Hacker News Reader

Comment by matt4077 | Hacker News Reader

So unfair! Comodo once, a while ago, also thought about using IPv6!

But seriously: letsencrypt is doing excellent work. It's a great case study in how inefficient a mostly-free market can be: SSL adoption doubled within a year. All that was previously deadweight loss.

View on HN

There is no such thing as a free market when certificates were only created and issued by those who had the political clout to get their authority in the Microsoft / Google / Mozilla trusted keyring or in the trust network of another trusted provider.

A free market is one where you can compete independently.

If anything, it is a demonstration of why faux-markets with monopoly control (or in this case, the collusion between established and trusted authorities to prevent competition) are dangerous.

What? Anyone can become a certificate authority, so long as you'll take the time to document your procedures, store the private key securely, and be externally audited. You probably want an insurance policy as well.

The only program that charges money to be included is/was Oracle, as far as I know. Everyone else is free.

Everyone else charges indirectly. Inclusion is free, you "only" need to go through someone like webtrust who will charge you $100k+ for an audit.

So? Relying on commercial auditors to verify compliance with published industry standards is a pretty common free-market solution to problems of trust.

I'm not disagreeing with it. I just think the parent post was weird: anyone can do it, just spend some time to obtain things, only Oracle charges for the program.

What's the premium look like for an insurance policy for a private key?

What does it cover, exactly? Every loss from misuse of the key? Sounds expensive.

> So unfair! Comodo once, a while ago, also thought about using IPv6!

In case anyone doesn't get it:

http://arstechnica.com/tech-policy/2016/06/800-pound-comodo-...

1It's a great case study in how inefficient a mostly-free market can be: SSL adoption doubled within a year. All that was previously deadweight loss.

And also in how a market fixes itself :)

Let's Encrypt is a non-profit organization run as a public service by the Internet Security Research Group. Not exactly the same thing as a competing company. Market forces are not compelling these people to donate money, they're doing it because they believe in the goals of the organization.

Nicely enough, this is made possible by the freedoms in the current market (economic system.) One should not forget that the freedom to donate ones' work is also part of a free market. I like this interview with Linus Torvalds [0, 1] where he admits it was for his pleasure and thus for his personal gain that he made Linux. Rational self-interest does not require financial rewards to be satisfactory. It did make him a millionaire in the end though (because Red Hat gave him stock options). This also show how he can be a dick sometimes while still being of immeasurable value to the global economy. He does it because he likes it, not because he likes you or wants you to like him.

[0] https://www.theobjectivestandard.com/2012/06/linux-creator-l... [1] http://www.bbc.com/news/technology-18419231

While true, the economic environment is also geared towards an assumption that you'll provide the vast majority of your work to a company that takes ownership of the results and directly pays you for it. In my country, the majority of the current generation will likely never own a house, let alone be financially comfortable enough to work on a social project full-time.

The result is that the only way for someone who isn't wealthy to do charitable work is to get either Government or companies to pay you to do it. Companies will generally only pay you to do work if they're getting something out of it, and Government has its own interests at heart.

Getting people to pay you to do something is very, very difficult - it's hard enough if you're selling them something directly and right now, significantly harder if you're still working on a project, and harder still if there might not be anything concretely benefiting the person donating at the end of it. Charities largely manage by not paying many of the people who perform work for them, along with begging money from Government and companies, and their volunteers primarily depend on Government welfare.

It's not a perfect system in the slightest - it's incredibly hard work to be able to perform any sort of charitable work, at least as hard as running a business, and is heavily subsidized. A system which ensured that everyone's needs were met by default, rather than requiring you to prove that you deserve to have your needs met, would allow significantly more charitable work - specifically, it would allow for work that rewards the worker in ways other than monetary pay.

Was it the same market though? Or is the shift largely driven by Google's ranking changes in that period?

This also reminds me of SGC certificates where browsers only trusted a limited number of roots.

SGC certificates were entirely a result of bizarre US export restrictions.

Reply on news.ycombinator.com