5 ms·

It saves me from the implementation details, this way I don't need to wear another engineer/sysadmin hat. I think the website content is more important than the

It saves me from the implementation details, this way I don't need to wear another engineer/sysadmin hat. I think the website content is more important than the SSL implementation!

ethbr0 4y ago
Indeed! It's how security should work, and should be the default dual-goal of any piece of security software: provide as much security as possible to as many people as possible.
- doublerabbit 4y ago
  - Thiez 4y ago
    I should hope HN hashes our passwords, instead of encrypting them. And for encrypted data I would expect them to use symmetric key encryption, rather than certificates with RSA or another form of public key cryptography. Your post contains some very basic misconceptions. This is going to sound harsh, but I would recommend not putting too much stock in your own opinions on security, and instead to trust the experts.
    - doublerabbit 4y ago
      Not harsh at all. I understand I am no security expert, bores the heck out of me. Sadly, you shouldn't trust the "experts" to be if that's LetsEncrypt. No one can be trusted apart from yourself when implementing security. If LE is ran with the following companies, "Electronic Frontier Foundation; Mozilla Foundation; University of Michigan; Akamai Technologies; Cisco Systems" What makes them all trade worthy, especially when they're all American? Especially after the whole Richard Stallman. Mozilla, maybe because they were netscape. I have more than enough experience working within security to know that. I've seen SysOps leak DB's, Passwords in plaintext.. and I've seen it from the age of where such didn't exist to where companies are now installing X security appliances to safe guard there networks. I'm not newb, from 2004 to now, counted 15 years of System and Network engineer experience. Fair from experienced but well seasoned. Why isn't HackerNews using LetsEncrypt, Google, Netflix, Amazon, if promoted as a great thing. Is what I want to know.
      - fudgefactorfive 4y ago
        HN: Pretty sure their relationship with DigiCert predates LE, why change if the current relationship is functional. Google: Browser Maintainer that runs entire TLDs, doesn't need a third party, it could just decide to trust itself and 60+% of the market follows. Amazon: Runs a massive chunk of the internet, it's already MitM'd itself and most other things, doesn't really need a third party for Certs but still uses DigiCert which predates LE and they clearly have a working relationship. Netflix: See Amazon, HN. You: Barely exist to the infrastructure of the web as people experience it. Maybe you have a static site you don't care to protect from MitM (could add some malicious scripts or whatever but who cares). Maybe you're a tiny service that offers some 50 users something, their plaintext auth probably shouldn't be readable to just anyone along the network path, but they're not paying you for services so you might not wanna spend much money on that service. Use LE. Also, if you think LE as a company has the ability to take sites with it if it goes down, you don't really understand Web PKI. At most likely within a year to 3 months you'd need to find a new place if their signatures expire. At worst someone could pretend to be you, but still not read that traffic protected by the old cert. Why so salty about LE? Especially from a "seasoned" SysEng? Didn't it just make your job easier and safer for those with slightly less experience?
        doublerabbit 4y ago
        > Why so salty about LE? Especially from a "seasoned" SysEng? Didn't it just make your job easier and safer for those with slightly less experience? Because it's required, I don't know the companies, I can't trust the companies. I just not happy that four companies run the worlds SSL. There should be another technology that caters to such without having to put all the keys in one basket.
        doublerabbit 4y ago
        > Why so salty about LE? Especially from a "seasoned" SysEng? Didn't it just make your job easier and safer for those with slightly less experience? Because it's required, I don't know the companies, I can't trust the companies. I just not happy that four companies run the worlds SSL. There should be another technology that caters to such without having to put all the keys in one basket. > Didn't it just make your job easier and safer for those with slightly less experience? No. It makes it harder, because your not teaching someone anyone thing you tell them "click here, click that, done"
  - vladd 4y ago
    I believe you get downvotes because you think by analogy rather than by reasoning. Not having that big corporation example doesn't negate Let's Encrypt's value proposition (and the improvement they brought compared with the way things were done before). Also you're mixing security on data transportation with security of data at rest. Both are important but there are different solutions to each.
  - shepherdjerred 4y ago
    > No thanks. Why doesn't Google, Microsoft, HackerNews use LetsEncrypt? Why does Bill Gates use Windows? There must be some fatal flaw in macOS if so many are choosing other operating systems!
    - doublerabbit 4y ago
      I doubt that he does just use Windows. I could see him use Linux and MacOS. Those days are over.
  - spicybright 4y ago
    So for one, if you're looking for an actual answer, dial it down a few notches. Your post is 18 minutes old as of me writing and you're already boasting about a lack of replies. Two, you're likely misunderstanding the purpose of SSL and Let's Encrypt. It's not to protect you against the site you're talking to, it's to prevent man in the middle attacks on the way. It ensures you can't walk into a starbucks for an hour and walk away with dozens of facebook logins. Lastly, the big players don't use Let's Encrypt for reliability and customer service purposes. If you run a blog and your cert screws up, the 3 people visitng your site that week will have to click a few extra buttons to get in. If you're a microsoft, that can mean thousands if not millions of users hitting this wall they expect not to have, leading to huge costs for customer support and occassionally deeper issues updating certificates. Exactly the same reason Bank of America doesn't use godaddy.com for their domain name. Before Let's Encrypt, certs cost money from certificate authorities, so not many smaller companies would bother. Now it's streamlined enough that browsers throw scary warnings if you don't have it, which is a massive improvement for everyone using the web.
    - doublerabbit 4y ago
      > Before Let's Encrypt, certs cost money from certificate authorities, so not many smaller companies would bother. Now it's streamlined enough that browsers throw scary warnings if you don't have it, which is a massive improvement for everyone using the web. But should they? I never had any issues running an internet site before this was required. A blog doesn't need SSL. Why are ISP's not more scrutinized to ensure that MITM doesn't happen? Why is it put upon the admin? My blog from 2005 was never hit with MITM. > If you're a microsoft, that can mean thousands if not millions of users hitting this wall they expect not to have, leading to huge costs for customer support and occassionally deeper issues updating certificates. Exactly the same reason Bank of America doesn't use godaddy.com for their domain name. So your saying LE is only worth for small-class sites such as "blogs", which than I above said, Why does a blog need SSL? The only reasoning I had which was valid was that "ISP's inject" and if that's the case why are ISP's allowed to get away with injection? > Your post is 18 minutes old as of me writing and you're already boasting about a lack of replies. Folks like to down-vote and never reply. I'm sure I might be "flagged" soon too. > Two, you're likely misunderstanding the purpose of SSL and Let's Encrypt. Not at all, SSL is the communications protocol. A encrypted-tunnel example made by HTTPS. Verified by a Certificate if we apply laymans terms. LetsEncrypt issues that certification based on the trusted root installed on your computer and if all valid, the brower throws a green badge. I can easily remove the LE root certificate and any LE encrypted site would be invalid.
  - wtetzner 4y ago
    > Just takes one bad actor for LetsEncrypt to swallow your site whole. What do you mean by this?
- bombolo 4y ago
  Having people do things without understanding what exactly they are doing is a good way to create a website with a very good ssl certificate and their private key available on the website itself… or similar issues.

It saves me from the implementation details, this way I don't need to wear another engineer/sysadmin hat. I think the website content is more important than the SSL implementation!

ethbr0 4y ago

Indeed! It's how security should work, and should be the default dual-goal of any piece of security software: provide as much security as possible to as many people as possible.

doublerabbit 4y ago
- Thiez 4y ago
  I should hope HN hashes our passwords, instead of encrypting them. And for encrypted data I would expect them to use symmetric key encryption, rather than certificates with RSA or another form of public key cryptography. Your post contains some very basic misconceptions. This is going to sound harsh, but I would recommend not putting too much stock in your own opinions on security, and instead to trust the experts.
  - doublerabbit 4y ago
    Not harsh at all. I understand I am no security expert, bores the heck out of me. Sadly, you shouldn't trust the "experts" to be if that's LetsEncrypt. No one can be trusted apart from yourself when implementing security. If LE is ran with the following companies, "Electronic Frontier Foundation; Mozilla Foundation; University of Michigan; Akamai Technologies; Cisco Systems" What makes them all trade worthy, especially when they're all American? Especially after the whole Richard Stallman. Mozilla, maybe because they were netscape. I have more than enough experience working within security to know that. I've seen SysOps leak DB's, Passwords in plaintext.. and I've seen it from the age of where such didn't exist to where companies are now installing X security appliances to safe guard there networks. I'm not newb, from 2004 to now, counted 15 years of System and Network engineer experience. Fair from experienced but well seasoned. Why isn't HackerNews using LetsEncrypt, Google, Netflix, Amazon, if promoted as a great thing. Is what I want to know.
    - fudgefactorfive 4y ago
      HN: Pretty sure their relationship with DigiCert predates LE, why change if the current relationship is functional. Google: Browser Maintainer that runs entire TLDs, doesn't need a third party, it could just decide to trust itself and 60+% of the market follows. Amazon: Runs a massive chunk of the internet, it's already MitM'd itself and most other things, doesn't really need a third party for Certs but still uses DigiCert which predates LE and they clearly have a working relationship. Netflix: See Amazon, HN. You: Barely exist to the infrastructure of the web as people experience it. Maybe you have a static site you don't care to protect from MitM (could add some malicious scripts or whatever but who cares). Maybe you're a tiny service that offers some 50 users something, their plaintext auth probably shouldn't be readable to just anyone along the network path, but they're not paying you for services so you might not wanna spend much money on that service. Use LE. Also, if you think LE as a company has the ability to take sites with it if it goes down, you don't really understand Web PKI. At most likely within a year to 3 months you'd need to find a new place if their signatures expire. At worst someone could pretend to be you, but still not read that traffic protected by the old cert. Why so salty about LE? Especially from a "seasoned" SysEng? Didn't it just make your job easier and safer for those with slightly less experience?
      - doublerabbit 4y ago
        > Why so salty about LE? Especially from a "seasoned" SysEng? Didn't it just make your job easier and safer for those with slightly less experience? Because it's required, I don't know the companies, I can't trust the companies. I just not happy that four companies run the worlds SSL. There should be another technology that caters to such without having to put all the keys in one basket.
      - doublerabbit 4y ago
        > Why so salty about LE? Especially from a "seasoned" SysEng? Didn't it just make your job easier and safer for those with slightly less experience? Because it's required, I don't know the companies, I can't trust the companies. I just not happy that four companies run the worlds SSL. There should be another technology that caters to such without having to put all the keys in one basket. > Didn't it just make your job easier and safer for those with slightly less experience? No. It makes it harder, because your not teaching someone anyone thing you tell them "click here, click that, done"
- vladd 4y ago
  I believe you get downvotes because you think by analogy rather than by reasoning. Not having that big corporation example doesn't negate Let's Encrypt's value proposition (and the improvement they brought compared with the way things were done before). Also you're mixing security on data transportation with security of data at rest. Both are important but there are different solutions to each.
- shepherdjerred 4y ago
  > No thanks. Why doesn't Google, Microsoft, HackerNews use LetsEncrypt? Why does Bill Gates use Windows? There must be some fatal flaw in macOS if so many are choosing other operating systems!
  - doublerabbit 4y ago
    I doubt that he does just use Windows. I could see him use Linux and MacOS. Those days are over.
- spicybright 4y ago
  So for one, if you're looking for an actual answer, dial it down a few notches. Your post is 18 minutes old as of me writing and you're already boasting about a lack of replies. Two, you're likely misunderstanding the purpose of SSL and Let's Encrypt. It's not to protect you against the site you're talking to, it's to prevent man in the middle attacks on the way. It ensures you can't walk into a starbucks for an hour and walk away with dozens of facebook logins. Lastly, the big players don't use Let's Encrypt for reliability and customer service purposes. If you run a blog and your cert screws up, the 3 people visitng your site that week will have to click a few extra buttons to get in. If you're a microsoft, that can mean thousands if not millions of users hitting this wall they expect not to have, leading to huge costs for customer support and occassionally deeper issues updating certificates. Exactly the same reason Bank of America doesn't use godaddy.com for their domain name. Before Let's Encrypt, certs cost money from certificate authorities, so not many smaller companies would bother. Now it's streamlined enough that browsers throw scary warnings if you don't have it, which is a massive improvement for everyone using the web.
  - doublerabbit 4y ago
    > Before Let's Encrypt, certs cost money from certificate authorities, so not many smaller companies would bother. Now it's streamlined enough that browsers throw scary warnings if you don't have it, which is a massive improvement for everyone using the web. But should they? I never had any issues running an internet site before this was required. A blog doesn't need SSL. Why are ISP's not more scrutinized to ensure that MITM doesn't happen? Why is it put upon the admin? My blog from 2005 was never hit with MITM. > If you're a microsoft, that can mean thousands if not millions of users hitting this wall they expect not to have, leading to huge costs for customer support and occassionally deeper issues updating certificates. Exactly the same reason Bank of America doesn't use godaddy.com for their domain name. So your saying LE is only worth for small-class sites such as "blogs", which than I above said, Why does a blog need SSL? The only reasoning I had which was valid was that "ISP's inject" and if that's the case why are ISP's allowed to get away with injection? > Your post is 18 minutes old as of me writing and you're already boasting about a lack of replies. Folks like to down-vote and never reply. I'm sure I might be "flagged" soon too. > Two, you're likely misunderstanding the purpose of SSL and Let's Encrypt. Not at all, SSL is the communications protocol. A encrypted-tunnel example made by HTTPS. Verified by a Certificate if we apply laymans terms. LetsEncrypt issues that certification based on the trusted root installed on your computer and if all valid, the brower throws a green badge. I can easily remove the LE root certificate and any LE encrypted site would be invalid.
- wtetzner 4y ago
  > Just takes one bad actor for LetsEncrypt to swallow your site whole. What do you mean by this?
bombolo 4y ago
Having people do things without understanding what exactly they are doing is a good way to create a website with a very good ssl certificate and their private key available on the website itself… or similar issues.