Hacker News Reader

Comment by alpb | Hacker News Reader

> So in conclusion: [...] LE is definitely a NOBUS.

This sounds a lot like a conspiracy theory and I don't see in the article any explanation how that's relevant or possible.

LE doesn't force you to add CAA DNS records. Furthermore, you have CAs in your browser/machine that are far more sketchy than LE in the first place.

I think the article suffers from a clear point that I can put my finger on and say "oh yeah this is why LE is bad", in fact I don't see any points supporting that in a solid way. The article could be 1/5th the length and still achieve the same result.

View on HN

> I think the article suffers from a clear point that I can put my finger on

He doesn't trust LE not to hand over a mitm certificate to some us american three letter agency and therefor refuses to use it.

> "LE is definitely a NOBUS" sounds a lot like a conspiracy theory

It sure does.

> you have CAs in your browser/machine that are far more sketchy

LE is in the focus of the headline, because people keep bringing it up to him. That is in the first paragraph. People complain about their browsers having trust issues with his webserver, and then go karen and suggest he uses LE, instead of establishing trust between the endpoints.

> LE doesn't force you to add CAA DNS records.

That you seem to misunderstand. The large selection of sketchy CAs the browser trusts are the reason why webmasters should use CAA DNS records. His page has both a TLS certificate and a CAA record, but the CA that issued it and is named there is not trusted by the browser vendors.

> He doesn't trust LE not to hand over a mitm certificate to some us american three letter agency and therefor refuses to use it.

The flaw in this logic is that LE could do that just as easily whether or not you use them for your legitimate certificate. And if you're worried about things like that, running insecure HTTP instead is about the worst thing you could do.

yeah you are right, that can't be it. Maybe the core point is that he considers the whole browser vendor based pki to be nonsense and refuses to partake, offering a self signed certificate instead. He probably memorized the key fingerprint and can verify it in person. The core point might be that those who want him to use LE barely care enough to make their browser not show warnings, they don't actually care about establishing trust.

I agree with you here there are many holes in this post that make it hard to take this person seriously beyond a conspiracy theorist who refuses to take responsibility of keys fully themselves and makes an extension argument that indeed they are also not to be trusted. This sounds like a very confused individual who needs to be told that their theories are flawed or at the very least that their lack of sense of responsibly is the exact reason why they should not be participating in being a provider of services/content.

You should use my login form without encryption based on my misunderstanding of what https is used for is not an excuse dammit!

Conspiracy theories aside, there are free non-US based ACME providers too.

that sounds even worse..

Reply on news.ycombinator.com