Hacker News Reader

Comment by ndsipa_pomu | Hacker News Reader

One issue with requiring some kind of fee to get SSL certificates is that it acts as a barrier to hobbyists and kids trying to set up a website (probably to learn about the technologies involved). That barrier means that there'll likely be more unsecured websites around which is not desirable.

Maybe some kind of traffic based tax would be better - just have the biggest ISPs pay for all of the free CAs.

View on HN

Don't get me wrong: I don't object to the existence of non-profit/funded CAs like Let's Encrypt! The work they've been doing on making HTTPS the norm is excellent. I just worry about a future in which the only option is a CA like that, as the other public CAs struggle with offering a product that competes with "but it's free!".

I also worry a bit about the amount of the Internet that now depends on Let's Encrypt, including a number of large enterprises. That didn't go very well the last time we had an 800-pound gorilla in the CA space, not to mention the availability problems that will occur if everyone depends on a single CA that then has an outage, a mass revocation problem, or has a disagreement with the browsers over issuance rules.

… which was never a problem until we all decided that every single website, no matter how boring or inconsequential, needed to be encrypted.

There is no reason for kozubik.com to be served with SSL … But browser behaviors, and changing social norms force me to do it.

Well, here in the UK, we had the BT ISP attempt to inject adverts into plain HTTP pages that their customers were requesting. HTTPS prevents that kind of abuse, so I welcome HTTPS on every single website as we can't trust big companies to not try to mess with us.

Reply on news.ycombinator.com