I love them. I'm not really sure how SSL works or what it is (and frankly I don't care to know the details) but with 2 commands I can get that magical lock on any website. I'm glad they're doing well. Thank you!
Let’s Encrypt only gets rid of the latter, and given that fraudsters able to spoof the former can probably spare the $10 for the latter, I‘d argue that this is a good thing.
All of that noise is gone now. That makes the internet much safer.
Not sure it's a downside/upside thing. It might shed light on the types of people who get hired at facebook.
Pick the brain of any accomplished engineer, and you'll quickly see that the technical knowledge they use to write code on a day to day basis is only the tip of the iceberg.
It's not reasonable to expect everyone to know everything all the time, but I don't agree people should be aspiring to just know the bare minimum either. Mediocrity is like gravity: if you don't (at least occasionally) aim higher, your trajectory will be lower than you want.
You don't know why they haven't taken the time to learn. At least they know enough to know they need an SSL cert. Should I not buckle up in a car if I don't understand the mechanics of how the buckle snaps together?
I don't understand why you're harping on this person for this.
"frankly I don't care to know the details"
I take issue with that statement not the person. The statement was honest and matter of fact.
Few know how SSLs work, few have time or opportunity or even desire to learn it. Not 'wanting' to understand the details goes against what I would expect. A programmer tries to/needs to understand how the world works. Not wanting to understand the entire stack is a new concept to me.
Then I'd suggest that your experience about the world, and about people in general, is severely lacking.
There aren't enough hours in a day or years in a life to learn everything, so we have to be selective.
Do you know how CPUs work, down to the various functional units and pipeline stages and how they work together? Can you explain to me how transistors work on an electrochemical level? Can you explain how silicon wafers are fabricated? Hell, I took those classes in college as a part of my EE degree, and I can't really remember it well enough to explain without cheating and looking at Wikipedia. (And even then...)
And guess what? That's just fine. I have no need or desire to dive that deeply back into that stuff.
Why should the minutiae around TLS certs be any different? I do know how TLS cert provisioning works, and to be honest, it's boring and tedious. And I do it so infrequently that I have to look up a tutorial every time I do it. It's just not worth keeping in my head. If I could use LE for everything, and never try to remember the right `openssl req` command ever again, that would be great.
> A programmer tries to/needs to understand how the world works.
No, a programmer is someone who solves problems with code. How they do it, and what types of knowledge they pursue, runs the entire gamut of possibilities.
Bottom line: knowing technical minutiae doesn't make you cool or special or better than other people. It just makes you someone who's interested in that stuff, or someone who needs to understand it as a part of work they do. Let's not elevate it to something it's not.
People may think they are Cool or special for millions of reasons (like not knowing what ssl is for example).
I could absolutely be wrong about that reasoning, though, but that's my point - we don't know why, so why assume a negative and then lean into that?
I mean, c'mon, it takes quite a bit of arrogance to condemn someone for some little facet of their life when you know next to nothing about them.
Technology shouldn't be a blackbox and shouldn't be celebrated as such.
General public does not differentiate between the SSL certificate validation level.
Let's Encrypt provides domain validation certificates, which only validates that one owns the domain in question.
There is another level - Organization Validation SSL certificates, which involves manual checking that this is the legal entity it claims to be. I would expect the financial institutions to use this kind of certificates to avoid phishing, but sadly I've seen some of them use Let's Encrypt.