Hacker News Reader

Comment by betageek | Hacker News Reader

> We’ve seen programs such as Let’s Encrypt that bring the price of domain name public key certificates down to a base of free

Only free if you value your time at $0.

View on HN

Indeed, otherwise they have negative cost. The Let's Encrypt API has saved me so much money by letting me automate certificate generation, it's crazy. No more having to install new certificates by hand every year!

HTTP has a zero ongoing cost, HTTPS has a non-zero ongoing cost.

Not for me. When I set up a new domain & hosting, I checked the box which said "Enable Lets Encrypt" and it was done instantly. I haven't had to manually renew it.

That's nice for you, but that's not how it is for other people.

The tooling around Let's Encrypt is designed to make it possible to do that. If you're not dead set on using a specific web server, there are web servers with Let's Encrypt support out of the box[0].

And if you're using Apache or Nginx, Certbot[1] can configure Let's Encrypt support for them automatically. It's not the "one-click install" you'd get with some other software, but it's pretty close.

[0] https://caddyserver.com/ [1] https://certbot.eff.org/

FWIW I just tried the automatic tooling. First observation is that my email (which was already using LE) still seems to be working, which is honestly surprising but I suppose I should be pleased. My website still seems to redirect a couple of times before ending up back at the unencrypted version. TBF, nothing's conspicuously broken so far so no immediate damage. I'll go back and try to sort it out when I have some more time / enthusiasm.

Update: I got it working. I still maintain that it was largely pointless, not zero-effort, and puts the difficulty of running a webserver further into the domain of stuff that's only likely to be undertaken by professional / commercial entities, and that that's a bit of a pity.

Update2: Shit, I broke some other stuff :-(

Switch to Caddy, then. It becomes mind-numbingly easy to setup.

https://caddyserver.com/

Only if you value the security of your customers at $0.

Isn't it reasonable for me to value the security of my customers at $0? Given that a) I don't have customers as such and b) My website is just a (very out of date) blog with some innocuous nerdy stuff on it.

It's not just security, it is also privacy.

But even if it was just security, it would be irresponsible to offer something (a blog) and knowingly compromise security for anyone who is interested.

How am I compromising anybody's privacy or security by hosting information about my defunct bare metal Raspberry Pi project? What is the threat model?

Does it have an admin interface? Without encryption, your username / password are broadcast unencrypted; if intercepted by whoever, they can hijack your blog and post spam / spread malware / subtly inject some JS to mine some dank monero.

Nope.

The traffic can be intercepted and changed. If someone trusts you (say you gave them the link) but the content they are being served is not the content you intended to be shared, is that not a security issue?

ISPs have been known to inject ads for example.

The former is not likely to be an issue for the site I'm talking about. Ad injection is shitty but I don't think it makes my blog "irresponsible".

Meltdown/Spectre kind of vulnerability plus injecting Javascript to anything that is http only by rouge ISP employee or user on open rouge wifi. It is not about targeted attacks it is about low hanging fruit which any http site is and bots, automated hacking/injecting.

Like people saying that changing SSH port on your VPS is not security. Setup one Linux VPS and see how many bots are trying to brute force your password. Just change the port so they stop trying.

> HTTP has a zero ongoing cost

Only if you value your (and your users/readers) privacy at $0

I set it up, once, it gets automatically renewed indefinitely.

Haven't had to change a CC number, or trip over any of the usual selection of billing and renewal gotchas.

Fits my definition of free, even after valuing my time as non-zero!

Again, HTTP had no ongoing cost, HTTPS has an ongoing cost

What ongoing cost? This is absurd. It’s $0, the automation is free, and the config is free. Stop spreading FUD.

So I can stop paying those bills the web-hosting company keeps bugging me about?

Yes, you can host your own server and use your home internet connection. This is the whole issue really - the web was designed as a decentralized, anarchistic, read/write thing, and it's subsequently become a thing where it's increasingly difficult to participate unless you're doing so on a professional basis or relying on somebody else's professional services. Maybe this is just how it has to be, but for people who can remember a couple of decades back it's pretty depressing.

(btw I've used LE both in my day jobs and for some personal stuff, and I very much appreciate its existence).

so I can stop paying those home internet connection bills that keep stacking up every month?

If you personally don't want to have an internet connection then I'm afraid it's going to be hard for you to run a webserver for free. I think this would be unusual though.

the point is that http isn't free of ongoing costs.

Are you paying for http on top of your internet connection costs?

I'd probably get a more expensive plan that had good upload speeds.

Or I might get free access from my library and they don't permit me to run a web-server.

> HTTP had no ongoing cost

If you consider constant warnings from most browsers that annoy your users and coming up with new excuses as to why you haven't moved to HTTPS as not being a cost…

That's an artificially induced cost, though. You are correct that I'm going to have to letsencrypt my blog if I want to people to be able to read it (I might just take it down). But I don't think the people are correct who are saying that a) there's any good inherent reason for me to do that and b) this will cost me no time or effort. I've done the LE thing before and, at least in my case, it's not a zero-effort thing.

In this thread alone you've already expended more energy than it would have taken to just do the right thing with your blog.

This is incorrect - I won't go into details as I'm busy fixing my server and need to go out in a couple of hours.

HTTP has an enormous ongoing cost in the form of loss of security and privacy.

I don't really see the difference between it and other certification. Surely I need to configure my servers regardless.

Also, sometimes doing a bit of server work is rewarding on its own.

The main difference in my experience is that LE's short certificate expiry dates force you to automate certificate renewal, while traditional certificates usually don't even offer automation and so require you to take time to explicitly renew them.

My problem is with the crusade to make everything HTTPS - normal HTTP involved no ongoing setup, and didn't put the ongoing functionality of your website in someone else's hands. As I've said above, LetsEncrypt is sponsored by corporations and could disappear tomorrow.

Do you live in some parallel universe where we do not have mass surveillance, nation states or internet providers modifying traffic or unencrypted wifi at coffee shops?

Your attitude is irresponsible. HTTPS is not a luxury, it is a requirement.

Let's Encrypt is currently sponsored by 53 different corporations and organizations, including Google, Facebook and Cisco. I'm not seeing it disappearing anytime soon.

I'm pretty confident your services will disappear long before LetsEncrypt does.

My HTTPS web server requires no on-going setup. And the on-going functionality is in a lot of people's hands, since I don't host the server in my own house with my own fixed Internet connection.

It took me 10 minutes to setup Let’s Encrypt on my web server. It was the first and only time I’ve had to do it. I’m pretty sure I spent more time setting up Apache’s configuration than I did Let’s Encrypt’s.

It is very easy to set up in a permanent fashion.

Your definition of permanent is different to mine. LetsEncrypt relies on corporate sponsorship that could disappear at any time, then where would you be? Back to jumping through the same hoops you had to jump through before

Nah, there are two things going on here, and they're separate

1. The Let's Encrypt service from ISRG, which is a charity and so obviously if the donations dried up and somehow we didn't fix that then eventually (maybe a year or more) it would go away. This is also true for Wikipedia and the EFF in the most obvious direct sense, but it's true for all commercial services you rely on too, Youtube, Facebook, Hacker News, all could go away if their owners decide there isn't enough money any more.

2. ACME and other certificate automation. These are protocols, in ACME's case IETF Standards Track protocols, for how we can validate control over a name and issue certificates to an applicant. These don't vanish if ISRG goes away. For example loads of cPanel users already don't use Let's Encrypt, they have a single button "Yes, I want free certificates" feature, and Comodo (the root CA behind that) is taking a slice out of the cPanel license fees.

Your worst case scernaio is so mild: nothing lost.

Why not use LetsEncrypt until it’s no longer available?

> Your worst case scernaio is so mild: nothing lost.

Not really. With Let's Encrypt available, the browser makers are now talking about penalising all HTTP sites. Next year, or the year after that, they could decommission Let's Encrypt (or start charging), and suddenly we'd all see what had been lost: it'd no longer be possible to set up an unpenalised site for free.

Personally, I believe that an IP cert should be issued along with one's IP address, and a hostname cert should be issued along with one's domain name.

If LE goes down, your cert expires and doesn't update, then your website visitors get the "unsafe site banner" and have to navigate instigation of an override to even see your pages.

My small business page's cert got messed up (by Plesk, or the hosting provider I suspect) and the page went offline.

If your site being essentially unavailable to customers isn't a major consequence I don't know what is.

Reply on news.ycombinator.com