4 ms·

Post author here. To clarify, my intention was not to blame ACME for this and certainly not Let's Encrypt specifically (there are many other CAs that will suppl

Post author here. To clarify, my intention was not to blame ACME for this and certainly not Let's Encrypt specifically (there are many other CAs that will supply certificates via the ACME protocol). I don't consider the pre-ACME way (verification via whois+email) for certificates with a long lifetime to be a more secure or elegant solution than what we have today. But certainly, the ecosystem is not perfect and it continues to adapt. CAA and (for XMPP at least) channel binding and DANE are the obvious next steps.

atmosx 3y ago
I have to ask, do you trust Hetzner? As many mitigations you can take, they control the underlying infrastructure it's a matter of how far they'll go. Not saying any other provider is better, but this one was caught red-handed. Germany is obviously not the _best_ jurisdiction to host an XMPP server. On the other hand, philosophically, the "good citizen" is the one who abides to the laws of the country they reside.
- deleted 3y ago
  [deleted]
- LinuxBender 3y ago
  I have to ask, do you trust Hetzner? Not the person you are asking but I trust all legit vendors to follow most of the rules most of the time. All vendors must comply with lawful orders or risk all their equipment being seized. There have been a number of cases were vendors tried to ignore court orders but the most notable one I recall is Lavabit. [1] That predictably ended poorly for them. We won't hear the details of this case until the investigations are tied off. At best one could use Monero to rent space from one of the shady resellers sometimes referred to as bullet proof hosting but those do not last long and the ones that do last are honeypots. Even then people would have to create their own TLD's, CA's and use /etc/hosts which won't happen due to friction and a lack of discipline. Following that would be private VPN meshes and ephemeral nodes that hide the final hops but those only require a small number of weak links or people to fail as they have in the past. [1] - https://www.theguardian.com/world/2013/oct/03/lavabit-ladar-levison-fbi-encryption-keys-snowden https://www.theguardian.com/world/2013/oct/03/lavabit-ladar-...
- MattJ100 3y ago
  In summary: I trust them no less than practically any other reputable provider. If you look at the turbulent history of providers that won't follow court orders, it's a real bucket of fun. Not one I particularly feel comfortable building a sustainable open-source not-for-profit business on top of. Nevertheless, freedom is the heart of what we do: all our software is open-source and easily self-hostable, so if people want to go for those kinds of providers, they're absolutely able to. In fact if you're super concerned about physical security, I can only recommend hosting at home as a solution. But that doesn't mean we're happy with what happened here. Regardless or who performed it or why, this was an attack on an essential layer of what keeps our systems secure, and that's why we're taking steps to ensure they become impossible. It's also our goal to diversify our hosting locations, to other providers and geographic regions for a number of reasons. That just hasn't happened yet, because we're still pretty small. If you have suggestions of other providers that we should be looking at, I'm very interested!
  - atmosx 3y ago
    No suggestions here, but thanks for taking the time to reply.

atmosx 3y ago

I have to ask, do you trust Hetzner? As many mitigations you can take, they control the underlying infrastructure it's a matter of how far they'll go. Not saying any other provider is better, but this one was caught red-handed. Germany is obviously not the _best_ jurisdiction to host an XMPP server. On the other hand, philosophically, the "good citizen" is the one who abides to the laws of the country they reside.

deleted 3y ago
[deleted]
LinuxBender 3y ago
I have to ask, do you trust Hetzner? Not the person you are asking but I trust all legit vendors to follow most of the rules most of the time. All vendors must comply with lawful orders or risk all their equipment being seized. There have been a number of cases were vendors tried to ignore court orders but the most notable one I recall is Lavabit. [1] That predictably ended poorly for them. We won't hear the details of this case until the investigations are tied off. At best one could use Monero to rent space from one of the shady resellers sometimes referred to as bullet proof hosting but those do not last long and the ones that do last are honeypots. Even then people would have to create their own TLD's, CA's and use /etc/hosts which won't happen due to friction and a lack of discipline. Following that would be private VPN meshes and ephemeral nodes that hide the final hops but those only require a small number of weak links or people to fail as they have in the past. [1] - https://www.theguardian.com/world/2013/oct/03/lavabit-ladar-levison-fbi-encryption-keys-snowden https://www.theguardian.com/world/2013/oct/03/lavabit-ladar-...
MattJ100 3y ago
In summary: I trust them no less than practically any other reputable provider. If you look at the turbulent history of providers that won't follow court orders, it's a real bucket of fun. Not one I particularly feel comfortable building a sustainable open-source not-for-profit business on top of. Nevertheless, freedom is the heart of what we do: all our software is open-source and easily self-hostable, so if people want to go for those kinds of providers, they're absolutely able to. In fact if you're super concerned about physical security, I can only recommend hosting at home as a solution. But that doesn't mean we're happy with what happened here. Regardless or who performed it or why, this was an attack on an essential layer of what keeps our systems secure, and that's why we're taking steps to ensure they become impossible. It's also our goal to diversify our hosting locations, to other providers and geographic regions for a number of reasons. That just hasn't happened yet, because we're still pretty small. If you have suggestions of other providers that we should be looking at, I'm very interested!
- atmosx 3y ago
  No suggestions here, but thanks for taking the time to reply.