4 ms·

What? No. The mirrors would just need to install a letsencrypt-compatible client and setup SSL via that. On any modern CPU since 2011 or so, TLS overhead is b

by zaarn 8y ago

What? No. The mirrors would just need to install a letsencrypt-compatible client and setup SSL via that. On any modern CPU since 2011 or so, TLS overhead is below a percent and a decent cheap dedicated box should be able to saturate a 1 Gbps uplink.

toast0 8y ago
Actually, no, the mirrors may not be able to verify themselves with let's encrypt. A hostname like ftp.us.debian.org resolves to many different mirrors, and may not resolve consistently around the world -- if that's the case, let's encrypt will not be able to verify the hosts through http challenges. Also, 1gbps is pretty small. I can't find any documentation on traffic, but I'd imagine mirrors in popular places are at least on 10gig.
- zaarn 8y ago
  I have a 10Gbps uplink on my personal server and I can easily saturate it without getting capped on CPU or RAM. LE offers other challenges to verify hosts, like DNS verification. DNS verification can be done easily with an external API for mirror owners to hit (most ACME clients offer DNS challenge with the standard update protocol for DNS which can be secure appropriately).
  - toast0 8y ago
    Mirror owners don't control the DNS for debian.org. Debian could get the certificates, but getting the certificates was never the issue -- some CA would be happy to issue certificates for little or no cost to help Debian and gain mindshare. Coordination between 3rd party, volunteer mirror owners and the Debian organization is the issue. What kind of CPU and traffic patterns are you using to hit 10 gbps of TLS protected traffic?
    - zaarn 8y ago
      >What kind of CPU and traffic patterns are you using to hit 10 gbps of TLS protected traffic? Mainly serving a file directory with apache with files ranging between 100M and 1G in size. Should be easily comparable to Debian or Ubuntu repositories.
      - toast0 8y ago
        Debian mirrors are going to get a lot of _very_ short connections for people checking if there are any updates frequently. Those are effectively zero bandwidth, but you need to do a full TLS handshake, which is the most expensive part.
        zaarn 8y ago
        A dedicated server of decent size should easily be able to handle this kind of traffic.
        toast0 8y ago
        I agree; you would need a dedicated server of decent size to handle this type of traffic. Debian relies on an assortment of volunteer servers of unknown size, and they're not dedicated.
        zaarn 8y ago
        A dedicated server of decent size at the right hoster starts at 25€ a month. That is not that much and I bet most of the volunteer servers are already above this price range.
  - kiallmacinnes 8y ago
    I love how complex this has become. Debian now needs to build a custom API, or use DDNS secured just right for LE verification records (which would give mirrors full access to obtain any debian.org cert, as the DNS-01 challenge doesn't contain enough info to filter on. You either control DNS, or you don't - DNS-01 doesn't have a middle ground of owning a single record AFAIK, and it certainly doesn't have the concept of shared ownership of a single record without race conditions..). Now multiply that by the 1000 or more projects that each mirror syncs content from, all with something different because nothing standard exists. LetsEncrypt is great, I love it, I have 10's of certs for personal stuff from them. I think they've completely changed the CA landscape, hopefully forever. However I'll say it again, LetsEncrypt does not solve this problem. That's OK. LetsEncrypt doesn't have to solve every problem with TLS!
    - zaarn 8y ago
      >DNS-01 doesn't have a middle ground of owning a single record AFAIK, With DNS-01 you only own up to the domain you verified. If you verify ftp.de.debian.org then you can't issue certs for de.debian.org or debian.org but you can issue for www.ftp.de.debian.org. I don't see the issue with that.
      - kiallmacinnes 8y ago
        I see an issue with that - but it's possible I'm too paranoid when it comes to many third parties being able to issue certificates for my domain on names I wasn't expecting.. Each to their own! Either way - assuming restricting issuance to exactly 1 name is a solved problem.. This: What? No. The mirrors would just need to install a letsencrypt-compatible client and setup SSL via that. is still a far cry from reality thanks to all the other issues. If anything, it's: What? No. Certs are just the tip of the iceberg, even if LetsEncrypt solved that problem neatly (and they don't), you have ignored the massive complexity of the issue, both the technical and organisational issues.
        zaarn 8y ago
        It will have to be solved considering an major vulnerability was released today that allows any attacker to get root-level RCE by manipulating the HTTP Response. HTTPS as default would have severely reduced the attack surface for this bug.

by zaarn 8y ago

toast0 8y ago

Actually, no, the mirrors may not be able to verify themselves with let's encrypt. A hostname like ftp.us.debian.org resolves to many different mirrors, and may not resolve consistently around the world -- if that's the case, let's encrypt will not be able to verify the hosts through http challenges. Also, 1gbps is pretty small. I can't find any documentation on traffic, but I'd imagine mirrors in popular places are at least on 10gig.

zaarn 8y ago
I have a 10Gbps uplink on my personal server and I can easily saturate it without getting capped on CPU or RAM. LE offers other challenges to verify hosts, like DNS verification. DNS verification can be done easily with an external API for mirror owners to hit (most ACME clients offer DNS challenge with the standard update protocol for DNS which can be secure appropriately).
- toast0 8y ago
  Mirror owners don't control the DNS for debian.org. Debian could get the certificates, but getting the certificates was never the issue -- some CA would be happy to issue certificates for little or no cost to help Debian and gain mindshare. Coordination between 3rd party, volunteer mirror owners and the Debian organization is the issue. What kind of CPU and traffic patterns are you using to hit 10 gbps of TLS protected traffic?
  - zaarn 8y ago
    >What kind of CPU and traffic patterns are you using to hit 10 gbps of TLS protected traffic? Mainly serving a file directory with apache with files ranging between 100M and 1G in size. Should be easily comparable to Debian or Ubuntu repositories.
    - toast0 8y ago
      Debian mirrors are going to get a lot of _very_ short connections for people checking if there are any updates frequently. Those are effectively zero bandwidth, but you need to do a full TLS handshake, which is the most expensive part.
      - zaarn 8y ago
        A dedicated server of decent size should easily be able to handle this kind of traffic.
        toast0 8y ago
        I agree; you would need a dedicated server of decent size to handle this type of traffic. Debian relies on an assortment of volunteer servers of unknown size, and they're not dedicated.
        zaarn 8y ago
        A dedicated server of decent size at the right hoster starts at 25€ a month. That is not that much and I bet most of the volunteer servers are already above this price range.
- kiallmacinnes 8y ago
  I love how complex this has become. Debian now needs to build a custom API, or use DDNS secured just right for LE verification records (which would give mirrors full access to obtain any debian.org cert, as the DNS-01 challenge doesn't contain enough info to filter on. You either control DNS, or you don't - DNS-01 doesn't have a middle ground of owning a single record AFAIK, and it certainly doesn't have the concept of shared ownership of a single record without race conditions..). Now multiply that by the 1000 or more projects that each mirror syncs content from, all with something different because nothing standard exists. LetsEncrypt is great, I love it, I have 10's of certs for personal stuff from them. I think they've completely changed the CA landscape, hopefully forever. However I'll say it again, LetsEncrypt does not solve this problem. That's OK. LetsEncrypt doesn't have to solve every problem with TLS!
  - zaarn 8y ago
    >DNS-01 doesn't have a middle ground of owning a single record AFAIK, With DNS-01 you only own up to the domain you verified. If you verify ftp.de.debian.org then you can't issue certs for de.debian.org or debian.org but you can issue for www.ftp.de.debian.org. I don't see the issue with that.
    - kiallmacinnes 8y ago
      I see an issue with that - but it's possible I'm too paranoid when it comes to many third parties being able to issue certificates for my domain on names I wasn't expecting.. Each to their own! Either way - assuming restricting issuance to exactly 1 name is a solved problem.. This: What? No. The mirrors would just need to install a letsencrypt-compatible client and setup SSL via that. is still a far cry from reality thanks to all the other issues. If anything, it's: What? No. Certs are just the tip of the iceberg, even if LetsEncrypt solved that problem neatly (and they don't), you have ignored the massive complexity of the issue, both the technical and organisational issues.
      - zaarn 8y ago
        It will have to be solved considering an major vulnerability was released today that allows any attacker to get root-level RCE by manipulating the HTTP Response. HTTPS as default would have severely reduced the attack surface for this bug.