much better value than other CAs.
- brilee 10y agoI recently replaced my paid SSL certs using LE. I took what I would have paid in SSL costs over the next two years and donated it instead.
- ersii 10y agoThat's a fantastic initiative! Bravo!
- thewavelength 10y agoFunny to see that some of the sponsors on the Let's Encrypt website are linked without https even though they offer https.
- guelo 10y agoPeople are confused. The end salaries are probably in the $110k-$150k range.
- cptskippy 10y agoMy multi-domain (3) cert just came up for renewal at $28.99 a year, instead I setup Let's Encrypt on 8 domains for free. I think I'll just setup a recurring donation to Let's Encrypt simply because I'll never have to do the SSL Cert song and dance ever again.
- pw 10y agoSo programmers mad that other programmers are making good money (although, taking into account overhead, salaries are rather normal). This is why we can't have nice things people.
- Gatsky 10y agoReading these comments, it's hard not to agree with the sentiment that being transparent about salary data is of dubious value to a company.
- classycoder 10y agoencryption is for homosexuals and pedophiles, the largest hacking leaks and bugs reported are always to do with encryption. we the Internet does not need homosexuals nor encryptions. encryption slows the internet, kills cats
- sctb 10y agoWe've banned this account.
- naveen99 10y agoHas anyone tried to incorporate signed executable loader into the Linux kernel ? Hopefully letsencrypt can start certifying code signing keybase keys. Also would be nice if someone would offer a service to build executables from open source code and code sign certifying that a particular executable was built from a particular source openly available.
- vacri 10y agoSo many people complaining 'why not remote', when half the staff is operations, and they run their own hardware. It's going to suck when your ops staffer in Tahiti has to fix a physical server problem in the SF datacenter...
- otakucode 10y agoI notice that they explain the purpose and benefit to the organization of every single category of employee - except the executive director.
- throw2016 10y agoThere is no problem with being located in sf but I would take issue with the idea its a job that 'requires' one to be located in sf or have access to the absoute 'highest quality' of engineers. On the contrary there is a risk of adding complexity where none is needed because super high quality talent requires super high quality work and if the work of generating certs is not challenging enough, complexity is created, like Acme. I am not sure why generating a cert is so involved with letsencrypt. Does Dns validation, file validation or email validation require a new standard. Perhaps a simple rest api and web frontend would be better. Here is my domainname, my cert request and a file on my server or dns entry to verify, now can I have a cert please? This is the process. Why does it need a client, and one that can automatically update certs!! and an elaborate new standard? There is no way I am running this on a live server, so the automation is then moot. I would rather pay $20-40 a year than babysit my ssl every 90 days, and this is for a wildcard. The kind of folks who automate things spend hundreds of dollars a month on aws or gce, and willingly pay 10 times more for bandwidth than they would at do or vultr. Is $20 a year or $2 a month per wildcard domain in this context really an issue? So who does the automation target and benefit? For others a manual process would have been more accesible, there are tons of others things to do with one's time, le is automated but that is one more thing to monitor and that can go wrong. I can't help feeling the whole cert generation process could be simplified and artificial restrictions around 90 days and wildcards re-evaluated. That would be valuable to users, contribute to make running things simpler and money well spent.
- sadness 10y agoPro Link <a href="http://www.indo-news.ga">Indonesia http://www.indo-news.ga">Indonesia News</a> <a href="http://www.tutorialgayarambut.com">Hairstyle</a> http://www.tutorialgayarambut.com">Hairstyle</a>
- sadness 10y agoPro Link <a href="http://www.indo-news.ga">Indonesia http://www.indo-news.ga">Indonesia News</a> <a href="http://www.tutorialgayarambut.com">Hairstyle</a> http://www.tutorialgayarambut.com">Hairstyle</a>