556 karma · joined October 18, 2013
Much like cloud users with k8s, though, I think a lot more companies think they have that problem than actually have that problem.
(I can hear the salespeople warming up in the silos already and no: if I don't have $36 million right now, absolutely nothing you say will make it possible to "find those dollars somewhere".)
I also worry a bit about the amount of the Internet that now depends on Let's Encrypt, including a number of large enterprises. That didn't go very well the last time we had an 800-pound gorilla in the CA space, not to mention the availability problems that will occur if everyone depends on a single CA that then has an outage, a mass revocation problem, or has a disagreement with the browsers over issuance rules.
Instead, I would surmise this is the first step in that process by introducing a window short enough to act as a forcing function on automating certificate issuance & renewal. It's short enough to strongly encourage leveraging automation everywhere possible, but not so short that one could argue it's impossible to do manually for things that still just can't do this automatically, of which there are still a disappointingly significant number.
Once we begin to get below 30 days, however, I suspect there will be a lot more scrutiny around the data suggesting exactly how small a window is sufficient. From a risk standpoint, if we're arguing shorter-is-better, then we should go as short as possible: someone will need to pull together the data that suggest exactly how small a window appropriately balances the various risks involved. (And then 15 others will need to argue about the validity of the data, whether the data actually suggest that, whether the data were assembled with an agenda in mind, etc., etc., etc.).
People seem to be under the misapprehension that Let's Encrypt / ZeroSSL certificates are "free". They are not — it's that the consumer is not the one paying the bill.
It costs tens to hundreds of thousands of dollars a year just to get the audits required to operate a public CA, much less pay for the infrastructure and staffing required. That bill has to get paid somehow. Yes, pricing on certs in the past has been questionable, but operating a public CA is -not- free, so CAs have sold certificates to pay for that service operation. That has introduced some issues of its own in terms of profit motives, although I would observe that for the majority of public CAs their public TLS certificates are frequently a loss-leader service and not a massive source of income. Put short (too late!), there's nothing wrong with the practice of paying for certificates in and of itself.
What makes me very concerned about the current model funneling everyone to "free" CAs is that those bills are being paid at the moment through donations to ISRG and other organizations. I like that ISRG is making efforts to broaden their donation base to reduce reliance on single sources! However, I'd much prefer to be paying them a monthly subscription fee for their certificate service and not have my ability to leverage it be dependent on the largesse of large corporations that frequently abruptly decide services like this should either cost money or pay up in user data. (Note that I explicitly do not think the user-data thing is happening right now, only that I'm concerned it becomes a problem in the future.)
Consider what's needed for someone non-programmer-y to use an SSG:
* Download a copy of the repository and install the SSG tooling, then fire up the SSG in listening mode so they can see their changes. * Write out the Markdown for their page. Oh, hope you have short-codes in place for things like images-next-to-paragraphs, info callouts, common page structures (cards, hero blocks, buttons), and so forth. If not, either they'll have to pause and get you to work with them to have them implemented, or they'll have to figure out writing the templates required. Regardless, once the bits are implemented in the site the writer has to work in the arcane short-code format markup required to include them. * Now they've got their changes, they need to figure out how to stage them — either they need to zip up the whole working directory and send it to you to sort out, or they get to learn how to commit a pull-request to a Git repository.
I don't mind doing all of that — it's quite enjoyable to figure out, and I get the chance to structure things exactly as I like them. But trying to teach a theatre director accustomed to writing in Google Docs how to do all of that? Nope. Which then turns into, "here, I wrote this out in G-Docs — hope you can figure out how to turn that into a site page!".
I really do wish there were a better competitor to WordPress, something that offered the ability to lift the hood and customize more easily. There are some CMS front-ends to SSGs, but the last I checked they either were more "CMS" in the sense of "put stuff in database and this will render it" or they still weren't particularly user-friendly (or were abandoned).
But they didn't "lose real money". They lost theoretical money that they didn't actually have. This is a trap people fall into with gambling, the stock market, and other up-and-down financial systems. What matters is the money you're holding in your hand, not the money you could have been holding in your hand. If I go to Vegas and put $20 on roulette and watch it multiply over rounds to $20,000, do I have $20,000? Not until I cash out I don't. So if the next round wipes all of that out, how much did I lose? $20. Not $20,000 — $20.
I realize this is sort of tangential to the point, but it's also a valid strategy for avoiding regret.
This is one of the prime examples of the utter failure of the US for-profit healthcare model.
Couple things killed them, though. The recording industry did their usual “ZOMGWTFBBQ this will KILL the music industry!” dance that they do every time there’s a new recording tech, so Sony responded by building in 90 layers of DRM all over the place. That meant you could record yourself playing, but trying to get that recording off the disc was anywhere from annoying to impossible depending on the player model thanks to Sony’s proprietary audio formats and connection systems. Until NetMD, the players would only use ATRAC, so you’d have to use Sony’s tools to move content in and out of the devices, with lots of DRM flags to make it harder to use them to bootleg concerts or trade music.
All of that was in place right when MP3 and HDD/solid-state recorder/players exploded, at which point there was no selling point for MD anymore. No one wanted to buy a copy of an album on MD (there weren’t many anyway) when they could buy the MP3s or buy the CD and rip the MP3s instead. No one wanted to record audio in a proprietary format on expensive MDs when they could record it uncompressed to a computer or a solid-state handheld and burn it to a CD if they wanted a physical copy.
Kind of sad, really—-the later NetMD models were tiny, fun to use, and by then Sony had removed most of the obstructions around recording and transferring audio. Solid-state is more reliable, but those recorders don’t have the cool looks and fun interfaces of the consumer MD models.
Seems like today, given the proclivity of open-source/non-platform-locked tooling, someone would be looking at making that a viable solution for boutique design-plus-hosting. But maybe those days are gone.
Some subreddits are notable exceptions, though—-those are the ones I’ll actually miss if this thing collapses. By and large, they’re small, very focused subreddits on particular topics; seems like once a subreddit reaches a certain size it just collapses into the above mess of behaviors.
Thanks for the effort! I’m still a budding Rustacean but will look and see if I can help at all.
Beyond that, though: Internal build systems? Data encryption? User client auth to critical services? Internal app mTLS for data exchanges? The list of possibilities goes on and on…
Some of this, too, is due to Cisco’s longevity in the market, the sheer number of product lines they’ve gone through, and the number of companies they’ve absorbed.
You buy a company, you can’t just cancel all the existing licenses for those products, so you have to keep those licensing systems and pricing packages around for those customers that keep renewing year after year. Only after a while, it becomes more trouble than it’s worth to integrate those into your existing licensing packages (especially if you’re figuring you’ll get around to EoLing that stuff when no one’s using it anymore), so they just stick around forever.
You kill off a product line and replace it with something, existing customers say, “Great, I’ll buy the new thing with the options I had on the old one”. Except those don’t map cleanly, so now you’re developing odd licensing packages for people who want the Super-Duper Routing 9000 but only with the same leather trim and manual shifter they had on the Routing 8000. If the customer is large enough you’ll bend for them, especially the big national ones with clauses in their contracts that require the forfeiture of dragon-blanching amounts of gold if you ever can’t sell them exactly what they bought last year.
Fortunately a lot of that has subsided. The focus on responsible disclosure while still holding companies accountable, the great security research being done by projects like Talos or Project Zero, and the consistent flow of new open-source blue-team tooling has really helped balance the scales (if they were ever unbalanced).
One thing that helped was accepting that bookmarking it was just a way of putting it down for now, and that I always have the option to come back to it. That doesn’t happen often, but pruning back all those tabs did remind me of a couple things I’d marked that I wound up doing things with. And then on a regular basis I’ll run into a problem and think, “Wait, I think I marked a site in Raindrop about this…aha! There it is.” So storing those marks (as long as they’re searchable!) still has benefit without immediate action, which helps me not leave them open (although I’m still wrestling with it…).
Meanwhile, the act of browsing all those interesting reads and looking at those projects is beneficial in its own right even if I do nothing else but read and bookmark. By reading and absorbing all those different ideas, I make it far more likely that when I’m working on projects at work or talking with other people, my brain will pull those random articles together and make a connection or a reference that’s useful.
A friend of mine likes to call herself the “corporate bumblebee”, gathering bits from one project and connecting it to other projects like a bumblebee spreading pollen. Think of reading HN as being a tech bumblebee: you’re gathering the pollen that you can later give to other people.
None of them, however, quite fit with our use cases. We needed something that non-tech people could equally contribute to and maintain (so git with static pages was out, as were the many wikis that required writing content in Markdown without a WYSIWYG UI). We needed something with tight integration with Jira, as we frequently used the ability to display Jira issue reports and auto-create wiki pages. And we preferred something that could at least display Office-doc and PDF content transparently, although that was looser. I’m glad I never had to make that call, because killing our self-hosted Confluence was going to suck badly.
I’ll never not be upset with Atlassian over that mess. I get why they did it and even kind of understand doing it, but the whole thing was handled in the most user-unfriendly, tone-deaf way possible. And then to have their godawful cloud Jira meltdown happen shortly afterwards and have them not adjust any license terms in apology for it was the topper on the cake.