Hacker News Reader

Comment by headShrinker | Hacker News Reader

I will be honest, I run a small web community of about 20,000 users, so it's different than hardware/firmware updates for potentially mission critical systems... That said, the reason I haven't implemented tighter security practices isn't so much a response to cost-benefit analysis. My users simply haven't made a lot of noise demanding more strict password tolerances, identity verification, or SSL. I have a limited amount of time I can apply to the demands of the community, 'more security' rarely if ever comes up.

View on HN

Security is the ultimate technical debt. It's "worthless to your users" for a while, and then one day it's an extinction event.

You don't get the same trial/iterate cycle there is with software features, when it comes to security. Kind of, but mostly not.

Odds are that I'm not from your community, but I follow a personal policy of not visiting plain http websites. I have strict HTTPS enabled at all times, and for the few sites that I visit that exclusively serve insecure content, I visit through archive.org or google cache.

Needless to say, I can't interact with these sites through proxies. It could also be the case that those who care about their security and privacy simply left your community or limited their presence to just being spectators.

You should definitely set up SSL/TLS for your web site. Let's Encrypt lets you easily do that.

Until it decides to completely fuck up your apache webserver config and you have to spend a whole day to properly configure your virtual hosts again.

I’ve done it twice, never again.

You can do it in certificate only mode. I think DNS challenge is even enabled now so you don't need to let it touch your running server at all. Of course it's a bit of admin every ~90 days but 4 times a year for free SSL isn't bad.

Or automate it.

DNS challenge is the worst of both: You have to manually add 60 something DNS entries, and remove them again.

Just putting a public key in the DNS and being able to sign a CSR with the correspoding private key should be enough.

There are ACME clients that can automate the DNS challenge process.

Only if your DNS system supports it, and you host it yourself.

If you have DNS managed by your domain registrar, this helps you very little.

So, for the average small site that’s neither made with a kit where the hoster has a one-click SSL solution, nor large enough to have their own nameservers, this is a real issue.

And yet, these sites are the target demography for LE.

You're missing the point. The OP isn't claiming that Lets Encrypt is impossible to configure, so telling them that there are ways to make it work is a bit pointless. The key is that Lets Encrypt can be very difficult to configure and get things working. In a way, the numerous methods available to set up LE add to the confusion, you can search around and find lots of conflicting 'best' ways to do it.

Just for clarification those are two distinct issues. One: the LE client's apache magic fix up code can fail to handle fairly standard configs and mess things up. I addressed this directly, you don't need to use the apache magic configuration.

Two: ACME offers numerous ways to convince it that you own a domain name. My intent was to follow this up by saying you don't even need to be running an ACME client/mess with your apache config at all by using the dns-01 challenge variant over the http-01 variant.

> The key is that Lets Encrypt can be very difficult to configure and get things working. This is definitely a problem, it would be great to see a divorce between the apache config munger and the certificate fetcher. SSL available to the uninitiated is great but if they're on the command line then I'd like to believe they're capable of pointing their server at a specific location for certificates on disk.

Parent's in a slightly different position, but I'd expect a lot of similar things can be chalked up to the prevalence of technical consultants working for non-technical, business client management.

Without authority, you can say "This is a good idea and you're taking a huge security risk without fixing it" as many times as you want and still be told "No new feature, not a development priority."

You should look at CloudFlare. It would be transparent to the users, free, and would provide (some) security without you having to do anything.

https://www.cloudflare.com/plans/

Reply on news.ycombinator.com