3 ms·
One issue with requiring some kind of fee to get SSL certificates is that it acts as a barrier to hobbyists and kids trying to set up a website (probably to lea
by ndsipa_pomu 2y ago
One issue with requiring some kind of fee to get SSL certificates is that it acts as a barrier to hobbyists and kids trying to set up a website (probably to learn about the technologies involved). That barrier means that there'll likely be more unsecured websites around which is not desirable.
Maybe some kind of traffic based tax would be better - just have the biggest ISPs pay for all of the free CAs.
- rsync 2y ago… which was never a problem until we all decided that every single website, no matter how boring or inconsequential, needed to be encrypted. There is no reason for kozubik.com to be served with SSL … But browser behaviors, and changing social norms force me to do it.
- ndsipa_pomu 2y agoWell, here in the UK, we had the BT ISP attempt to inject adverts into plain HTTP pages that their customers were requesting. HTTPS prevents that kind of abuse, so I welcome HTTPS on every single website as we can't trust big companies to not try to mess with us.
- castillar76 2y agoDon't get me wrong: I don't object to the existence of non-profit/funded CAs like Let's Encrypt! The work they've been doing on making HTTPS the norm is excellent. I just worry about a future in which the only option is a CA like that, as the other public CAs struggle with offering a product that competes with "but it's free!". I also worry a bit about the amount of the Internet that now depends on Let's Encrypt, including a number of large enterprises. That didn't go very well the last time we had an 800-pound gorilla in the CA space, not to mention the availability problems that will occur if everyone depends on a single CA that then has an outage, a mass revocation problem, or has a disagreement with the browsers over issuance rules.