7 ms·

Every time LetsEncrypt is brought up I am reminded of "if it's for free, You are the product". In this case it is one's servers. A single company has a hand on

Every time LetsEncrypt is brought up I am reminded of "if it's for free, You are the product". In this case it is one's servers. A single company has a hand on the pulse and runs software on your server in exchange for continuous "convenience". I am still NOT buying in, diversifying SSL certs from reputable companies with 12 (or sometimes 13) months validity are still ok for me in 2017.

duskwuff 9y ago
This seems a little tin-foil-hatty. The only information which Let's Encrypt receives is the domain name that the certificate is for (which is public anyways for any CA implementing certificate transparency). The Certbot software is open-source and easily verifiable, and there's multiple independently developed alternatives available if you don't like it.
- schoen 9y ago
  Certbot developer here. If you don't like Certbot, we definitely encourage you to use one of the many other implementations: https://community.letsencrypt.org/t/list-of-client-implementations/2103 https://community.letsencrypt.org/t/list-of-client-implement... Some of these are much lighter weight than Certbot and have many fewer dependencies. You can also take your pick of what language they are written in and how they are installed on your system. You're also welcome to write your own client that speaks the ACME protocol. Let's Encrypt is near to rolling out an API endpoint that will speak the IETF-standardized version of ACME, developed through an open standards process and in consultation with other implementers. I know that some people have said they don't like running a large new application as root, even when it's open source. So, please have a look at some of the other clients and see if one of them strikes your fancy! Let's Encrypt's operational funding is thanks to these entities https://letsencrypt.org/sponsors/ https://letsencrypt.org/sponsors/ which view the service as worthwhile and important and have chosen to donate funds to support its operation. The organization is overseen by these people https://letsencrypt.org/isrg/ https://letsencrypt.org/isrg/ In this model there is no need to charge users for certificates or try to indirectly monetize the use of the service, although users are very welcome to donate if they find the service useful, and Let's Encrypt may be more sustainable if some users choose to do so.
  - IronBacon 9y ago
    > I know that some people have said they don't like running a large new application as root, even when it's open source. Certbot could be configured to run without root with little effort, at least the part exposed to the web that was my concern.
wereHamster 9y ago
> runs software on your server letsencrypt doesn't require you to run anything on your server.
- sliken 9y ago
  Cronjob != anything?
  - zegl 9y ago
    They are not running anything on the server, you can implement your own renewal software with their protocols.
technion 9y ago
I don't like the idea of a monopoly either. But the issue here is what is "reputable". Most of (all?) the major commercial suppliers that I am aware of have been involved in major incidents. The only reputable supplier I could name, is LE.
- enigmabridge 9y ago
  I agree, but you could say that any of major issuers was reputable 2, 5, ... years into issuing certificates. Being new doesn't mean you're better long term. But I personally like the fact there's much less commercial pressure on LE - for the time being at least.
jaas 9y ago
I don't really understand what you're implying but here's some information that might help. Let's Encrypt is a non-profit service and we don't use your data for our benefit. We work hard to collect and retain as little of your data as possible. We do not require you to run software from us on your server. You can use any client you want. In fact, we don't even produce client software -- all Let's Encrypt clients are built and maintained by our community (the client we often recommend, Certbot, is an EFF project).

duskwuff 9y ago

This seems a little tin-foil-hatty. The only information which Let's Encrypt receives is the domain name that the certificate is for (which is public anyways for any CA implementing certificate transparency). The Certbot software is open-source and easily verifiable, and there's multiple independently developed alternatives available if you don't like it.

schoen 9y ago
Certbot developer here. If you don't like Certbot, we definitely encourage you to use one of the many other implementations: https://community.letsencrypt.org/t/list-of-client-implementations/2103 https://community.letsencrypt.org/t/list-of-client-implement... Some of these are much lighter weight than Certbot and have many fewer dependencies. You can also take your pick of what language they are written in and how they are installed on your system. You're also welcome to write your own client that speaks the ACME protocol. Let's Encrypt is near to rolling out an API endpoint that will speak the IETF-standardized version of ACME, developed through an open standards process and in consultation with other implementers. I know that some people have said they don't like running a large new application as root, even when it's open source. So, please have a look at some of the other clients and see if one of them strikes your fancy! Let's Encrypt's operational funding is thanks to these entities https://letsencrypt.org/sponsors/ https://letsencrypt.org/sponsors/ which view the service as worthwhile and important and have chosen to donate funds to support its operation. The organization is overseen by these people https://letsencrypt.org/isrg/ https://letsencrypt.org/isrg/ In this model there is no need to charge users for certificates or try to indirectly monetize the use of the service, although users are very welcome to donate if they find the service useful, and Let's Encrypt may be more sustainable if some users choose to do so.
- IronBacon 9y ago
  > I know that some people have said they don't like running a large new application as root, even when it's open source. Certbot could be configured to run without root with little effort, at least the part exposed to the web that was my concern.

wereHamster 9y ago

> runs software on your server letsencrypt doesn't require you to run anything on your server.

sliken 9y ago
Cronjob != anything?
- zegl 9y ago
  They are not running anything on the server, you can implement your own renewal software with their protocols.

technion 9y ago

I don't like the idea of a monopoly either. But the issue here is what is "reputable". Most of (all?) the major commercial suppliers that I am aware of have been involved in major incidents. The only reputable supplier I could name, is LE.

enigmabridge 9y ago
I agree, but you could say that any of major issuers was reputable 2, 5, ... years into issuing certificates. Being new doesn't mean you're better long term. But I personally like the fact there's much less commercial pressure on LE - for the time being at least.

jaas 9y ago

I don't really understand what you're implying but here's some information that might help. Let's Encrypt is a non-profit service and we don't use your data for our benefit. We work hard to collect and retain as little of your data as possible. We do not require you to run software from us on your server. You can use any client you want. In fact, we don't even produce client software -- all Let's Encrypt clients are built and maintained by our community (the client we often recommend, Certbot, is an EFF project).