6 ms·

Let's Encrypt’s mission is to create a more secure and privacy-respecting web, except for people residing in countries with the most need for a more secure and

Let's Encrypt’s mission is to create a more secure and privacy-respecting web, except for people residing in countries with the most need for a more secure and privacy-respecting web. Sure, that's great. That said, pretty sure this is stems from the insane US legal requirement to not export SSL technology to enemy countries. I'm sure some of y'all are old enough to remember when web browsers came in "international friendly" versions that supported 40 bit encryption, or "fancy secure" versions with 128 bit encryption.

rzerowan 4mo ago
Seems in all thing tech at the moment the US legal system is accelearting a great split and erectinga digital iron curtain, from AI models to the more mundane like TLS certs. Its been standard for a while for many Linux distros based in the US to toe the party line - like RedHat having notices pretty similar to this one by LE. Seems any meaningful Open Projects will have to choose what path they want to take, be like RISC-V and relocate or LE and others and enforce the divide.
- xxpor 4mo ago
  The RISC-V move was laughable. It’s still US tech, developed largely with DARPA funds.
  - mschuster91 4mo ago
    So what? If I disagree with the direction any FOSS project (or its maintainers) is taking... I can just fork it. People have done that countless times in the history of FOSS, most notably in the xOffice schism.
    - xxpor 4mo ago
      No remotely western company will risk US sanctions violations or whatever other regulatory burden by using US technology where it can't be used. Even Chinese companies depending on how state backed they are might not be willing to risk it.
      - ifwinterco 4mo ago
        This is the big irony of the current situation: while the US is dependent on China for manufactured goods, China is dependent on the US for external demand for its manufactured goods. One is the mirror image of the other and neither economy can exist in its current state in isolation. So China has the US over a barrel when it comes to actually building stuff, rare earths and all of that, but equally US sanctions still have real bite (a lot more than China would like) because China does have to do a huge amount of international trade to export and externalise its surpluses. They're stuck in this unhappy marriage
        re-thc 4mo ago
        > They're stuck in this unhappy marriage Who says they’re stuck or unhappy? This is politics. We’re all just bait. In reality they’re friends. US and China have made more gains by pretending to be enemies than friends and they likely plotted it all together.
      - GoblinSlayer 4mo ago
        It doesn't matter what technology is used, sanctions are imposed when USA doesn't like something.
  - throwaway2037 4mo ago
    Woah, I had no idea about DARPA and RISC-V. I wonder why they care about RISC-V so much? This is the best explanation that I can find: > Open source standards provide great benefits to U.S. taxpayers in reducing the cost of advanced military system development, and also increases security by allowing the government to build their own trusted implementations at low cost. You can read more about it here: https://riscv.org/about/ https://riscv.org/about/ -> See section "DARPA Influence" About their move to Switzerland, they say: > RISC-V International has not incorporated in Switzerland based on any one country, company, government, or event. This move is reflective of community concern and managing strategic risk for our community investing in RISC-V for the next 50+ years.
- thayne 4mo ago
  It isn't just the US. China, Russia, the EU, and Australia and probably others are all increasingly trying to create virtual walls of various forms in the internet.
  - PalmPilotProMax 4mo ago
    It is in the nature of nation states to assert control over national borders. That the Internet and the globalised flow of information it enables circumvents this is a historical anomaly.
throwaway85825 4mo ago
If you truly need a secure and private web you should be using tor.
- Izmaki 4mo ago
  Say what, now? Anonymity and encrypted communication are two very, very different things. Have one but not the other and you're essentially handing off your private data incl. passwords to whoever that has a tap on the communication between you and the server can fetch them, too. Have the other but not the one and everyone will know who you are, but they can't eavesdrop.
  - firefax 4mo ago
    I've had people straight up serve me malware when you attempt to OSINT them with Tor. Sometimes you need different kinds of anonymity, and I see a lot of one sized fits all proclamations on HN.
  - throwaway85825 4mo ago
    I've found lots on Iranians on tor.
dsl 4mo ago
> pretty sure this is stems from the insane US legal requirement to not export SSL technology to enemy countries This is most likely OFAC. Lets Encrypt could apply for a license to do business with sanctioned entities, and given their use case it would most likely be approved. https://ofac.treasury.gov/ofac-license-application-page https://ofac.treasury.gov/ofac-license-application-page
- greyface- 4mo ago
  OFAC regulates commerce, not speech. Let's Encrypt is not doing "business", they're operating a free informational service. Lots of organizations interpret any information exchange as subject to OFAC regulation, and you and Let's Encrypt have good company in this interpretation, but I think it's unnecessarily ceding ground.
  - 10000truths 4mo ago
    The government may use as wide of an interpretation of commerce as they can get away with. We've seen this happen before [0]. Sure, Let's Encrypt isn't taking money from the entities they offer certificates to. But the OFAC desk jockey assigned to that case only has to concoct some sufficiently plausible-sounding trail of money connecting the backing 501(c)3 and a sanctioned entity in order to levy penalties, and the legal team will not like that risk, even if it's unlikely for OFAC to win on appeal in a court. [0]: https://en.wikipedia.org/wiki/Wickard_v._Filburn https://en.wikipedia.org/wiki/Wickard_v._Filburn
    - greyface- 4mo ago
      This is true, of course, and I understand why some companies don't want to take the risk. But I would hope that Let's Encrypt would take the opposite stance. They were born out of the EFF and have EFF & ACLU board members! These orgs live for this type of legal fight.
    - thayne 4mo ago
      IANAL, but it seems like the argument from Wickard v Filburn would apply to LE. They may not be taking money but they do impact the commerce of the market for certificates. I disagree with that ruling, and I have some serious problems with sanctions against entire countries/regions, but it definitely makes sense that LE would interpret it as being impacted by OFAC.
deleted 4mo ago
[deleted]
bhhaskin 4mo ago
It could also be an easy way to not have to implement backdoors for the government/military.
- lxgr 4mo ago
  What "backdoor" would Let's Encrypt even implement? That's not how a CA works. They might be compelled to issue a certificate to an unauthorized (by browser PKI policies, not local law) entity, but that would be very conspicuous due to Certificate Transparency.
  - firefax 4mo ago
    I suspect any "backdoor" would be inserted at the protocol level. See https://web.archive.org/web/20130918135152/http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security https://web.archive.org/web/20130918135152/http://www.thegua...
    - jcranmer 4mo ago
      How would they do that? The ACME protocol is "take the basic artifacts you use for certificate signing, wrap them in JSON (cryptographically, using standard JWS), then send them over using HTTP + TLS." Every part of that is something for which there exists a buttload of implementations in whatever language you care to use.
      - gopher_space 4mo ago
        > How would they do that? Let me introduce you to the phrase "I don't see a mechanism."
        firefax 4mo ago
        >Let me introduce you to the phrase "I don't see a mechanism." I'm not familiar with this phrase, but I think I did a good job citing a comparable example in my original post.
loloquwowndueo 4mo ago
I’m actually old enough to remember how PGP code was exported as a book printout because exporting computer code for cryptography with strong keys in digital form was disallowed but a book was fine (protected by first amendment rights). The printout was scanned abroad to reconstitute the source and build pgp legally.
jaas 4mo ago
Let's Encrypt continues to be available to almost every vulnerable population in the world, including those that need it most. I say almost as I'm hesitant to speak in absolutes regarding a topic as complex as this. Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population. This subscriber agreement update was intended to better reflect our legal requirements. It does not reflect a major change in the service we provide. Our compliance program does evolve over time, and part of that is communicating about it better in our terms of service. It's clear from some of the comments here that we have more work to do to make that text more understandable, we'll work on that. > That said, pretty sure this is stems from the insane US legal requirement to not export SSL technology to enemy countries. I'm sure some of y'all are old enough to remember when web browsers came in "international friendly" versions that supported 40 bit encryption, or "fancy secure" versions with 128 bit encryption. It doesn't.
- notamario 4mo ago
  When you say “our legal requirements” do you mean requirements LE imposes in its agreements or requires imposed on LE by governments?
  - jaas 4mo ago
    I was referring to the requirements imposed on us. When it comes to sanctions, we do not block anything more than what is required by law.
    - marcus_holmes 4mo ago
      The current US government sanctions political enemies [0]. Wouldn't the more rational response to this legal situation be to leave the USA and move somewhere more willing to respect international law? [0] https://www.whitehouse.gov/presidential-actions/2025/02/imposing-sanctions-on-the-international-criminal-court/ https://www.whitehouse.gov/presidential-actions/2025/02/impo...
      - 4mo ago
bigiain 4mo ago
Some (well, at least one) of us are old enough to have owned one of these: http://www.cypherspace.org/adam/uk-shirt.html http://www.cypherspace.org/adam/uk-shirt.html A t-shirt with a Perl script that implemented RSA encryption strong enough to be technically illegal to export from the US. (I must sadly admit to being too cowardly/sensible to have taken that shirt to the US in the late 90s...)
- greyface- 4mo ago
  And if you missed the original run, you can buy a reprint from Adam's current company: https://store.blockstream.com/products/rsa-t-shirt https://store.blockstream.com/products/rsa-t-shirt
- tolciho 4mo ago
  I wore the rsa-dolphin t-shirt all over the place and nobody batted an eye back then, but a dolphin made up of ASCII characters is quite a bit less obvious than the one you linked. OpenBSD being based in Canada ships strong crypto, but has had a sometimes troubled relationship with certain regimes. https://www.openbsd.org/lyrics.html#34 https://www.openbsd.org/lyrics.html#34
- dd8601fn 4mo ago
  DeCSS printed on stuff was a thing for a while, too.
wodenokoto 4mo ago
> Let's Encrypt’s mission is to create a more secure and privacy-respecting web, except for people residing in countries with the most need for a more secure and privacy-respecting web. Sure, that's great. If complying with the law gets in the way of the mission I’m not sure that counts as a change to the mission.
- Supermancho 4mo ago
  > If complying with a law gets in the way of the mission I’m not sure that counts as a change to the mission. It's already illegal to use in NK, but if it's the US, well it's time to steer the mission around it? Gross.
  - wodenokoto 4mo ago
    For an American enterprise? Yes, obviously. Should NRA hand out guns to everyone who can’t get a permit where permits are required? Of course not. If they are against gun permits they have to fight the law, not break it.
    - Supermancho 4mo ago
      The National Rifle Association (NRA) describes itself as America’s longest-standing civil rights organization. That is a specific US-internal stance. There's a list of organizations that started in the US, ultimately having had to work around the US legal system, in pursuit of their missions: re Planned Parenthood Global, WikiLeaks, International Campaign to Ban Landmines, Center for Reproductive Rights, selected programs of the Human Rights Campaign Foundation, et al
__s 4mo ago
http://www.geekytattoos.com/illegal-tattoos-rsa-tattoos http://www.geekytattoos.com/illegal-tattoos-rsa-tattoos tattoo yourself with crypto code to become munitions
golem14 4mo ago
I mean, noone is stopping someone to clone letsencrypt - it shouldn't be very hard. Google had a similar dilemma - do they want to offer a (censored) service in China, and have a hope of keeping some marketshare, or not (and be kicked out immediately). In this case though, it seems to be an unforced move by letsencrypt ? Or was it compelled by LEAs?
p0w3n3d 4mo ago
to not export SSL technology to enemy countries sounds like to not export mathematics
jjav 4mo ago
This is why, as someone who works in security and encryption and has implemented web server TLS stacks and such, I still oppose the "always-https" idea. TLS is awesome, one of the most valuable developments in Internet history. But, it is important to undewrstand that it is a double edged sword. Requiring a CA, which in practical terms means requiring a publicly known CA, is a choke point of freedom.

rzerowan 4mo ago

Seems in all thing tech at the moment the US legal system is accelearting a great split and erectinga digital iron curtain, from AI models to the more mundane like TLS certs. Its been standard for a while for many Linux distros based in the US to toe the party line - like RedHat having notices pretty similar to this one by LE. Seems any meaningful Open Projects will have to choose what path they want to take, be like RISC-V and relocate or LE and others and enforce the divide.

xxpor 4mo ago
The RISC-V move was laughable. It’s still US tech, developed largely with DARPA funds.
- mschuster91 4mo ago
  So what? If I disagree with the direction any FOSS project (or its maintainers) is taking... I can just fork it. People have done that countless times in the history of FOSS, most notably in the xOffice schism.
  - xxpor 4mo ago
    No remotely western company will risk US sanctions violations or whatever other regulatory burden by using US technology where it can't be used. Even Chinese companies depending on how state backed they are might not be willing to risk it.
    - ifwinterco 4mo ago
      This is the big irony of the current situation: while the US is dependent on China for manufactured goods, China is dependent on the US for external demand for its manufactured goods. One is the mirror image of the other and neither economy can exist in its current state in isolation. So China has the US over a barrel when it comes to actually building stuff, rare earths and all of that, but equally US sanctions still have real bite (a lot more than China would like) because China does have to do a huge amount of international trade to export and externalise its surpluses. They're stuck in this unhappy marriage
      - re-thc 4mo ago
        > They're stuck in this unhappy marriage Who says they’re stuck or unhappy? This is politics. We’re all just bait. In reality they’re friends. US and China have made more gains by pretending to be enemies than friends and they likely plotted it all together.
    - GoblinSlayer 4mo ago
      It doesn't matter what technology is used, sanctions are imposed when USA doesn't like something.
- throwaway2037 4mo ago
  Woah, I had no idea about DARPA and RISC-V. I wonder why they care about RISC-V so much? This is the best explanation that I can find: > Open source standards provide great benefits to U.S. taxpayers in reducing the cost of advanced military system development, and also increases security by allowing the government to build their own trusted implementations at low cost. You can read more about it here: https://riscv.org/about/ https://riscv.org/about/ -> See section "DARPA Influence" About their move to Switzerland, they say: > RISC-V International has not incorporated in Switzerland based on any one country, company, government, or event. This move is reflective of community concern and managing strategic risk for our community investing in RISC-V for the next 50+ years.
thayne 4mo ago
It isn't just the US. China, Russia, the EU, and Australia and probably others are all increasingly trying to create virtual walls of various forms in the internet.
- PalmPilotProMax 4mo ago
  It is in the nature of nation states to assert control over national borders. That the Internet and the globalised flow of information it enables circumvents this is a historical anomaly.

throwaway85825 4mo ago

If you truly need a secure and private web you should be using tor.

Izmaki 4mo ago
Say what, now? Anonymity and encrypted communication are two very, very different things. Have one but not the other and you're essentially handing off your private data incl. passwords to whoever that has a tap on the communication between you and the server can fetch them, too. Have the other but not the one and everyone will know who you are, but they can't eavesdrop.
- firefax 4mo ago
  I've had people straight up serve me malware when you attempt to OSINT them with Tor. Sometimes you need different kinds of anonymity, and I see a lot of one sized fits all proclamations on HN.
- throwaway85825 4mo ago
  I've found lots on Iranians on tor.

dsl 4mo ago

> pretty sure this is stems from the insane US legal requirement to not export SSL technology to enemy countries This is most likely OFAC. Lets Encrypt could apply for a license to do business with sanctioned entities, and given their use case it would most likely be approved. https://ofac.treasury.gov/ofac-license-application-page https://ofac.treasury.gov/ofac-license-application-page

greyface- 4mo ago
OFAC regulates commerce, not speech. Let's Encrypt is not doing "business", they're operating a free informational service. Lots of organizations interpret any information exchange as subject to OFAC regulation, and you and Let's Encrypt have good company in this interpretation, but I think it's unnecessarily ceding ground.
- 10000truths 4mo ago
  The government may use as wide of an interpretation of commerce as they can get away with. We've seen this happen before [0]. Sure, Let's Encrypt isn't taking money from the entities they offer certificates to. But the OFAC desk jockey assigned to that case only has to concoct some sufficiently plausible-sounding trail of money connecting the backing 501(c)3 and a sanctioned entity in order to levy penalties, and the legal team will not like that risk, even if it's unlikely for OFAC to win on appeal in a court. [0]: https://en.wikipedia.org/wiki/Wickard_v._Filburn https://en.wikipedia.org/wiki/Wickard_v._Filburn
  - greyface- 4mo ago
    This is true, of course, and I understand why some companies don't want to take the risk. But I would hope that Let's Encrypt would take the opposite stance. They were born out of the EFF and have EFF & ACLU board members! These orgs live for this type of legal fight.
  - thayne 4mo ago
    IANAL, but it seems like the argument from Wickard v Filburn would apply to LE. They may not be taking money but they do impact the commerce of the market for certificates. I disagree with that ruling, and I have some serious problems with sanctions against entire countries/regions, but it definitely makes sense that LE would interpret it as being impacted by OFAC.

deleted 4mo ago

[deleted]

bhhaskin 4mo ago

It could also be an easy way to not have to implement backdoors for the government/military.

lxgr 4mo ago
What "backdoor" would Let's Encrypt even implement? That's not how a CA works. They might be compelled to issue a certificate to an unauthorized (by browser PKI policies, not local law) entity, but that would be very conspicuous due to Certificate Transparency.
- firefax 4mo ago
  I suspect any "backdoor" would be inserted at the protocol level. See https://web.archive.org/web/20130918135152/http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security https://web.archive.org/web/20130918135152/http://www.thegua...
  - jcranmer 4mo ago
    How would they do that? The ACME protocol is "take the basic artifacts you use for certificate signing, wrap them in JSON (cryptographically, using standard JWS), then send them over using HTTP + TLS." Every part of that is something for which there exists a buttload of implementations in whatever language you care to use.
    - gopher_space 4mo ago
      > How would they do that? Let me introduce you to the phrase "I don't see a mechanism."
      - firefax 4mo ago
        >Let me introduce you to the phrase "I don't see a mechanism." I'm not familiar with this phrase, but I think I did a good job citing a comparable example in my original post.

loloquwowndueo 4mo ago

I’m actually old enough to remember how PGP code was exported as a book printout because exporting computer code for cryptography with strong keys in digital form was disallowed but a book was fine (protected by first amendment rights). The printout was scanned abroad to reconstitute the source and build pgp legally.

jaas 4mo ago

Let's Encrypt continues to be available to almost every vulnerable population in the world, including those that need it most. I say almost as I'm hesitant to speak in absolutes regarding a topic as complex as this. Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population. This subscriber agreement update was intended to better reflect our legal requirements. It does not reflect a major change in the service we provide. Our compliance program does evolve over time, and part of that is communicating about it better in our terms of service. It's clear from some of the comments here that we have more work to do to make that text more understandable, we'll work on that. > That said, pretty sure this is stems from the insane US legal requirement to not export SSL technology to enemy countries. I'm sure some of y'all are old enough to remember when web browsers came in "international friendly" versions that supported 40 bit encryption, or "fancy secure" versions with 128 bit encryption. It doesn't.

notamario 4mo ago
When you say “our legal requirements” do you mean requirements LE imposes in its agreements or requires imposed on LE by governments?
- jaas 4mo ago
  I was referring to the requirements imposed on us. When it comes to sanctions, we do not block anything more than what is required by law.
  - marcus_holmes 4mo ago
    The current US government sanctions political enemies [0]. Wouldn't the more rational response to this legal situation be to leave the USA and move somewhere more willing to respect international law? [0] https://www.whitehouse.gov/presidential-actions/2025/02/imposing-sanctions-on-the-international-criminal-court/ https://www.whitehouse.gov/presidential-actions/2025/02/impo...
    - 4mo ago

bigiain 4mo ago

Some (well, at least one) of us are old enough to have owned one of these: http://www.cypherspace.org/adam/uk-shirt.html http://www.cypherspace.org/adam/uk-shirt.html A t-shirt with a Perl script that implemented RSA encryption strong enough to be technically illegal to export from the US. (I must sadly admit to being too cowardly/sensible to have taken that shirt to the US in the late 90s...)

greyface- 4mo ago
And if you missed the original run, you can buy a reprint from Adam's current company: https://store.blockstream.com/products/rsa-t-shirt https://store.blockstream.com/products/rsa-t-shirt
tolciho 4mo ago
I wore the rsa-dolphin t-shirt all over the place and nobody batted an eye back then, but a dolphin made up of ASCII characters is quite a bit less obvious than the one you linked. OpenBSD being based in Canada ships strong crypto, but has had a sometimes troubled relationship with certain regimes. https://www.openbsd.org/lyrics.html#34 https://www.openbsd.org/lyrics.html#34
dd8601fn 4mo ago
DeCSS printed on stuff was a thing for a while, too.

wodenokoto 4mo ago

> Let's Encrypt’s mission is to create a more secure and privacy-respecting web, except for people residing in countries with the most need for a more secure and privacy-respecting web. Sure, that's great. If complying with the law gets in the way of the mission I’m not sure that counts as a change to the mission.

Supermancho 4mo ago
> If complying with a law gets in the way of the mission I’m not sure that counts as a change to the mission. It's already illegal to use in NK, but if it's the US, well it's time to steer the mission around it? Gross.
- wodenokoto 4mo ago
  For an American enterprise? Yes, obviously. Should NRA hand out guns to everyone who can’t get a permit where permits are required? Of course not. If they are against gun permits they have to fight the law, not break it.
  - Supermancho 4mo ago
    The National Rifle Association (NRA) describes itself as America’s longest-standing civil rights organization. That is a specific US-internal stance. There's a list of organizations that started in the US, ultimately having had to work around the US legal system, in pursuit of their missions: re Planned Parenthood Global, WikiLeaks, International Campaign to Ban Landmines, Center for Reproductive Rights, selected programs of the Human Rights Campaign Foundation, et al

__s 4mo ago

http://www.geekytattoos.com/illegal-tattoos-rsa-tattoos http://www.geekytattoos.com/illegal-tattoos-rsa-tattoos tattoo yourself with crypto code to become munitions

golem14 4mo ago

I mean, noone is stopping someone to clone letsencrypt - it shouldn't be very hard. Google had a similar dilemma - do they want to offer a (censored) service in China, and have a hope of keeping some marketshare, or not (and be kicked out immediately). In this case though, it seems to be an unforced move by letsencrypt ? Or was it compelled by LEAs?

p0w3n3d 4mo ago

to not export SSL technology to enemy countries sounds like to not export mathematics

jjav 4mo ago

This is why, as someone who works in security and encryption and has implemented web server TLS stacks and such, I still oppose the "always-https" idea. TLS is awesome, one of the most valuable developments in Internet history. But, it is important to undewrstand that it is a double edged sword. Requiring a CA, which in practical terms means requiring a publicly known CA, is a choke point of freedom.