4 ms·

> Step Two: Google's entry makes the incumbents either decide to exit the space or change their bad behavior Yes, we wouldn't want the price of certificates to

> Step Two: Google's entry makes the incumbents either decide to exit the space or change their bad behavior Yes, we wouldn't want the price of certificates to enter a race to the bottom. Let's Encrypt relies on that revenue! Honestly these comments...

psergeant 8y ago
The comment you’re replying to thinks Step Two is good, but feels a bad Step Three is inevitable.
- magicalist 8y ago
  Why would existing CAs leave the market if they didn't before?
  - geofft 8y ago
    I think the argument is that existing CAs with mediocre practices are currently profitable, but in the presence of Google competition will stop being profitable and decide to exit, and may not decide to return if Google leaves. (I don't think the scenario as a whole seems likely, but this specific argument is analogous to e.g. concerns about Uber and Lyft competing with taxies on VC-subsidized pricing that will run out one day, or the loss of SF laundromats thanks to laundry startups.)
    - magicalist 8y ago
      Except, again, there are sponsored non-profits in this space. What further distortion do you expect?
      - askmike 8y ago
        LE is great for a lot of things. But it doesn't offer the wide range of SSL certs everyone requires, such as OV and EV certs.
        tialaramex 8y ago
        Google did not request and were not granted EV treatment for this CA. So even if it mints certificates with an EV OID in them that will get ignored in Firefox. Although the Google CA, Google's root trust programme, and the Chrome TLS implementation people are three distinct teams at Google, common sentiment among the technically savvy (which would include all three groups) is that EV is either entirely or largely pointless and nobody cares, so it would not make sense to request EV treatment. Your general thrust is right, there are other things CAs issue that Let's Encrypt does not, but the numbers still tell a story of solid growth even in the Web PKI, Let's Encrypt grew the market considerably, seizing 75% of a market that is now five times bigger than before doesn't squeeze out other people.
        manquer 8y ago
        Largely pointless to people @ Google is not a good measure. Customers still use it, and are willing to pay for it.
        tialaramex 8y ago
        Customers still use and are willing to pay for homeopathy, but since it's ineffective my doctor doesn't offer it. Google knows EV is basically snake oil, so why sell it? I appreciate that there's a certain level of anarcho-capitalist sentiment in Hacker News, but lots of people run for-profit businesses that don't take the "If there's any possible way to make money, no matter how reprehensible, I will do that" approach. If you just can't stand for any for-profit business to ever do anything except to make as much money as possible, let me offer you a (very weak) economic justification you can cling to instead: Offering EV means you need to build a fairly complicated customer services operation, maybe a call center with verification specialists, a whole new team of people with skills your company doesn't have today. It is very unlikely that Google can make more profit on this weird niche business than by spending the same resources on, say, a minor improvement to advertising revenue. There, Anarcho-capitalists, do you feel all safe and cosy in the knowledge that if you squint you can pretend it was all just about money?

psergeant 8y ago

The comment you’re replying to thinks Step Two is good, but feels a bad Step Three is inevitable.

magicalist 8y ago
Why would existing CAs leave the market if they didn't before?
- geofft 8y ago
  I think the argument is that existing CAs with mediocre practices are currently profitable, but in the presence of Google competition will stop being profitable and decide to exit, and may not decide to return if Google leaves. (I don't think the scenario as a whole seems likely, but this specific argument is analogous to e.g. concerns about Uber and Lyft competing with taxies on VC-subsidized pricing that will run out one day, or the loss of SF laundromats thanks to laundry startups.)
  - magicalist 8y ago
    Except, again, there are sponsored non-profits in this space. What further distortion do you expect?
    - askmike 8y ago
      LE is great for a lot of things. But it doesn't offer the wide range of SSL certs everyone requires, such as OV and EV certs.
      - tialaramex 8y ago
        Google did not request and were not granted EV treatment for this CA. So even if it mints certificates with an EV OID in them that will get ignored in Firefox. Although the Google CA, Google's root trust programme, and the Chrome TLS implementation people are three distinct teams at Google, common sentiment among the technically savvy (which would include all three groups) is that EV is either entirely or largely pointless and nobody cares, so it would not make sense to request EV treatment. Your general thrust is right, there are other things CAs issue that Let's Encrypt does not, but the numbers still tell a story of solid growth even in the Web PKI, Let's Encrypt grew the market considerably, seizing 75% of a market that is now five times bigger than before doesn't squeeze out other people.
        manquer 8y ago
        Largely pointless to people @ Google is not a good measure. Customers still use it, and are willing to pay for it.
        tialaramex 8y ago
        Customers still use and are willing to pay for homeopathy, but since it's ineffective my doctor doesn't offer it. Google knows EV is basically snake oil, so why sell it? I appreciate that there's a certain level of anarcho-capitalist sentiment in Hacker News, but lots of people run for-profit businesses that don't take the "If there's any possible way to make money, no matter how reprehensible, I will do that" approach. If you just can't stand for any for-profit business to ever do anything except to make as much money as possible, let me offer you a (very weak) economic justification you can cling to instead: Offering EV means you need to build a fairly complicated customer services operation, maybe a call center with verification specialists, a whole new team of people with skills your company doesn't have today. It is very unlikely that Google can make more profit on this weird niche business than by spending the same resources on, say, a minor improvement to advertising revenue. There, Anarcho-capitalists, do you feel all safe and cosy in the knowledge that if you squint you can pretend it was all just about money?