8 ms·

I can sympathize with the frustration, but I disagree with the criticism. Certbot is capable of doing dry-runs, and is configured by default to try to renew wit

by ohazi 6y ago

I can sympathize with the frustration, but I disagree with the criticism. Certbot is capable of doing dry-runs, and is configured by default to try to renew with a month to spare. It logs failures. You should read your logs. If you've built a system where silently failing is a problem, and you haven't configured any sort of "email me when anything isn't nominal" then you haven't finished configuring your server. Software updates happen. Unattended updates are a thing. It's not the ninties anymore... You can't hook something up to the internet, chuck it in your closet, forget about it for five years, and expect zero issues. You need to pay attention to it.

logicchains 6y ago
>You can't hook something up to the internet, chuck it in your closet, forget about it for five years, and expect zero issues. You need to pay attention to it. This kind of contempt for users is why I try to avoid using any libraries/software written in Python. Somebody always thinks their minor backwards incompatible change is such a precious snowflake that it justifies wasting collectively thousands of hours of users' time debugging and updating their stuff to work around it.
- boudin 6y ago
  I don't think that's what the author says. There's been some changes in the past to the acme protocol requiring to update whatever client you use.
- msla 6y ago
  It isn't contempt to realize that security landscapes change, and what was best practice in the past is insecure now.
- aeturnum 6y ago
  I don't think this is "contempt for users," it's a position that configurations that appear to setup a web server to run without monitoring for years are deceptive and harmful to the admin taken in by them. It's an ethical (and technical) position that tools should push their users to adopt maintenance practices that are seen as responsible by the wider community. It's not contempt to inform people about the level of work you expect is required to do what they are planning. It's also, if letsencrypt happens to be wrong, not contemptuous to be wrong!
- lallysingh 6y ago
  The one with contempt for users is reality itself. Computer security is hard, and whatever you have installed today will force you to update it later, directly or indirectly, due to security. Don't blame the messenger.
- RandoHolmes 6y ago
  That's not a Python specific problem, but otherwise I agree with your point.
  - paul_f 6y ago
    No, but when it occurs, it's usually Python
jacquesm 6y ago
> You need to pay attention to it. My whole reason for switching to LE was that it was announced as an automatic way to upgrade certificates. So it required less of my attention than before. Or at least, that was the spiel.
- hn_check 6y ago
  You should demand a refund. Vote with your wallet. Of course that was a bit trenchant, however you're complaining about a promise that was never made. No one ever promised that you could setup a old certbot instance and it was out of sight and mind for perpetuity. There are any number of issues that can occur, and honestly if one expected certbot to run without issue, having it automatically updating as well seems to be a base minimum. Also worth noting that LE was early with ACMEv1, but a lot of alternatives started with ACMEv2. ACMEv2 became the common standard.
  - jacquesm 6y ago
    Yes, but that hole was closed almost immediately as far as I know.
    - tptacek 6y ago
      No, it was not. It's a protocol bug. The hole was "closed" by deprecating and then removing tls-sni-01.
- cuillevel3 6y ago
  Interesting perspective. For me it was clear from the beginning that I'm trading convenience for free certs. Criticism of the "official" client was also very loud from the start. I do agree that LetsEncrypt has been a constant source of maintenance problems over the years. For example now, I have to switch to another alternative acme client, since the old one doesn't seem to be in active development anymore... However, certificates used to be expensive, even unaffordable for some projects.
  - 6y ago
bartvk 6y ago
Since my college days, I've been running a Linux server, of some sorts, somewhere. Usually running Debian. To be honest, I also haven't configured any sort of notification when anything isn't nominal. Once I did set up Zabbix. But it turned out that Debian/Linux is incredibly reliable. When I migrated to a new server (or rather VPS), I simply haven't bothered installing any kind of notification. It just runs and runs, it's like an appliance. I can see people falling into the trap. They run Linux their whole lives, and it never failed them. Then they introduce something new, like Certbot, and for the first time, there's a hiccup and they get frustrated :D
bigiain 6y ago
> You need to pay attention to it If I have to pay attention to it four times a year and regularly spend a day updating software I didn't want to have let alone update, I should have just paid GoDaddy or whoever their $100 grift and only had to update the cert once a year and not hunt down stupid error messages and look for release notes on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard.' Amazon haven't done something this stupid with their 'free" ssl certs for load balancers, and you know why? Because the provide them to "customers", not to "early adopting cheapskate beta testing schmucks"...
- wongarsu 6y ago
  >and you know why? because they control the software on both ends and can update certificate clients on the load balancers anytime they want?
- PaulKeeble 6y ago
  It is actually easier to deploy a repeat certificate you bought as well. Once you have it all setup it is usually just a drop in replacement and a config reload of the web server. Multiple times now I have spent hours fiddling with certbot trying to get it to do its job properly and stop invalidating my certificates. SSL has never been as much hassle as it has been with letsencrypt. Its free and I feel like I am getting what I paid for!
- perlgeek 6y ago
  I've been using let's encrypt nearly since it started issuing certificates, and I had to intervene only once so far. I think one thing that's missing from the discussion is scalability. Sure you can pay a CA for a cert that is valid for a year, but you still have to do your update dance once per year per site. With let's encrypt, you write an Ansible playbook (or whatever it is you use for automation) once, run it everywhere. You select a TLS monitoring service (or run your own) once, enter your URLs, and you're done. You only have to intervene when problems arise (and that can happen with CAs that you have paid as well).
- abiogenesis 6y ago
AdrianB1 6y ago
> You can't hook something up to the internet, chuck it in your closet, forget about it for five years, and expect zero issues. You need to pay attention to it. You should. 2 examples: - the average age of the planes for major airliners is 20 years. Maintenance - yes, retrofitting the cockpit every year just because a vendor decided to change the protocol for the sensor or control, no - about 18 years ago an intern in my company built (with external developers) an application for internal use; today the intern's career reached senior director level, left the company, the application is still used on a regular basis by every single employee; the only change was to move it from a physical server (there was no virtualization in 2002) to a VM. 5 years is not an unreasonable expectation from a damn thing to work without pampering
- cuillevel3 6y ago
  The first plane started in 1903, they have a bit more experience. Also they are crazy expensive and dangerous. Your mail server is not.
  - jacquesm 6y ago
    Mail and web servers should be a lot simpler to set up and maintain than aircraft too. But Letsencrypt, instead of making things simpler actually became a source of extra work, sometimes a lot of work.
- xoa 6y ago
  >the average age of the planes for major airliners is 20 years. Maintenance - yes, retrofitting the cockpit every year just because a vendor decided to change the protocol for the sensor or control, no Civilian airliners don't face a HUMAN DRIVEN ADVERSARIAL ENVIRONMENT for general airspace. In the rare occasions they do, everyone dies. Internet connected devices all do all the time, and indeed that is the entire point of all these security measures and upgrade requirements. I don't know why this is such a frequent screw up in comparisons by people complaining about security. Why bother with TLS at all? Plain old http is a ton simpler and easier. Why not just run everything as root? Etc etc. Systems were much simpler and more hackable back in the day, but running that way these days is simply not doable. If you wanted to compare to planes, the proper comparison would be military aircraft. And those do indeed have constant block updates over their lifetimes to ECM, comms, weapons, etc. Dealing with an adversarial environment with intelligent adapter attackers requires adaption in turn.
gexla 6y ago
This is a great comment. There are a lot of people who are going to get tripped up because they aren't really system admins. Or it might not be that important if it fails. If you only have to mess with it rarely, then it's probably not critical. But for people who spend a substantial amount of time with their hands in servers, this comment is spot on.
FpUser 6y ago
>" It's not the ninties anymore... You can't hook something up to the internet, chuck it in your closet, forget about it for five years, and expect zero issues" Ouch! This is just too bad. I suggest we go back.
jldugger 6y ago
> It logs failures. You should read your logs. > If you've built a system where silently failing is a problem, and you haven't configured any sort of "email me when anything isn't nominal" then you haven't finished configuring your server. I mean, I built a system years ago then got a full time job. Shit breaking every 3 months is kinda bad for a hobbyist website / blog. Even when the monitoring is in place, there's ample room to decide 'you know, family emergency is more important than rearchitecting my TLS certs again.'
- couchand 6y ago
  Running your own server connected to the Internet is not a hobby and nobody should get the impression that it will be. Otherwise you're just making a donation to a DDOS swarm.
  - jldugger 6y ago
    It hosts a static website with no meaningful network dependencies other than the control plane and letsencrypt. I'm relatively comfortable with the situation.
  - AlisdairO 6y ago
    Do we have any real evidence that hobbyist servers are significant hitters when it comes to DDOSes? The idea that hobbyists shouldn't run a server is, IMO, misguided, and dangerous to the health of the internet. A simple debian VM + nginx + $app_server with automatic updates turned on is not rocket science, and I struggle to see why one shouldn't run that as a hobbyist.
mr_toad 6y ago
You also get an email if your cert is about to expire.

by ohazi 6y ago

logicchains 6y ago

>You can't hook something up to the internet, chuck it in your closet, forget about it for five years, and expect zero issues. You need to pay attention to it. This kind of contempt for users is why I try to avoid using any libraries/software written in Python. Somebody always thinks their minor backwards incompatible change is such a precious snowflake that it justifies wasting collectively thousands of hours of users' time debugging and updating their stuff to work around it.

boudin 6y ago
I don't think that's what the author says. There's been some changes in the past to the acme protocol requiring to update whatever client you use.
msla 6y ago
It isn't contempt to realize that security landscapes change, and what was best practice in the past is insecure now.
aeturnum 6y ago
I don't think this is "contempt for users," it's a position that configurations that appear to setup a web server to run without monitoring for years are deceptive and harmful to the admin taken in by them. It's an ethical (and technical) position that tools should push their users to adopt maintenance practices that are seen as responsible by the wider community. It's not contempt to inform people about the level of work you expect is required to do what they are planning. It's also, if letsencrypt happens to be wrong, not contemptuous to be wrong!
lallysingh 6y ago
The one with contempt for users is reality itself. Computer security is hard, and whatever you have installed today will force you to update it later, directly or indirectly, due to security. Don't blame the messenger.
RandoHolmes 6y ago
That's not a Python specific problem, but otherwise I agree with your point.
- paul_f 6y ago
  No, but when it occurs, it's usually Python

jacquesm 6y ago

> You need to pay attention to it. My whole reason for switching to LE was that it was announced as an automatic way to upgrade certificates. So it required less of my attention than before. Or at least, that was the spiel.

hn_check 6y ago
You should demand a refund. Vote with your wallet. Of course that was a bit trenchant, however you're complaining about a promise that was never made. No one ever promised that you could setup a old certbot instance and it was out of sight and mind for perpetuity. There are any number of issues that can occur, and honestly if one expected certbot to run without issue, having it automatically updating as well seems to be a base minimum. Also worth noting that LE was early with ACMEv1, but a lot of alternatives started with ACMEv2. ACMEv2 became the common standard.
- jacquesm 6y ago
  Yes, but that hole was closed almost immediately as far as I know.
  - tptacek 6y ago
    No, it was not. It's a protocol bug. The hole was "closed" by deprecating and then removing tls-sni-01.
cuillevel3 6y ago
Interesting perspective. For me it was clear from the beginning that I'm trading convenience for free certs. Criticism of the "official" client was also very loud from the start. I do agree that LetsEncrypt has been a constant source of maintenance problems over the years. For example now, I have to switch to another alternative acme client, since the old one doesn't seem to be in active development anymore... However, certificates used to be expensive, even unaffordable for some projects.
- 6y ago

bartvk 6y ago

Since my college days, I've been running a Linux server, of some sorts, somewhere. Usually running Debian. To be honest, I also haven't configured any sort of notification when anything isn't nominal. Once I did set up Zabbix. But it turned out that Debian/Linux is incredibly reliable. When I migrated to a new server (or rather VPS), I simply haven't bothered installing any kind of notification. It just runs and runs, it's like an appliance. I can see people falling into the trap. They run Linux their whole lives, and it never failed them. Then they introduce something new, like Certbot, and for the first time, there's a hiccup and they get frustrated :D

bigiain 6y ago

> You need to pay attention to it If I have to pay attention to it four times a year and regularly spend a day updating software I didn't want to have let alone update, I should have just paid GoDaddy or whoever their $100 grift and only had to update the cert once a year and not hunt down stupid error messages and look for release notes on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard.' Amazon haven't done something this stupid with their 'free" ssl certs for load balancers, and you know why? Because the provide them to "customers", not to "early adopting cheapskate beta testing schmucks"...

wongarsu 6y ago
>and you know why? because they control the software on both ends and can update certificate clients on the load balancers anytime they want?
PaulKeeble 6y ago
It is actually easier to deploy a repeat certificate you bought as well. Once you have it all setup it is usually just a drop in replacement and a config reload of the web server. Multiple times now I have spent hours fiddling with certbot trying to get it to do its job properly and stop invalidating my certificates. SSL has never been as much hassle as it has been with letsencrypt. Its free and I feel like I am getting what I paid for!
perlgeek 6y ago
I've been using let's encrypt nearly since it started issuing certificates, and I had to intervene only once so far. I think one thing that's missing from the discussion is scalability. Sure you can pay a CA for a cert that is valid for a year, but you still have to do your update dance once per year per site. With let's encrypt, you write an Ansible playbook (or whatever it is you use for automation) once, run it everywhere. You select a TLS monitoring service (or run your own) once, enter your URLs, and you're done. You only have to intervene when problems arise (and that can happen with CAs that you have paid as well).
abiogenesis 6y ago

AdrianB1 6y ago

> You can't hook something up to the internet, chuck it in your closet, forget about it for five years, and expect zero issues. You need to pay attention to it. You should. 2 examples: - the average age of the planes for major airliners is 20 years. Maintenance - yes, retrofitting the cockpit every year just because a vendor decided to change the protocol for the sensor or control, no - about 18 years ago an intern in my company built (with external developers) an application for internal use; today the intern's career reached senior director level, left the company, the application is still used on a regular basis by every single employee; the only change was to move it from a physical server (there was no virtualization in 2002) to a VM. 5 years is not an unreasonable expectation from a damn thing to work without pampering

cuillevel3 6y ago
The first plane started in 1903, they have a bit more experience. Also they are crazy expensive and dangerous. Your mail server is not.
- jacquesm 6y ago
  Mail and web servers should be a lot simpler to set up and maintain than aircraft too. But Letsencrypt, instead of making things simpler actually became a source of extra work, sometimes a lot of work.
xoa 6y ago
>the average age of the planes for major airliners is 20 years. Maintenance - yes, retrofitting the cockpit every year just because a vendor decided to change the protocol for the sensor or control, no Civilian airliners don't face a HUMAN DRIVEN ADVERSARIAL ENVIRONMENT for general airspace. In the rare occasions they do, everyone dies. Internet connected devices all do all the time, and indeed that is the entire point of all these security measures and upgrade requirements. I don't know why this is such a frequent screw up in comparisons by people complaining about security. Why bother with TLS at all? Plain old http is a ton simpler and easier. Why not just run everything as root? Etc etc. Systems were much simpler and more hackable back in the day, but running that way these days is simply not doable. If you wanted to compare to planes, the proper comparison would be military aircraft. And those do indeed have constant block updates over their lifetimes to ECM, comms, weapons, etc. Dealing with an adversarial environment with intelligent adapter attackers requires adaption in turn.

gexla 6y ago

This is a great comment. There are a lot of people who are going to get tripped up because they aren't really system admins. Or it might not be that important if it fails. If you only have to mess with it rarely, then it's probably not critical. But for people who spend a substantial amount of time with their hands in servers, this comment is spot on.

FpUser 6y ago

>" It's not the ninties anymore... You can't hook something up to the internet, chuck it in your closet, forget about it for five years, and expect zero issues" Ouch! This is just too bad. I suggest we go back.

jldugger 6y ago

> It logs failures. You should read your logs. > If you've built a system where silently failing is a problem, and you haven't configured any sort of "email me when anything isn't nominal" then you haven't finished configuring your server. I mean, I built a system years ago then got a full time job. Shit breaking every 3 months is kinda bad for a hobbyist website / blog. Even when the monitoring is in place, there's ample room to decide 'you know, family emergency is more important than rearchitecting my TLS certs again.'

couchand 6y ago
Running your own server connected to the Internet is not a hobby and nobody should get the impression that it will be. Otherwise you're just making a donation to a DDOS swarm.
- jldugger 6y ago
  It hosts a static website with no meaningful network dependencies other than the control plane and letsencrypt. I'm relatively comfortable with the situation.
- AlisdairO 6y ago
  Do we have any real evidence that hobbyist servers are significant hitters when it comes to DDOSes? The idea that hobbyists shouldn't run a server is, IMO, misguided, and dangerous to the health of the internet. A simple debian VM + nginx + $app_server with automatic updates turned on is not rocket science, and I struggle to see why one shouldn't run that as a hobbyist.

mr_toad 6y ago

You also get an email if your cert is about to expire.