5 ms·

It will just make it easier to create walled gardens, and charge companies and individuals for certificates. It will also pretty much get rid of privacy, since

It will just make it easier to create walled gardens, and charge companies and individuals for certificates. It will also pretty much get rid of privacy, since to get the cert you will need to provide someone with your detailed information. Using self-signed certs will become harder. Yes, it's a good idea to use https _almost_ everywhere, but forcing everyone to use it is a terrible, stupid idea.

pfg 12y ago
> It will just make it easier to create walled gardens, and charge companies and individuals for certificates. letsencrypt.org will solve this problem. > It will also pretty much get rid of privacy, since to get the cert you will need to provide someone with your detailed information. That's something that applies to buying/owning a domain as well. Domain-verified certificates require very little private information, and I suspect letsencrypt.org might be able to provide a way to get trusted certificates without giving up privacy. > Using self-signed certs will become harder. How so? The proper way to use self-signed certificates would be to distribute them in a safe way (e.g. deploy them through your Active Directory Domain, provide the fingerprint through a separate channel, etc.) and install them in your trust store. I couldn't find any intended changes to this in their announcement. > Yes, it's a good idea to use https _almost_ everywhere, but forcing everyone to use it is a terrible, stupid idea. I agree that it should be a slow process, and I think that's exactly what they're suggesting. Eventually, when the tooling and processes around SSL/TLS catch up with the new "encrypt everything" mentality, it would probably be no big deal to deprecate almost every use-case of HTTP without SSL/TLS.
- ciupicri 12y ago
  Let’s Encrypt does not even provide a RPM for Fedora or RHEL yet or at least there's no mention of it on the front page [1]. [1]: https://letsencrypt.org/howitworks/ https://letsencrypt.org/howitworks/
  - TheHippo 12y ago
    There is an open protocol[1] on how to retrieve the certificates, so you can implement a client in a language of your choice, or wait until someone else does it. [1]: https://github.com/letsencrypt/acme-spec https://github.com/letsencrypt/acme-spec
    - yellowapple 12y ago
      That comment was about package management (i.e. actually installing this on servers), not about language implementations. Let's Encrypt's documentation currently assumes a Debian-based operating system, which therefore leaves out a very large portion of the web server population.
- mariusz79 12y ago
  letsencrypt.org is not even working, and it seems to be Linux only, at least for now. What about other OSs?
  - pfg 12y ago
    That's why I said "will solve". For now, you can use startssl.com for (non-commercial) free, trusted certificates. Mozilla is one of the backers behind letsencrypt. I'm sure they won't be deprecating anything until well after it is up and running. This was an email to the Mozilla community asking for feedback, not an announcement of any major deprecations in the next version of Firefox. Letsencrypt is based on an open protocol [1], I'm sure there will be implementations for all major platforms. [1]: https://letsencrypt.github.io/acme-spec/ https://letsencrypt.github.io/acme-spec/
- spdustin 12y ago
  Can we please stop saying "letsencrypt.org will solve this" until letsencrypt.org is actually solving this?
  - pfg 12y ago
    Why? We're discussing long-term changes to how HTTP without encryption should be handled. I think an upcoming project with major impact on the availability of certificates should be a factor in this discussion. Besides, it's not like letsencrypt will be the first CA to offer free certificates - StartSSL has been doing it for years, although letsencrypt obviously has a different approach.
    - chc 12y ago
      > Why? We're discussing long-term changes to how HTTP without encryption should be handled. I think an upcoming project with major impact on the availability of certificates should be a factor in this discussion. Because Let's Encrypt might solve this well, or it might not solve it well, or it might never even be released. At the moment, factual statements about what effect Let's Encrypt will have on the world are similar to "$(THIS_YEAR+1) will be the year of Linux on the desktop."
blowski 12y ago
> It will also pretty much get rid of privacy, since to get the cert you will need to provide someone with your detailed information. If you're using a self-signed certificate, you don't need to provide information to anyone. > Using self-signed certs will become harder. Why? I haven't given this much thought yet, but these don't sound like convincing arguments against the proposition.
- mariusz79 12y ago
  Because all of the modern browsers already make it harder for users to use them. It will only get worse.
scrollaway 12y ago
I'm having a very hard time picturing anyone having such a blatantly wrong and FUD-filled opinion as anything else than either a joke or a NSA shill. Care to convince me otherwise?
- jacquesm 12y ago
  Please do not accuse users of being 'shills' (for the NSA or otherwise) alert the mods (hn@ycombinator.com) instead if you are fairly sure about it.
- deleted 12y ago
  [deleted]
- mariusz79 12y ago
  Hear that NSA? where is my check for this week? Edit: never mind. Mailman was late.. got it now!

pfg 12y ago

> It will just make it easier to create walled gardens, and charge companies and individuals for certificates. letsencrypt.org will solve this problem. > It will also pretty much get rid of privacy, since to get the cert you will need to provide someone with your detailed information. That's something that applies to buying/owning a domain as well. Domain-verified certificates require very little private information, and I suspect letsencrypt.org might be able to provide a way to get trusted certificates without giving up privacy. > Using self-signed certs will become harder. How so? The proper way to use self-signed certificates would be to distribute them in a safe way (e.g. deploy them through your Active Directory Domain, provide the fingerprint through a separate channel, etc.) and install them in your trust store. I couldn't find any intended changes to this in their announcement. > Yes, it's a good idea to use https _almost_ everywhere, but forcing everyone to use it is a terrible, stupid idea. I agree that it should be a slow process, and I think that's exactly what they're suggesting. Eventually, when the tooling and processes around SSL/TLS catch up with the new "encrypt everything" mentality, it would probably be no big deal to deprecate almost every use-case of HTTP without SSL/TLS.

ciupicri 12y ago
Let’s Encrypt does not even provide a RPM for Fedora or RHEL yet or at least there's no mention of it on the front page [1]. [1]: https://letsencrypt.org/howitworks/ https://letsencrypt.org/howitworks/
- TheHippo 12y ago
  There is an open protocol[1] on how to retrieve the certificates, so you can implement a client in a language of your choice, or wait until someone else does it. [1]: https://github.com/letsencrypt/acme-spec https://github.com/letsencrypt/acme-spec
  - yellowapple 12y ago
    That comment was about package management (i.e. actually installing this on servers), not about language implementations. Let's Encrypt's documentation currently assumes a Debian-based operating system, which therefore leaves out a very large portion of the web server population.
mariusz79 12y ago
letsencrypt.org is not even working, and it seems to be Linux only, at least for now. What about other OSs?
- pfg 12y ago
  That's why I said "will solve". For now, you can use startssl.com for (non-commercial) free, trusted certificates. Mozilla is one of the backers behind letsencrypt. I'm sure they won't be deprecating anything until well after it is up and running. This was an email to the Mozilla community asking for feedback, not an announcement of any major deprecations in the next version of Firefox. Letsencrypt is based on an open protocol [1], I'm sure there will be implementations for all major platforms. [1]: https://letsencrypt.github.io/acme-spec/ https://letsencrypt.github.io/acme-spec/
spdustin 12y ago
Can we please stop saying "letsencrypt.org will solve this" until letsencrypt.org is actually solving this?
- pfg 12y ago
  Why? We're discussing long-term changes to how HTTP without encryption should be handled. I think an upcoming project with major impact on the availability of certificates should be a factor in this discussion. Besides, it's not like letsencrypt will be the first CA to offer free certificates - StartSSL has been doing it for years, although letsencrypt obviously has a different approach.
  - chc 12y ago
    > Why? We're discussing long-term changes to how HTTP without encryption should be handled. I think an upcoming project with major impact on the availability of certificates should be a factor in this discussion. Because Let's Encrypt might solve this well, or it might not solve it well, or it might never even be released. At the moment, factual statements about what effect Let's Encrypt will have on the world are similar to "$(THIS_YEAR+1) will be the year of Linux on the desktop."

blowski 12y ago

> It will also pretty much get rid of privacy, since to get the cert you will need to provide someone with your detailed information. If you're using a self-signed certificate, you don't need to provide information to anyone. > Using self-signed certs will become harder. Why? I haven't given this much thought yet, but these don't sound like convincing arguments against the proposition.

mariusz79 12y ago
Because all of the modern browsers already make it harder for users to use them. It will only get worse.

scrollaway 12y ago

I'm having a very hard time picturing anyone having such a blatantly wrong and FUD-filled opinion as anything else than either a joke or a NSA shill. Care to convince me otherwise?

jacquesm 12y ago
Please do not accuse users of being 'shills' (for the NSA or otherwise) alert the mods (hn@ycombinator.com) instead if you are fairly sure about it.
deleted 12y ago
[deleted]
mariusz79 12y ago
Hear that NSA? where is my check for this week? Edit: never mind. Mailman was late.. got it now!