4 ms·

wildcard certs are not a solution to this problem. Sharing a private cert with all customers isn't what the solution does. every customer gets their own cert s

wildcard certs are not a solution to this problem. Sharing a private cert with all customers isn't what the solution does. every customer gets their own cert second letsenrypt has low limits of 20 certs per week. so imagine VLC added a Plex like streaming feature. they'd need far far more than 20 certs a day given how large their user base is

qb45 9y ago
BTW, who really is Let's Encrypt, why should I trust them, why should I trust they won't disappear once plain HTTP is no longer supported by cargo-cult-security-conscious browsers? It seems to me like providing certificates isn't exactly free, in itself.
- icebraining 9y ago
  Say they disappear, so what? You're left in the exact same situation as before they've appeared, except with some money saved in the meantime.
  - qb45 9y ago
    You must have missed once plain HTTP is no longer supported by cargo-cult-security-conscious browsers There already are people talking about such possibility and some even appear to believe it would be a good idea. Of course what happens then is that without Let's Encrypt you are stuck paying other CAs to have anything published on the Web at all. <tinfoil hat on>LE is a conspiracy of CAs to phase out unencrypted HTTP and ensure them infinite money stream. <tinfoil hat off>Even if it isn't, LE will disappear five months after their mission is done because what the heck, why bother. I just wonder if there is any reason to believe that users of LE are any smarter than kids accepting free candy from pedos? Maybe there are reasons but I just haven't heard them yet.
    - icebraining 9y ago
      Ah, I think I'm missing an assumption you're making: that LE is indispensable (or almost) for browsers to deprecate HTTP. Personally, I think the deprecation (as in, the warning bells and reduced priority, not full blocking) was going to happen anyway, and LE was mostly inconsequential, even if it makes the transition easier. As for LE being a CA conspiracy, I don't think that makes much sense considering their funders (eg. Mozilla, Google) and those funders relationships with existing CAs (see WoSign, Symantec). But anything's possible.
icebraining 9y ago
wildcard certs are not a solution to this problem. Sharing a private cert with all customers isn't what the solution does. every customer gets their own cert That's not what I mean. I mean the same solution as described by michaelt above, that is, provide a different wildcard cert per user. second letsenrypt has low limits of 20 certs per week. so imagine VLC added a Plex like streaming feature. they'd need far far more than 20 certs a day given how large their user base is Remember that the limit is only on the number of new users; Let's Encrypt has a renewal exemption that lets you renew your certs even after hitting the 20/week limit. So while it might still not be enough for VLC, I don't think it's a problem for most projects. Plus you can always use more than one domain.
- greggman 9y ago
  > I don't think it's a problem for most projects Pretty much any open source project that was to need certs similar to plex would pass this limit the moment they mentioned it on HN. Why should an open source projected have to register hundreds of domains just to handle this case? Someone else gave a long list of the number of devices and services running in his house that need certs like plex. Effectively every router, nas, IP camera, and other networked device that exposes a web interface and therefore every open source project that does those, OpenWRT for example, FreeNAS, ZoneMinder, etc...

qb45 9y ago

BTW, who really is Let's Encrypt, why should I trust them, why should I trust they won't disappear once plain HTTP is no longer supported by cargo-cult-security-conscious browsers? It seems to me like providing certificates isn't exactly free, in itself.

icebraining 9y ago
Say they disappear, so what? You're left in the exact same situation as before they've appeared, except with some money saved in the meantime.
- qb45 9y ago
  You must have missed once plain HTTP is no longer supported by cargo-cult-security-conscious browsers There already are people talking about such possibility and some even appear to believe it would be a good idea. Of course what happens then is that without Let's Encrypt you are stuck paying other CAs to have anything published on the Web at all. <tinfoil hat on>LE is a conspiracy of CAs to phase out unencrypted HTTP and ensure them infinite money stream. <tinfoil hat off>Even if it isn't, LE will disappear five months after their mission is done because what the heck, why bother. I just wonder if there is any reason to believe that users of LE are any smarter than kids accepting free candy from pedos? Maybe there are reasons but I just haven't heard them yet.
  - icebraining 9y ago
    Ah, I think I'm missing an assumption you're making: that LE is indispensable (or almost) for browsers to deprecate HTTP. Personally, I think the deprecation (as in, the warning bells and reduced priority, not full blocking) was going to happen anyway, and LE was mostly inconsequential, even if it makes the transition easier. As for LE being a CA conspiracy, I don't think that makes much sense considering their funders (eg. Mozilla, Google) and those funders relationships with existing CAs (see WoSign, Symantec). But anything's possible.

icebraining 9y ago

wildcard certs are not a solution to this problem. Sharing a private cert with all customers isn't what the solution does. every customer gets their own cert That's not what I mean. I mean the same solution as described by michaelt above, that is, provide a different wildcard cert per user. second letsenrypt has low limits of 20 certs per week. so imagine VLC added a Plex like streaming feature. they'd need far far more than 20 certs a day given how large their user base is Remember that the limit is only on the number of new users; Let's Encrypt has a renewal exemption that lets you renew your certs even after hitting the 20/week limit. So while it might still not be enough for VLC, I don't think it's a problem for most projects. Plus you can always use more than one domain.

greggman 9y ago
> I don't think it's a problem for most projects Pretty much any open source project that was to need certs similar to plex would pass this limit the moment they mentioned it on HN. Why should an open source projected have to register hundreds of domains just to handle this case? Someone else gave a long list of the number of devices and services running in his house that need certs like plex. Effectively every router, nas, IP camera, and other networked device that exposes a web interface and therefore every open source project that does those, OpenWRT for example, FreeNAS, ZoneMinder, etc...