4 ms·

This has nothing whatsoever to do with realiability or professionalism, much less is it related to funding, and it very much is a valid alternative. A very exp

• jacquesm 6y ago
  They could simply decide not to break it.
  • brazzy 6y ago
    Which would be the wrong decision if there is a security-critical issue that cannot be fixed in any other way.
    • bigiain 6y ago
      Was there though in this case? I don’t think there was.
• bigiain 6y ago
  The _worst_ of the shitty alternatives, let’s say GoDaddy, have this approach where the mechanism by which I update the ssl certs they provide has remained the same since, honestly? Probably the Mid/late 90’s which was the first time I added an ssl cert to an Apache config. GoDaddy have made exactly zero breaking changes in those intervening 20-25 year. If this had been due to an actual critical security breach in ACMEv1, then maybe doing it would have been excusable - but even then, doing it without proactively contacting every user of their certs to let then know would have been inexcusable. So far as I can tell though, the ACME 1->2 “upgrade” was closer to”Oh, we didn’t like the old guy’s code, so we rewrote it. It’s almost the same, but better! It passes almost 70% of the tests, so we decided versioning things so we could maintain backwards compatibility was too hard, so it sucks to be running a stone ages website that’s over 180 days old - who even are those losers? YOLO!”