Comment by superkuh | Hacker News Reader

Comment by superkuh | Hacker News Reader

Parent Full thread

First is the obvious increase in complexity and fragility of websites requiring re-approval every 90 (or whatever) days. A personal website made of .html and other files in the past would last, literally forever. Now require HTTPS and ACME(1/2/whatever) based re-approval and at some point that complex stack of software (who's complexity is hidden from the user) will break. The website will become inaccessible and die. And not only does it make them more fragile but it makes setting up a website for the first time much more complex.

The second is more abstract but notice how literally everyone in this thread is recommending LetsEncrypt. That's great, and I love LE and I'm really glad they exist. But this is literally putting all our eggs in one basket. The increased centralization will inevitably lead to increased pressures, social, political, and otherwise on LE to censor, revoke permission, or otherwise cancel the accounts of law breaking websites. Like, say, a website for an abortion clinic that is now against the law in Texas. Switching to comodo when this happens won't fix it.

You need to renew your domain every year. You need to either pay your hosting provider or, in the case of hardware you run yourself, your ISP providing network connectivity, on a regular basis. How is relying on a third-party for certificates any different?

And you do understand the reason why having browsers verify that they're actually talking to who they think they're talking to is important, right?

Nope. I can and have used my IP address. I host from the computer sitting 1 meter to my left in my apartment. I have for 20+ years. It's just as easy to send http://73.5.160.29/somefunnypic.jpg as http://superkuh.com/somefunnypic.jpg on IRC, or in email, or whatever if it comes to that. Plus there are overlay networks like Tor that I use that do provide end-point identity verification that work great without a centralized domain or CA system.

HTTP/3 would break this.

This doesn't really seem like a real issue. By eschewing domain names, you've already killed any chance of a mainstream audience for the site. That's fine, but it's also not particularly complicated for the users to support an alternative protocol where you don't need TLS if it's already so niche.

> By eschewing domain names, you've already killed any chance of a mainstream audience for the site. That's fine, but it's also not particularly complicated for the users to support an alternative protocol where you don't need TLS if it's already so niche.

These are very different. If need to convince your audience to get and install some alternate client with an alternate protocol, now you audience it at best only a few techies who can do that for themselves.

Whereas sending anyone an URL they can click on with any client, even if it identified by an IP address instead of a hostname, is as easy at it gets.

> A personal website made of .html and other files in the past would last, literally forever.

Web serving has always had moving parts, and there has always been some maintenance required to keep sites up. I agree that HTTPS increases the burden here, but not from zero.

> at some point that complex stack of software (who's complexity is hidden from the user) will break

Sort of? People definitely screw up their HTTPS configuration from time to time, or run into bugs. But the acme software is very reliable, so this is rare, and if it does happen blowing your existing configuration away and starting fresh will fix it.

> And not only does it make them more fragile but it makes setting up a website for the first time much more complex.

If you want to set up a website with minimal steps you generally get someone else to host, at which point they are dealing with HTTPS. If you want to do it all yourself HTTPS does add a step, but it is small compared to all of the other steps involved in setting up a server.

> The increased centralization will inevitably lead to increased pressures, social, political, and otherwise on LE to censor, revoke permission, or otherwise cancel the accounts of law breaking websites.

The US legal system cannot currently compel Let's Encrypt to refuse service to lawbreaking sites, and even if the law changed here you could get a certificate from a CA in another country.

acme hasn't even been around long enough to be called reliable. Imagine a website set up in 2017 using acme 1 protocol. That website is now dead because acme 1 is no longer supported; only acme 2.

Reply on news.ycombinator.com