this post was submitted on 18 Nov 2024
973 points (99.6% liked)

Technology

59876 readers
4969 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
 

Happy birthday to Let's Encrypt !

Huge thanks to everyone involved in making HTTPS available to everyone for free !

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 152 points 3 weeks ago (7 children)

Man I love let's encrypt, remember how terrible ssl was before the project landed?

[–] [email protected] 65 points 3 weeks ago (1 children)

Crazy times. Nowadays it's weird when a website doesn't have https. Back then it was pretty much big companies only. And the price of a wildcard certificate...

[–] [email protected] 10 points 3 weeks ago (1 children)

Except for neverssl.com

Triggering the launch of captive portals for public Wi-Fi users everywhere yayy

[–] [email protected] 4 points 3 weeks ago (1 children)

That website says it will never use SSL, but it definitely just connected over https with a valid certificate when I went there.

[–] foggenbooty 7 points 3 weeks ago (1 children)

That's odd. Try httpforever.com instead.

[–] [email protected] 5 points 3 weeks ago (1 children)

Nice yeah that site actively rejects https connections.

load more comments (1 replies)
[–] [email protected] 31 points 3 weeks ago

I did not have the money to pay the insane amounts these greedy for-profit certificate authorities asked, so I only remember the pain of trying to setup my self-signed root certificate on my several devices/browsers, and then being unable to recover my private key because I went over the top with securing it.

[–] [email protected] 23 points 3 weeks ago (1 children)

And if you remember, that this whole shebang was only started, because Snowden revealed that the NSA spied on all of us, it's getting much much darker.

[–] rottingleaf 4 points 3 weeks ago

People behave as if having a green lock icon were enough to consider you're safe.

People behave as if there were not multiple cases of abuse of PKI.

People behave as if all those whistleblowing cases exposing widespread illegal activities by the state were not treated as normal, except those exposing them being chased and vilified.

What I'm trying to say is that we're past the stage where techno-optimism about the Internet made sense. They just say in the news that abusing you is good, and everybody just takes it.

[–] [email protected] 13 points 3 weeks ago (1 children)

I always had to fill out multiple pages of forms to get those free 1 year "trial" certs from startssl.

[–] [email protected] 4 points 3 weeks ago (4 children)

Oh man, I forgot about startssl until just now. I definitely had a few of those certs. If you wanted something fancy like a wildcard cert back then, you were paying $$$

load more comments (4 replies)
[–] [email protected] 11 points 3 weeks ago

Remember they wanted like $75 for certs? The gall.

load more comments (2 replies)
[–] pressanykeynow 50 points 3 weeks ago

And it changed the Internet, for good and a lot.

[–] [email protected] 47 points 3 weeks ago (1 children)

SSL Certs were so god awful before certbot that it’s hard to explain now that it’s so easy and free.

[–] [email protected] 7 points 3 weeks ago

Also fucking expensive

[–] [email protected] 40 points 3 weeks ago

Damn! That's definitely a "I'm old" moment for me. I still remember when I first heard about the concept and I remember setting it up the first time on a self hosted project (which seemed harder back then).

Awesome project!

[–] kaotic 31 points 3 weeks ago (2 children)

A client of mine pays for an SSL cert he doesn’t even use. I’ve told him before I moved him to Let’s Encrypt because I was able to automate the renew process. He decided he needed to continue paying for the SSL cert. I told him we are not using it, but he doesn’t believe me. So he continues to pay for it.

[–] pagenotfound 5 points 3 weeks ago (1 children)

I love it when companies are too stubborn to update their costs despite the necessity changing over the years.

My previous employment kept buying microsoft office license keys despite us already moving to 365. They probably did it out of habit when buying new computers. Needless to say I have a cardstack of license keys at home lol. Granted it’s for Office 2013 but I don’t really need the latest version for basic document processing.

load more comments (1 replies)
[–] [email protected] 3 points 3 weeks ago

TLS certificates have huge margins, so web hosts love selling them.

[–] __matthew__ 30 points 3 weeks ago

Lol I instinctively freaked out when I saw the post preview assuming it was going to be a post about a major data breach or exploit of some sort relating to Let's Encrypt.

I probably need more positivity in my life 😂

[–] fiendishplan 23 points 3 weeks ago

I worked for a company we had 300 websites, the boss wanted to buy certs. I told him about Lets Encrypt. He loved the idea it saved us a bunch of money. I suggest we donate $100 to them. Hes says "NO F-ing way!".

[–] nek0d3r 19 points 3 weeks ago (3 children)

And my parents still buy SSL certs because that's just what they know 🤢

[–] [email protected] 3 points 3 weeks ago (2 children)

Today it's just more or less stupid to buy SSL you can get one extremely easy for free from Let's Encrypt or Google Trust..

[–] NikkiDimes 17 points 3 weeks ago

Yeah, I uh...I think that's kinda what this whole conversation here is about

[–] nek0d3r 3 points 3 weeks ago

I've tried explaining to them before, but they think that it's a scam because it's free lol

load more comments (2 replies)
[–] [email protected] 16 points 3 weeks ago* (last edited 3 weeks ago) (1 children)

It doesn't say on the website but on their anniversary day they are giving away unlimited ssl certs!

load more comments (1 replies)
[–] RoyaltyInTraining 16 points 3 weeks ago (4 children)

Let's Encrypt is amazing, but are there any equally trustworthy alternatives people could switch to if something bad happens to it?

[–] [email protected] 12 points 3 weeks ago (1 children)

They came up with the ACME protocol, so presumably somebody could. The real barrier to entry is the cost of getting into that certificate chain of trust. I have no idea why it's so difficult and expensive.

[–] [email protected] 12 points 3 weeks ago (2 children)

Well, it's difficult, as it should be, because if you control a certificate in the active chain of trust of browsers, you can hack pretty much anything you want.

load more comments (2 replies)
[–] [email protected] 8 points 3 weeks ago (2 children)

If it begins to enshitify, someone will quickly take up the helm. It's become so core now that someone like Cloudflare would just be like "We do this now."

[–] [email protected] 8 points 3 weeks ago (2 children)

Cloudflare sort of provides this now by being a MITM to secure your site between your server and the end user. But this requires you and your end user to trust Cloudflare.

And fwiw the ACME protocol is open so anyone can implement it. I believe even the ACME software that EFF sends out allows you to choose your server with some configuration.

load more comments (2 replies)
load more comments (1 replies)
[–] [email protected] 7 points 3 weeks ago (4 children)
load more comments (4 replies)
load more comments (1 replies)
[–] laxe 15 points 3 weeks ago

Huge impact on a tiny budget - that’s extremely impressive. The world could be so much better without rent seeking parasites.

[–] jj4211 10 points 3 weeks ago (2 children)

Just two months ago, a security team member dinged one of our services for using Lets Encrypt, as "it's not as secure as a traditional CA".

[–] bfg9k 15 points 3 weeks ago (1 children)

I'd love for them to explain how, if anything the short cert validity and constant re-checking of the domain seems more secure than traditional CAs

[–] [email protected] 7 points 3 weeks ago* (last edited 3 weeks ago)

I'd also argue that the fact that it's 100% automated and their software is open source makes it objectively more secure. On the issuing side, there's no room for human error, social engineering, etc.

[–] EnderMB 4 points 3 weeks ago

It's sad that these arguments are still being shared. It was the same arguments years ago from people that would just assume that a free cert was inherently unsafe.

[–] zerozaku 9 points 3 weeks ago (2 children)

Can anyone fill me on this? Why is it so significant?

[–] NikkiDimes 39 points 3 weeks ago* (last edited 3 weeks ago) (1 children)

HTTPS certs used to be very expensive and technically complicated, making it out of reach for most smaller orgs. Let's Encrypt brought easy mass adoption and changed encryption availability on the web for everyone.

[–] [email protected] 7 points 3 weeks ago* (last edited 3 weeks ago)

They also made it a open protocol (the ACME protocol), so now there's a bunch of certificate providers that implement the same protocol and thus can work with the same client apps (Certbot, acme.sh, etc). I know Sectigo and GoDaddy support ACME at least. So even if you don't use Let's Encrypt, you can still benefit from their work.

[–] [email protected] 17 points 3 weeks ago (1 children)

It is the free, easy way to get an SSL cert (plus automated renewals). Without it, maybe HTTPS wouldn't have been so omnipresent.

load more comments (1 replies)
[–] [email protected] 8 points 3 weeks ago

Yay for their glorious, free trusted ssl certs. Love this project!

[–] [email protected] 7 points 3 weeks ago* (last edited 3 weeks ago) (10 children)

Lots of people shitting on stories of people who buy certs.

You do still have to buy a cert if you want one for a .onion. Let's encrypt still doesn't support it :(

load more comments (10 replies)
[–] [email protected] 6 points 3 weeks ago

Underrated. Stuff rocks.

load more comments
view more: next ›