3 ms·

Setting up, monitoring and maintaining LE isn't free

by switch007 5y ago

shadowgovt 5y ago
But monitoring and maintenance are things someone needs to do if they operate a site, period.
- winternett 5y ago
  But if you're independently running, paying for, and managing multiple sites, it's a HUGE burden. It also kills innovation for independent devs and startups, and dramatically raises the cost/investment threshold for this kind of innovation. Pricing on cert services is also far too high when everyone's concern and agreement should be security as a basis for operations. It's not something that should be an upcharge or income opportunity. You buy a door lock for your home once, and it works as long as you don't compromise the key. If you buy a house, door locks are expected to come with the house in most circumstances.
  - shadowgovt 5y ago
    And, indeed, if you build your site via a service provider or platform, an SSL solution is usually provided. Building a site from scratch in this day and age is a lot more analogous to building your house from scratch. Nobody to blame but yourself if you buy substandard locks and thieves get in. Only here the metaphor breaks down, because if you aren't encrypting your HTTP traffic and it is intercepted, it's your users who suffer, not the site owner. I, too, pine for the days of simpler internet. But that was a function of the user base, not the technology. It was always insecure... it simply hadn't been exploited yet. Now that it has, and is, site administrators owe it to users to secure their connections.
  - fulafel 5y ago
    Setting up certbot is easy, not a big burden for indie devs. Or if you want to know nothing about tls & certs, just get hosting that comes with tls.
    - winternett 5y ago
      I wasn't writing to the update process, as much as the original installation of a cert. On a house you own, you can change locks and keys any time you want to keep security up to date (for example). no house in "move in ready condition" comes without sufficiently keyed door locks of some kind (on day1).
  - WJW 5y ago
    Having just replaced my door lock, I can assure you that they too wear out and need replacing. (one of the springs inside broke) The pricing on Let's Encrypt is literally zero, and they provide (also free of charge) the `certbot` utility which you can run as a cronjob and which will automatically renew your certificates for you. The whole thing comes extremely well documented and with install scripts that take less than a minute to download, verify and run. If you think even that is too much of a burden I don't think any topic in programming is simple enough.
  - xxpor 5y ago
    traefik takes care of all of this with about 5 lines of setup. it's so trivial i add it to every experimental nonsense service I setup because it's one line of nix config. i really don't understand the complaint.
charcircuit 5y ago
It all happens automatically after a setup process that takes less than a minute.
- switch007 5y ago
  I’ve spent hours fixing, debugging and upgrading LE clients this year. “I’m doing it wrong” I’m sure
ertian 5y ago
Whether or not that's true, it's not a money grab.

Setting up, monitoring and maintaining LE isn't free

shadowgovt 5y ago

But monitoring and maintenance are things someone needs to do if they operate a site, period.

winternett 5y ago
But if you're independently running, paying for, and managing multiple sites, it's a HUGE burden. It also kills innovation for independent devs and startups, and dramatically raises the cost/investment threshold for this kind of innovation. Pricing on cert services is also far too high when everyone's concern and agreement should be security as a basis for operations. It's not something that should be an upcharge or income opportunity. You buy a door lock for your home once, and it works as long as you don't compromise the key. If you buy a house, door locks are expected to come with the house in most circumstances.
- shadowgovt 5y ago
  And, indeed, if you build your site via a service provider or platform, an SSL solution is usually provided. Building a site from scratch in this day and age is a lot more analogous to building your house from scratch. Nobody to blame but yourself if you buy substandard locks and thieves get in. Only here the metaphor breaks down, because if you aren't encrypting your HTTP traffic and it is intercepted, it's your users who suffer, not the site owner. I, too, pine for the days of simpler internet. But that was a function of the user base, not the technology. It was always insecure... it simply hadn't been exploited yet. Now that it has, and is, site administrators owe it to users to secure their connections.
- fulafel 5y ago
  Setting up certbot is easy, not a big burden for indie devs. Or if you want to know nothing about tls & certs, just get hosting that comes with tls.
  - winternett 5y ago
    I wasn't writing to the update process, as much as the original installation of a cert. On a house you own, you can change locks and keys any time you want to keep security up to date (for example). no house in "move in ready condition" comes without sufficiently keyed door locks of some kind (on day1).
- WJW 5y ago
  Having just replaced my door lock, I can assure you that they too wear out and need replacing. (one of the springs inside broke) The pricing on Let's Encrypt is literally zero, and they provide (also free of charge) the `certbot` utility which you can run as a cronjob and which will automatically renew your certificates for you. The whole thing comes extremely well documented and with install scripts that take less than a minute to download, verify and run. If you think even that is too much of a burden I don't think any topic in programming is simple enough.
- xxpor 5y ago
  traefik takes care of all of this with about 5 lines of setup. it's so trivial i add it to every experimental nonsense service I setup because it's one line of nix config. i really don't understand the complaint.

charcircuit 5y ago

It all happens automatically after a setup process that takes less than a minute.

switch007 5y ago
I’ve spent hours fixing, debugging and upgrading LE clients this year. “I’m doing it wrong” I’m sure

ertian 5y ago

Whether or not that's true, it's not a money grab.