News for hackers. Stuff that matters.
Re:Our First Certificate Is Now Live by jonknee on Monday September 14, 2015 @06:05PM (#10217819)
It's amazing that it takes a free provider to make things simple:

https://letsencrypt.org/howitworks/

I'd actually pay more than I do now for SSL certs to get that kind of simplicity.

Re:Our First Certificate Is Now Live by nailer on Monday September 14, 2015 @06:37PM (#10217972)
I run https://certsimple.com: we only do EV certificates, we're the fastest place to get an EV cert, we check as much as we can before you pay us a cent, and our application process is 80 seconds.
Re:Our First Certificate Is Now Live by kuschku on Monday September 14, 2015 @07:26PM (#10218134)
You might want to fix your webdesign: http://i.imgur.com/zQbWnUI.png

And this is in Firefox, which renders fonts more bold than other browsers.

Re:Our First Certificate Is Now Live by nhebb on Monday September 14, 2015 @09:40PM (#10218545)
Just removing the font-weight: 300 helps tremendously. Personally, I'm becoming less of a fan of external fonts. I've noticed lately that they're often the slowest thing to load on sites that use them (especially Google fonts).
Re:Our First Certificate Is Now Live by LeoNatan25 on Monday September 14, 2015 @10:58PM (#10218751)
The weight works great on a high DPI display, but on older displays, it just doesn't work. Open on a rMBP or iPad, and it's beautiful. I'm guessing the designers are working on a high DPI Mac.
Re:Our First Certificate Is Now Live by nailer on Tuesday September 15, 2015 @03:39AM (#10219429)
Edit: should be sorted.

Original: working on a standard DPI Mac, but it still looks fine - see http://imgur.com/WRWYzBx. Trying to figure it out now...

Re:Our First Certificate Is Now Live by tripzilch on Wednesday September 16, 2015 @08:57AM (#10226176)
Do you mean "fine" as in "very fine lines", or "looks fine" as in "looks good"?

Cause that looks like a printer that ran out of ink.

Re:Our First Certificate Is Now Live by LeoNatan25 on Tuesday September 15, 2015 @11:01AM (#10221024)
I'm guessing OS X's font smoothing is more aggressive and makes it look better than Windows'. It also depends on how the font was hinted for Windows, whereas on OS X, the system "knows best" and has its own font smoothing technique.
Re:Our First Certificate Is Now Live by hinkley on Tuesday September 15, 2015 @01:15AM (#10219053)
I am on a rMBP and I wouldn't call it beautiful.

It's painfully thin, and the eyestrain factor is pretty high.

Re:Our First Certificate Is Now Live by kuschku on Monday September 14, 2015 @11:15PM (#10218790)
I downloaded all of Google’s font library and installed it locally, means I can read the fonts without having to load them from Google. Still doesn’t help against fonts with 0.5px thin lines.
Re:Our First Certificate Is Now Live by chrissnell on Tuesday September 15, 2015 @01:00AM (#10219013)
Back in the day, running a massive library of fonts slowed down many apps. Is this still the case? I'm running Mac OS X 10.10.
Re:Our First Certificate Is Now Live by kuschku on Tuesday September 15, 2015 @01:16AM (#10219056)
I’m on linux, and yes, it does. Opening the font selection menu can take for me, with 7000 installed fonts, about half an hour sometimes. I just don’t do that, instead select fonts by name (I know most of them now).

But you don’t notice it until you open a font selection menu.

Re:Our First Certificate Is Now Live by profinger on Tuesday September 15, 2015 @12:44PM (#10221634)
That's insane! Guessing you don't use Photoshop. At least, the last version I used (I think CS5), the font selection was weird and, no matter what, required that you open the drop down. Bleh. Haha
Re:Our First Certificate Is Now Live by kuschku on Tuesday September 15, 2015 @04:07PM (#10222839)
Photoshop on linux, that’s funny ;P

But seriously, I had to use Gtk3's font selection menu today, and it was impossible to work with it.

Re:Our First Certificate Is Now Live by mortenlarsen on Tuesday September 15, 2015 @02:40AM (#10219275)
Also on Ubuntu. I (only) have 671 fonts, no delay at all for me.
Re:Our First Certificate Is Now Live by nailer on Tuesday September 15, 2015 @03:16AM (#10219386)
Edit:

I've made some changes to Typekit to thicken things up. Is it better? If not, can you provide details of your OS?

Original:

I'll investigate and fix that now. What OS are you on so I can reproduce it?

It looks this this here in Firefox (http://imgur.com/WRWYzBx) and this in Chrome (http://imgur.com/6dFeQhG) on OS X, testing across multiple Macs here. I'd really like to fix it though! Thanks for the heads up!

We moved from Google Fonts to TypeKit recently, so I suspect it may have happened then.

Re:Our First Certificate Is Now Live by zhte415 on Tuesday September 15, 2015 @08:28AM (#10220200)
On the updated version, want to give some actionable feedback:

Not just the weight, the size combined with the weight: 12px in a thin font is too light for a screen, especially done in grey. Going to 16px could really make a difference.

Going with a bigger size gives the scope to use a different, contrasting (perhaps thicker, perhaps thicker and smaller for double-contrast?) font for the headings currently in green.

* Getting older happens to different people at different ages, one of the effects of this means eyes get more temperamental, and this doesn't happen 50+, it happens a lot earlier for a lot of people.

Re:Our First Certificate Is Now Live by nailer on Tuesday September 15, 2015 @09:03AM (#10220371)
Thanks - I'm really grateful for the feedback - and would like it if you have any more.

I'll be changing the base font to 14px and darkening the grey to #222 quite soon.

I'll also look at 16px but this needs some additional design work.

Re:Our First Certificate Is Now Live by tripzilch on Wednesday September 16, 2015 @09:02AM (#10226205)
As I said above, the Firefox screenshot looks like a printer that ran out of ink, the Chrome version is slightly better, but look at the letter 'T', that's still wrong, a hairline that falls between pixels. That's only acceptable for text that is not actually intended to be read (thumbnails, mockups, zoomed out stuff, etc).
Re:Our First Certificate Is Now Live by JorgeGT on Monday September 14, 2015 @08:00PM (#10218232)
In Chrome is better but still terrible :/
Re:Our First Certificate Is Now Live by Killswitch on Monday September 14, 2015 @07:33PM (#10218157)
Yeah but still $234/yr for a certificate. While I appreciate what you're doing to make things more simple, that's pretty expensive.

I can't wait until letsencrypt is done.

Re:Our First Certificate Is Now Live by jessedhillon on Monday September 14, 2015 @09:09PM (#10218437)
They offer EV certs, so there's some cost involved in doing the identity verification. I don't think it's $234 dollars a year, forever, but it costs something. And that's actually a pretty competitive price for an EV certificate.
Re:Our First Certificate Is Now Live by pserwylo on Monday September 14, 2015 @10:08PM (#10218624)
While I also look forward to letsencrypt being generally available, the fact your parent comment charges $234/yr for a cert is in response to:

> I'd actually pay more than I do now for SSL certs to get that kind of simplicity.

Re:Our First Certificate Is Now Live by StavrosK on Tuesday September 15, 2015 @06:49AM (#10219886)
$10/yr to $234/yr is quite the jump.
Re:Our First Certificate Is Now Live by leesalminen on Monday September 14, 2015 @07:35PM (#10218162)
Is it possible to get a wildcard EV certificate?
Re:Our First Certificate Is Now Live by Gregordinary on Monday September 14, 2015 @08:53PM (#10218371)
Wildcards are prohibited on EV certificates per CA/B Forum requirements: https://cabforum.org/wp-content/uploads/EV-V1_5_61.pdf (Section 9.2.2)
Re:Our First Certificate Is Now Live by EwanToo on Tuesday September 15, 2015 @07:30AM (#10220001)
No, which is why most of Google isn't running on EV certs..
Re:Our First Certificate Is Now Live by manigandham on Monday September 14, 2015 @09:47PM (#10218568)
Like the other comment says, the font is way too thin on your site and actually hurts to read on my monitor. Any interest I had in this service is effectively gone now.

Text needs to be legible, please try and stick to normal and bold weights.

Re:Our First Certificate Is Now Live by A010 on Monday September 14, 2015 @10:06PM (#10218620)
I didn't know the site is unreadable until uMatrix was disabled.
Re:Our First Certificate Is Now Live by kolev on Monday September 14, 2015 @07:19PM (#10218112)
These shameless plugs are getting really annoying. We know about you, we know CloudFlare and Let's Encrypt are kinda competitors with their free certificates, but you don't have to comment on each post about them. Really, stop annoying us - it doesn't do you any good, honestly!
Re:Our First Certificate Is Now Live by mindcrime on Monday September 14, 2015 @07:57PM (#10218227)
These shameless plugs are getting really annoying. We know about you

I for one had never heard of these guys and appreciate the mention. Besides, as far as I can recall, it's never been considered problematic to promote your own service on HN as long as the mention is topical and done tastefully.

Re:Our First Certificate Is Now Live by schoen on Monday September 14, 2015 @07:22PM (#10218120)
In this case, the previous commenter was explicitly asking for advice about how to get certificates more conveniently today, so the replies about existing services that can do so seem quite relevant.
Re:Our First Certificate Is Now Live by kolev on Monday September 14, 2015 @08:11PM (#10218263)
It's like trying to sell a Ferrari to a guy who's looking for a regular car...
Re:Our First Certificate Is Now Live by twothamendment on Tuesday September 15, 2015 @12:09AM (#10218902)
Maybe so, but you know every regular guy driving a regular car would rather have a Ferrari and might even spend time looking at them even though he can't buy one.
Re:Our First Certificate Is Now Live by kolev on Tuesday September 15, 2015 @12:55AM (#10219005)
You're wrong. EV is a scam. I can afford to buy EV for most of my sites, but I don't do it. Because consumers don't really care. Even HN doesn't have an EV! Ferrari is what everybody wants, EV is a different story! And stop downvoting all my comments - it shows your subpar human material. Downvote my main point and stop right there. No need to go aggressive and try to silence me and not comment further, because you will "punish" me further as well.
Re:Our First Certificate Is Now Live by cpach on Tuesday September 15, 2015 @03:40AM (#10219432)
As per the guidelines, please keep discussions civil on HN and please don't complain about being downvoted.

https://news.ycombinator.com/newsguidelines.html

Re:Our First Certificate Is Now Live by kolev on Tuesday September 15, 2015 @04:03AM (#10219489)
I am civil, but those who can't help the sick urge to downvote every single comment of mine although they all represent the same points are not civilized.
Re:Our First Certificate Is Now Live by dang on Tuesday September 15, 2015 @05:18AM (#10219659)
No, cpach is right. You can't post comments like "it shows your subpar human material" to Hacker News. Personal attacks are not allowed here, regardless of whether someone downvoted unfairly.

There's also the guideline specifically asking you not to go on about being downvoted.

https://news.ycombinator.com/newsguidelines.html

Re:Our First Certificate Is Now Live by kolev on Tuesday September 15, 2015 @12:47PM (#10221650)
Most are just suggestions, not law. I stand by what I said. Being vindictive is not civilized. I didn't make personal attacks - I have no idea who downvoted me.
Re:Our First Certificate Is Now Live by dang on Tuesday September 15, 2015 @02:08PM (#10222198)
Personal attacks can be anonymous, so that's a red herring. And HN's guidelines may not be laws, but neither are they optional—we ban accounts that violate them repeatedly.

It's not hard to see what kind of discourse we're going for here. What's hard is to stick to it when you're feeling that someone is subpar. On the internet, human biases yield a strong tendency to feel that way about others, and we all need to be disciplined about counteracting it. If you can't or won't take up the task, you're not welcome to comment here.

That doesn't mean you have to abide by it perfectly. I can't, and doubt anyone can. It means that when we slip we need to recognize our error and correct it, not defensively dismiss the information.

Re:Our First Certificate Is Now Live by kolev on Tuesday September 15, 2015 @09:14PM (#10224130)
Then do the right thing and solve the problem by removing downvote on comments - you will do this community a huge favor and you will simplify the UX as well. It has no purpose outside of emotional buildups. Upvotes give you enough for sorting purposes - it's been working well for Facebook and Twitter. For everything else, there's reddit!
Re:Our First Certificate Is Now Live by dang on Tuesday September 15, 2015 @10:24PM (#10224330)
Downvotes are imperfect but HN would be worse without them. However, I don't think that has anything to do with your breaking the rule about incivility. Being downvoted, even being downvoted unfairly, is no excuse. Please only post civil comments from now on.
Re:Our First Certificate Is Now Live by kolev on Tuesday September 15, 2015 @11:26PM (#10224506)
I am sure that you cannot back with any credible evidence the assumption than downvoting comments makes HN a better place. You can add flagging and that will do better, but downvoting is unhealthy. The fixed -4 threshold is random and wrong as well. The loyalty to Paul Graham's original decisions is misunderstood loyalty and there are a lot of missed opportunities here, because of these repeated mistakes.
Re:Our First Certificate Is Now Live by dang on Wednesday September 16, 2015 @02:23PM (#10228675)
Going off on perennial questions of forum design is not a good way to deal with the issue here.

When people can't or won't be civil on HN, we ban their accounts. There's no exception for getting downvoted—on the contrary.

Re:Our First Certificate Is Now Live by Flenser on Wednesday September 16, 2015 @11:38AM (#10227391)
I'm curious, did you know you were taking to a moderator? (dang is on the HN staff: http://blog.ycombinator.com/meet-the-people-taking-over-hack... )

I'm asking because I'm wondering if it should be made more obvious that he is when he is posting in his moderation role.

Re:Our First Certificate Is Now Live by kolev on Wednesday September 16, 2015 @04:38PM (#10229694)
Yes, I know who he is. Although I had a much older account, which password I couldn't recover, because it's from the days when no email was necessary here, I frequent HN for years and that's why I care about this community as I spend a significant portion of my life in here.
Re:Our First Certificate Is Now Live by dang on Thursday September 17, 2015 @03:13PM (#10235444)
We can sometimes help people regain old accounts with no email address in them. If you still want it, you're welcome to email us ([email protected]) with the username and we'll look into it.
Re:Our First Certificate Is Now Live by rimantas on Tuesday September 15, 2015 @03:58AM (#10219480)
I really would not care if any of your sites had EV. And I don't care that HN does not have EV. But I may care whether the place I am going to spend money does have one.
Re:Our First Certificate Is Now Live by kolev on Tuesday September 15, 2015 @04:08AM (#10219503)
You don't shop at Amazon.com? Because they don't believe in the EV scam either! More on the DV vs EV topic here: https://certsimple.com/blog/are-ev-ssl-certificates-worth-it
Re:Our First Certificate Is Now Live by kolev on Monday September 14, 2015 @08:00PM (#10218233)
Oh, the commenter asked for the overly expensive EV type? Let's not be the devil's advocate. This is the wrong way to advertise. This is not the beginners corner. You advertise once, twice, three times, people remember, you can search HN - no need to annoy people till the end of the world. The company seems desperate for new business this way anyway.
Re:Our First Certificate Is Now Live by readme on Monday September 14, 2015 @09:16PM (#10218455)
Who's us? I didn't know you represented me.

I actually had never heard of this and think it's pretty cool.

Re:Our First Certificate Is Now Live by kolev on Tuesday September 15, 2015 @01:04AM (#10219024)
Grab a dictionary - there's "us", and there's "all".
Re:Our First Certificate Is Now Live by icebraining on Monday September 14, 2015 @06:25PM (#10217913)
SSLMate seems pretty easy as well: https://sslmate.com/

(No affiliation, I just saw their HN post some time before)

Re:Our First Certificate Is Now Live by jsnk on Monday September 14, 2015 @08:04PM (#10218247)
Looks awesome!

Does anyone know if there's an undo command for `$ letsencrypt run`?

I would love to try this, but too scared to do it and mess up with my nginx configs.

Re:Our First Certificate Is Now Live by schoen on Monday September 14, 2015 @11:34PM (#10218833)
The client has a checkpointing mechanism that does back up old configuration versions and can revert them. (This client feature is called the "reverter", in case you care to look at some of the code or issues related to it on our GitHub page.)

I still haven't figured out how that interacts with the automated renewal features (probably not well right now!) but the ability to revert configurations exists.

Also, please don't try the client with a live site right now, because we don't have general public availability (nobody outside of Let's Encrypt can get a cert issued from the Let's Encrypt intermediate -- you'll get one from "happy hacker fake CA" instead), and we don't have the cross-signature. We're not even quite at the beta-test stage yet, let alone the "please use our certificates on your popular public services" stage. :-)

The main exception would be if you currently don't have HTTPS enabled at all and you're in the mood to experiment to learn more about Let's Encrypt.

Re:Our First Certificate Is Now Live by technion on Tuesday September 15, 2015 @08:07AM (#10220128)
For this specific reason I'm a lot more comfortable running the "nosudo"[0] variant, which tells you to install the keys yourself.

A recently released Ruby gem also looks promising, in that it's a much better codebase with a tonne of tests.[1].

[0] https://github.com/diafygi/letsencrypt-nosudo [1] https://github.com/unixcharles/acme-client

Re:Our First Certificate Is Now Live by HappyTypist on Monday September 14, 2015 @09:31PM (#10218520)
Perhaps $ git init your nginx configs?
Re:Our First Certificate Is Now Live by nightpool on Monday September 14, 2015 @09:41PM (#10218549)
I mean... back them up? :D
Re:Our First Certificate Is Now Live by nathan7 on Tuesday September 15, 2015 @02:00AM (#10219180)
SSLmate (https://sslmate.com/) actually makes things similarly simple — I've been using them for a few months now.