12 ms·
Let's Encrypt’s subscriber agreement changes on Sept 21
- Lucent 4y agoThe only real difference I spot in the diff is ISRG not storing your certificate in its repository anymore.
- bobsmooth 4y agoThat's what I gathered.
- infogulch 4y agoIs that different from the certificate transparency log (CT)?
- zinekeller 4y agoYes, previously as part of audit requirements you are required to internally store all certificates you've issued for at least seven years. Seeing as CT is now here though (which is a much more robust system since it's tamper-resistant), storage on your own archives is no longer needed (as long as you can prove that you log them all in CTs).
- infogulch 4y agoThanks!
- buzer 4y agoIn the email that they sent they said following: The main updates are: we now link to instructions on choosing a revocation reason if you revoke a certificate. This is a requirement for Subscriber Agreements from all Certificate Authorities as of this year. Also, we've removed unneeded capitalization, removed a section that is redundant with our Certificate Policy (CP), and tweaked the wording of the requirement to "assure" control of your private key so it matches the Baseline Requirements (BRs).
- jaas 4y agoWe still store the certificate in the same ways we did, we just don't talk about it in the subscriber agreement any more as it's redundant with our CP/CPS documents.
- tempodox 4y agoThe site has a download for the differences, which is very useful. I wish every company would provide that with their TOS updates. https://letsencrypt.org/documents/LE-SA-v1.2-v1.3-diff.docx https://letsencrypt.org/documents/LE-SA-v1.2-v1.3-diff.docx
- nolok 4y ago> I wish every company would provide that with their TOS updates The companies for which you want that are probably the companies who don't want you to figure out what changed though, so little luck of that happening
- jabbany 4y agoMaybe someone could make a tool to generate such a diff automatically.
- hereforphone 4y agoWe could call it 'diff(1)'
- throwaway787544 4y agoCalling it exactly what it does... That's a bit 'on the nose', isn't it? Shouldn't we call it "gadget", or "razlika", or "moon beam" ? Something cool and confusing, with an available domain name for our flashy homepage and mascot. How else will we popularize and monetize it?
- SketchySeaBeast 4y agoDon't forget to include a "Made with ♡ by ..." somewhere on the page.
- joshka 4y agodffr-bleed, but you forgot that we need a really good logo.
- alfiedotwtf 4y agoI moved from letsencrypt over to AWS ACM, but the letsencrypt emails don't have an Unsubscribe :(
- tux2bsd 4y ago> the letsencrypt emails don't have an Unsubscribe Yes and that is really stupid, especially from a group of people who are otherwise very clever.
- deleted 4y ago[deleted]
- afiori 4y agoNewsletters or notifications?
- tux2bsd 4y agoIrrelevant. Think of it this way, Let's Encrypt could be emailing a dead person and you can't tell them to fuck off.
- dicknuckle 4y agoExcept that it does, just not via email. You have to unsubscribe the same way you subscribed.
- wonderbore 4y agoThat’s not enough. CAN-SPAM is nearly 20-years-old now, it’s not even a GDPR matter. The rule is pretty clear in having to provide an unsubscribe link in every email. It’s really quite annoying that companies have taken this “you can’t unsubscribe from service emails” approach and I wish this act would get a refresh 20 years later.
- kayodelycaon 4y ago