3 ms·

They're definitely part of the problem, but they're a powerful kingmaker in the industry. Without their approval several vendors won't include the Let's Encrypt

They're definitely part of the problem, but they're a powerful kingmaker in the industry. Without their approval several vendors won't include the Let's Encrypt CA at all. So it ultimately boils down to: Dance with the devil and become relevant, or maintain the moral high ground and accomplish nothing.

bifurcation 11y ago
You've got things a little confused here. Let's Encrypt doesn't need to be part of the CABF in order to be included in the browsers, but they do need to demonstrate that they abide by the rules that CABF defines (the Baseline Requirements). They only need to join CABF if they want to be able to vote on those rules.
yellowapple 11y ago
> Without their approval several vendors won't include the Let's Encrypt CA at all. Which ones? Let's Encrypt is Mozilla's baby IIRC, so this will almost certainly be recognized as valid by them with or without CAB membership, which means that Firefox and Firefox OS are both instantly covered. The former makes up a pretty sizable chunk of desktop user agents and (probably) a smaller but still significant chunk of mobile user agents (not including Firefox OS). This leaves Google, Microsoft, Apple, the major GNU/Linux distro vendors (Red Hat, Canonical, SUSE/Novell), and maintainers of other operating system projects ((Open|Free|Net)BSD, Solaris/illumos folks (Oracle, Joyent, etc.), etc.). * Google seems to be a proponent of ubiquitous encryption/HTTPS, and a free and easy-to-use CA aligns with that goal. I reckon they're more likely to support the Let's Encrypt CA than not for this reason, regardless of CAB membership. Thus, Chrome/Chromium, ChromeOS, and Android - the other significant chunk of desktop user agents, and arguably the most significant chunk of mobile user agents aside from feature phones (which will likely be phased out with low-cost Android and FirefoxOS devices anyway), will end up supporting Let's Encrypt's CA. * Most GNU/Linux distros I'm aware of use Firefox as the default/primary browser in desktop deployments (the notable exception being Lubuntu last I checked), and many of them use Mozilla's cert bundle for their CA needs. I'd expect most other free software operating systems to follow suit. * I'm not sure what Solaris uses as a default browser nowadays for desktop use (not that there are a whole lot of desktop Solaris users in the wild anymore...), but it's probably Firefox. Oracle tends to be more interested in bureaucratic institutions like the CAB, though, so they might hold off on Let's Encrypt for a long while (and thus further accelerating the effects of their sidaM touch on Solaris, but whatever). Most illumos-based operating systems (like OpenIndiana and SmartOS) will likely be more receptive to Let's Encrypt, though their desktop significance is also pretty low. * This leaves Microsoft and Apple. On one hand, these particular vendors - like Oracle - tend to favor bureaucracy over common sense. On the other hand, Let's Encrypt probably wouldn't be the first non-CAB CA they've recognized as valid. On the third hand, it wouldn't be above Microsoft to spin off some "Visual Cert.NET 3.11# for Workgroups(TM)" as a competitor of sorts to draw folks toward Microsoft's sphere of influence (meanwhile, Apple would be no stranger to waiting for a few years before taking the trendy idea that everyone else is coming up with, calling it the "Apple Cert" with an Apple logo instead of the word "Apple", and insist that everyone calling it the "iCert" are ignoramuses while politely ignoring that - like their watches - they're about half a decade late to the game). So - to summarize - two of the three most significant desktop browser vendors (Mozilla and Google), one of the two most significant smartphone browser/OS vendors (Google), and both of the two viable dumb->smart phone browser/OS vendors (Mozilla and Google) will in all likelihood recognize Let's Encrypt's validity regardless of whether or not it's a member of some random bureaucracy. That's a pretty substantial market driver.

bifurcation 11y ago

You've got things a little confused here. Let's Encrypt doesn't need to be part of the CABF in order to be included in the browsers, but they do need to demonstrate that they abide by the rules that CABF defines (the Baseline Requirements). They only need to join CABF if they want to be able to vote on those rules.

yellowapple 11y ago

> Without their approval several vendors won't include the Let's Encrypt CA at all. Which ones? Let's Encrypt is Mozilla's baby IIRC, so this will almost certainly be recognized as valid by them with or without CAB membership, which means that Firefox and Firefox OS are both instantly covered. The former makes up a pretty sizable chunk of desktop user agents and (probably) a smaller but still significant chunk of mobile user agents (not including Firefox OS). This leaves Google, Microsoft, Apple, the major GNU/Linux distro vendors (Red Hat, Canonical, SUSE/Novell), and maintainers of other operating system projects ((Open|Free|Net)BSD, Solaris/illumos folks (Oracle, Joyent, etc.), etc.). * Google seems to be a proponent of ubiquitous encryption/HTTPS, and a free and easy-to-use CA aligns with that goal. I reckon they're more likely to support the Let's Encrypt CA than not for this reason, regardless of CAB membership. Thus, Chrome/Chromium, ChromeOS, and Android - the other significant chunk of desktop user agents, and arguably the most significant chunk of mobile user agents aside from feature phones (which will likely be phased out with low-cost Android and FirefoxOS devices anyway), will end up supporting Let's Encrypt's CA. * Most GNU/Linux distros I'm aware of use Firefox as the default/primary browser in desktop deployments (the notable exception being Lubuntu last I checked), and many of them use Mozilla's cert bundle for their CA needs. I'd expect most other free software operating systems to follow suit. * I'm not sure what Solaris uses as a default browser nowadays for desktop use (not that there are a whole lot of desktop Solaris users in the wild anymore...), but it's probably Firefox. Oracle tends to be more interested in bureaucratic institutions like the CAB, though, so they might hold off on Let's Encrypt for a long while (and thus further accelerating the effects of their sidaM touch on Solaris, but whatever). Most illumos-based operating systems (like OpenIndiana and SmartOS) will likely be more receptive to Let's Encrypt, though their desktop significance is also pretty low. * This leaves Microsoft and Apple. On one hand, these particular vendors - like Oracle - tend to favor bureaucracy over common sense. On the other hand, Let's Encrypt probably wouldn't be the first non-CAB CA they've recognized as valid. On the third hand, it wouldn't be above Microsoft to spin off some "Visual Cert.NET 3.11# for Workgroups(TM)" as a competitor of sorts to draw folks toward Microsoft's sphere of influence (meanwhile, Apple would be no stranger to waiting for a few years before taking the trendy idea that everyone else is coming up with, calling it the "Apple Cert" with an Apple logo instead of the word "Apple", and insist that everyone calling it the "iCert" are ignoramuses while politely ignoring that - like their watches - they're about half a decade late to the game). So - to summarize - two of the three most significant desktop browser vendors (Mozilla and Google), one of the two most significant smartphone browser/OS vendors (Google), and both of the two viable dumb->smart phone browser/OS vendors (Mozilla and Google) will in all likelihood recognize Let's Encrypt's validity regardless of whether or not it's a member of some random bureaucracy. That's a pretty substantial market driver.