Two, you're likely misunderstanding the purpose of SSL and Let's Encrypt. It's not to protect you against the site you're talking to, it's to prevent man in the middle attacks on the way. It ensures you can't walk into a starbucks for an hour and walk away with dozens of facebook logins.
Lastly, the big players don't use Let's Encrypt for reliability and customer service purposes. If you run a blog and your cert screws up, the 3 people visitng your site that week will have to click a few extra buttons to get in.
If you're a microsoft, that can mean thousands if not millions of users hitting this wall they expect not to have, leading to huge costs for customer support and occassionally deeper issues updating certificates. Exactly the same reason Bank of America doesn't use godaddy.com for their domain name.
Before Let's Encrypt, certs cost money from certificate authorities, so not many smaller companies would bother. Now it's streamlined enough that browsers throw scary warnings if you don't have it, which is a massive improvement for everyone using the web.
But should they? I never had any issues running an internet site before this was required. A blog doesn't need SSL. Why are ISP's not more scrutinized to ensure that MITM doesn't happen? Why is it put upon the admin? My blog from 2005 was never hit with MITM.
> If you're a microsoft, that can mean thousands if not millions of users hitting this wall they expect not to have, leading to huge costs for customer support and occassionally deeper issues updating certificates. Exactly the same reason Bank of America doesn't use godaddy.com for their domain name.
So your saying LE is only worth for small-class sites such as "blogs", which than I above said, Why does a blog need SSL? The only reasoning I had which was valid was that "ISP's inject" and if that's the case why are ISP's allowed to get away with injection?
> Your post is 18 minutes old as of me writing and you're already boasting about a lack of replies.
Folks like to down-vote and never reply. I'm sure I might be "flagged" soon too.
> Two, you're likely misunderstanding the purpose of SSL and Let's Encrypt.
Not at all, SSL is the communications protocol. A encrypted-tunnel example made by HTTPS. Verified by a Certificate if we apply laymans terms. LetsEncrypt issues that certification based on the trusted root installed on your computer and if all valid, the brower throws a green badge. I can easily remove the LE root certificate and any LE encrypted site would be invalid.
As for who uses LetsEncrypt, there are a lot of businesses and organizations in between the size of a Microsoft and a small blog that use it. If you read the article, you'll note that LE is celebrating 300M websites protected with their certs. So quite a lot of people find LE useful and want to protect connections to their sites with TLS. If you can't figure out why, perhaps that's more a lack of imagination on your part, than misplaced time and effort on theirs.
As an aside, can you lay off with all the aggressive nonsense? People are replying to you (despite your whining about downvotes). Chill out and maybe take some time away from the keyboard when you're all worked up like that.
[0] Unfortunately SNI will often still leak the domain name of the TLS-protected site being visited, but an encrypted version of SNI is being worked on to close that hole.
Yes if you're going to deliberately flamebait I will flag you.
That's not you winning. You made things worse for everyone.
I've made nothing worse for anyone. Those who made it worse for everyone are internet walled gardens and monopolies. If the internet wasn't as corrupted as it now and you deny, telling me Google isn't evil? We would be in a better place with enhancements without the the need for SSL. However not so, evil and mass greed ruined the internet for all since the 80's; heck the 70's.
No, not flame-baiting. Am I not allowed my own view based on my own thoughts? Or am I not allowed free-thought? I'm happy to read everyone's else and take that in. But your denying my own? There's no flame, those opinions are of my own and may not be correct in your eyes but I am still allowed to have.
I'm just talking about this conversation being worse.
> you deny, telling me Google isn't evil?
I didn't say anything about Google.
> No, not flame-baiting. Am I not allowed my own view based on my own thoughts? Or am I not allowed free-thought? I'm happy to read everyone's else and take that in. But your denying my own? There's no flame, those opinions are of my own and may not be correct in your eyes but I am still allowed to have.
You posted "No answers for me? Just what I thought." with the specific intent of annoying people into replying.
I'll agree to disagree on that, the reason is that folk blindly down-vote. It's infuriating. If I hold opinion A which is incorrect, when opinion B could be correct, I then wouldn't get possibly a corrected perspective. At least it sparks a reaction and sights conversation, regardless if annoyance. It allows myself to express how I feel and why I feel. Rather than the hive-mind mentality that if everyone is doing it, its the right think.
> I'm just talking about this conversation being worse.
How? I expressed my opinion. It may not be right, it may be controversial, you may disagree. Yet your post came off as you should have supreme control, you do have many karma points but that still doesn't dictate. I don't doubt your intelligence, nor interactions, myself I am only 33, still learning the world. For all I know you could be god if you believe in such a thing.
> you deny, telling me Google isn't evil?
I'm was laying my beliefs based on the misunderstanding of your post. I misunderstood how "conversation being worse" it happens. However that again is another controversial opinion that the internet is within a very crippled state, for such pointed out above. Again, you may disagree.
Your entitled to such opinion you believe, I'm disappointed that if you did flag me, or that such a feature blocks because what I laid out wasn't out to be argumentative but as free-thought opinion. Maybe more emotional and cynical of than what it should of been but still. Words are tricky and no one person is an expert.
Regardless, mutually. Have a good night
Why does Bill Gates use Windows? There must be some fatal flaw in macOS if so many are choosing other operating systems!
Your post contains some very basic misconceptions. This is going to sound harsh, but I would recommend not putting too much stock in your own opinions on security, and instead to trust the experts.
If LE is ran with the following companies, "Electronic Frontier Foundation; Mozilla Foundation; University of Michigan; Akamai Technologies; Cisco Systems"
What makes them all trade worthy, especially when they're all American? Especially after the whole Richard Stallman. Mozilla, maybe because they were netscape. I have more than enough experience working within security to know that.
I've seen SysOps leak DB's, Passwords in plaintext.. and I've seen it from the age of where such didn't exist to where companies are now installing X security appliances to safe guard there networks. I'm not newb, from 2004 to now, counted 15 years of System and Network engineer experience. Fair from experienced but well seasoned.
Why isn't HackerNews using LetsEncrypt, Google, Netflix, Amazon, if promoted as a great thing. Is what I want to know.
Google: Browser Maintainer that runs entire TLDs, doesn't need a third party, it could just decide to trust itself and 60+% of the market follows.
Amazon: Runs a massive chunk of the internet, it's already MitM'd itself and most other things, doesn't really need a third party for Certs but still uses DigiCert which predates LE and they clearly have a working relationship.
Netflix: See Amazon, HN.
You: Barely exist to the infrastructure of the web as people experience it. Maybe you have a static site you don't care to protect from MitM (could add some malicious scripts or whatever but who cares). Maybe you're a tiny service that offers some 50 users something, their plaintext auth probably shouldn't be readable to just anyone along the network path, but they're not paying you for services so you might not wanna spend much money on that service. Use LE.
Also, if you think LE as a company has the ability to take sites with it if it goes down, you don't really understand Web PKI. At most likely within a year to 3 months you'd need to find a new place if their signatures expire. At worst someone could pretend to be you, but still not read that traffic protected by the old cert.
Why so salty about LE? Especially from a "seasoned" SysEng? Didn't it just make your job easier and safer for those with slightly less experience?
Because it's required, I don't know the companies, I can't trust the companies. I just not happy that four companies run the worlds SSL. There should be another technology that caters to such without having to put all the keys in one basket.
> Didn't it just make your job easier and safer for those with slightly less experience?
No. It makes it harder, because your not teaching someone anyone thing you tell them "click here, click that, done"
Because it's required, I don't know the companies, I can't trust the companies. I just not happy that four companies run the worlds SSL. There should be another technology that caters to such without having to put all the keys in one basket.
Also you're mixing security on data transportation with security of data at rest. Both are important but there are different solutions to each.
What do you mean by this?