Hacker News Reader

Comment by mariusz79 | Hacker News Reader

It will just make it easier to create walled gardens, and charge companies and individuals for certificates. It will also pretty much get rid of privacy, since to get the cert you will need to provide someone with your detailed information. Using self-signed certs will become harder. Yes, it's a good idea to use https _almost_ everywhere, but forcing everyone to use it is a terrible, stupid idea.

View on HN

> It will just make it easier to create walled gardens, and charge companies and individuals for certificates.

letsencrypt.org will solve this problem.

> It will also pretty much get rid of privacy, since to get the cert you will need to provide someone with your detailed information.

That's something that applies to buying/owning a domain as well. Domain-verified certificates require very little private information, and I suspect letsencrypt.org might be able to provide a way to get trusted certificates without giving up privacy.

> Using self-signed certs will become harder.

How so? The proper way to use self-signed certificates would be to distribute them in a safe way (e.g. deploy them through your Active Directory Domain, provide the fingerprint through a separate channel, etc.) and install them in your trust store. I couldn't find any intended changes to this in their announcement.

> Yes, it's a good idea to use https _almost_ everywhere, but forcing everyone to use it is a terrible, stupid idea.

I agree that it should be a slow process, and I think that's exactly what they're suggesting. Eventually, when the tooling and processes around SSL/TLS catch up with the new "encrypt everything" mentality, it would probably be no big deal to deprecate almost every use-case of HTTP without SSL/TLS.

Let’s Encrypt does not even provide a RPM for Fedora or RHEL yet or at least there's no mention of it on the front page [1].

[1]: https://letsencrypt.org/howitworks/

There is an open protocol[1] on how to retrieve the certificates, so you can implement a client in a language of your choice, or wait until someone else does it.

[1]: https://github.com/letsencrypt/acme-spec

That comment was about package management (i.e. actually installing this on servers), not about language implementations. Let's Encrypt's documentation currently assumes a Debian-based operating system, which therefore leaves out a very large portion of the web server population.

letsencrypt.org is not even working, and it seems to be Linux only, at least for now. What about other OSs?

That's why I said "will solve". For now, you can use startssl.com for (non-commercial) free, trusted certificates.

Mozilla is one of the backers behind letsencrypt. I'm sure they won't be deprecating anything until well after it is up and running. This was an email to the Mozilla community asking for feedback, not an announcement of any major deprecations in the next version of Firefox.

Letsencrypt is based on an open protocol [1], I'm sure there will be implementations for all major platforms.

[1]: https://letsencrypt.github.io/acme-spec/

Can we please stop saying "letsencrypt.org will solve this" until letsencrypt.org is actually solving this?

Why? We're discussing long-term changes to how HTTP without encryption should be handled. I think an upcoming project with major impact on the availability of certificates should be a factor in this discussion. Besides, it's not like letsencrypt will be the first CA to offer free certificates - StartSSL has been doing it for years, although letsencrypt obviously has a different approach.

> Why? We're discussing long-term changes to how HTTP without encryption should be handled. I think an upcoming project with major impact on the availability of certificates should be a factor in this discussion.

Because Let's Encrypt might solve this well, or it might not solve it well, or it might never even be released. At the moment, factual statements about what effect Let's Encrypt will have on the world are similar to "$(THIS_YEAR+1) will be the year of Linux on the desktop."

> It will also pretty much get rid of privacy, since to get the cert you will need to provide someone with your detailed information.

If you're using a self-signed certificate, you don't need to provide information to anyone.

> Using self-signed certs will become harder.

Why?

I haven't given this much thought yet, but these don't sound like convincing arguments against the proposition.

Because all of the modern browsers already make it harder for users to use them. It will only get worse.

I'm having a very hard time picturing anyone having such a blatantly wrong and FUD-filled opinion as anything else than either a joke or a NSA shill.

Care to convince me otherwise?

Please do not accuse users of being 'shills' (for the NSA or otherwise) alert the mods (hn@ycombinator.com) instead if you are fairly sure about it.

Hear that NSA? where is my check for this week?

Edit: never mind. Mailman was late.. got it now!

Reply on news.ycombinator.com