Comment by jiggawatts | Hacker News Reader

Comment by jiggawatts | Hacker News Reader

Parent Full thread

To put things in perspective, a typical certificate is a few kilobytes. Let’s say 10KB of network traffic to process one certificate.

This is just 3.5 Mbps, and we’re all “very impressed” that it’s being provided for free.

A Raspberry Pi could serve this.

Certificate Authorities have convinced everyone that their service is so onerously difficult to provide that they deserve billions of dollars… annually.

The reality is that they are pure rent-seekers, charging $50 for something that can be provided for free from a fanless hobby computer.

I just want everyone to have some perspective next time you go buy a wildcard certificate for a thousand dollars, which differs from a normal certificate by just four bytes.

Count the dollars per byte.

Cool. But what do the HSMs, auditing, etc, etc, etc that the BRs (https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...) and root store policies require cost on top of “just some bytes”?

FreeFreeFreeCerts (https://bugzilla.mozilla.org/show_bug.cgi?id=233458) or Honest Achmed’s certificate authority (https://bugzilla.mozilla.org/show_bug.cgi?id=647959) won’t make it in today’s world, nor yesterday’s.

Let’s Encrypt’s financials are public and they aren’t running it off a singular Raspberry PI, nor anything like it - because they can’t; nor would it responsible to, at least on, say, a HSM or key seperation level.

Not to say, though, that traditional CAs aren’t rent seeking bloated greedy pieces of shit - because they absolutely are. I’m happy Let’s Encrypt found the funding and will (and the all important cross-sign) to take off and curb stomp the incumbent CAs around a bit. I still cringe every time I see an OV certificate in the wild.

To be fair, I doubt bandwidth has ever been a significant cost driver for CAs

Greed has been the cost driver, which is why plugging "*.domain.com" into the subject field instead of "domain.com" costs 10x more money.

DigiCert for example is owned by private venture capitalists.

They expect as much rent-seeking as possible to get a return on their investment.

You can have wildcard certificates from LE too.

Reply on news.ycombinator.com