News for hackers. Stuff that matters.
Re:What It Costs to Run Let's Encrypt by djaychela on Tuesday September 20, 2016 @01:54PM (#12541583)
I'm quite surprised - $2.06 on staffing seemed steep, so obviously read on as I was thinking that there must be a lot of employees. But 8? OK, I'm just a teacher, and I earn around £30k a year... not the kind of figures I've seen bandied about on here for graduate programmers who seem to be pulling in 8-10 times that for their first job... So I'd be interested to see a breakdown of the payroll (which I doubt would happen) - an average of $250k seem normal to others on here?
Re:What It Costs to Run Let's Encrypt by walrus01 on Tuesday September 20, 2016 @01:56PM (#12541622)
people who seriously know how to code mission critical X.590 root CA PKI infrastructure are not cheap when you're looking at total benefits/compensation per head.
Re:What It Costs to Run Let's Encrypt by resmote on Tuesday September 20, 2016 @03:19PM (#12542430)
Creating a certificate is easy.
Re:What It Costs to Run Let's Encrypt by msinclair on Tuesday September 20, 2016 @03:45PM (#12542681)
It sure is! Just go to https://letsencrypt.org
Re:What It Costs to Run Let's Encrypt by freehunter on Tuesday September 20, 2016 @04:42PM (#12543210)
It's so easy, I have a cron job do it for me!

(That is a comment on how easy LetsEncrypt makes generating certificates, something I very much appreciate).

Re:What It Costs to Run Let's Encrypt by resmote on Tuesday September 20, 2016 @06:19PM (#12543868)
I agree, LetsEncrypt has done a great job. My original comment was snarky though accurate in a focused sense concerning the actual creation of a self-signed certificate (which can be easily cron jobbed). Of course I understand and appreciate that there is the whole negotiating the larger certificate scene, multiple companies, politics, etc. and that takes time, talent, effort and money. If LetsEncrypt had just come out from the start and said, "we can offer this service for X dollars" then it would have been more transparent.
Re:What It Costs to Run Let's Encrypt by saganus on Tuesday September 20, 2016 @03:49PM (#12542729)
Creating a certificate might be easy for someone with the proper skillset.

However creating an world-class organization that provides certificates as easily as LE does... definitely not.

Re:What It Costs to Run Let's Encrypt by msmith on Tuesday September 20, 2016 @08:17PM (#12544465)
How about creating hundreds of millions of certificates, developing a new standard protocol to interoperate with CAs, managing millions of registered users, managing certificate revocation, logging to certificate transparency logs, running OSCP responders, developing clients for a wide variety of platforms, and keeping up with the latest happenings in the crypto world?
Re:What It Costs to Run Let's Encrypt by jvehent on Tuesday September 20, 2016 @08:25PM (#12544492)
Have you tried writing that code from scratch without any libraries?
Re:What It Costs to Run Let's Encrypt by MustardTiger on Tuesday September 20, 2016 @02:10PM (#12541781)
>people who seriously know how to code mission critical X.590 root CA PKI infrastructure are not cheap

And they also aren't working at letsencrypt.

Re:What It Costs to Run Let's Encrypt by eropple on Tuesday September 20, 2016 @03:01PM (#12542281)
You've exhaustively enumerated those people, have you?

I know a couple folks at Let's Encrypt in passing and they are at the top of my list of folks I would want writing code for me if I needed to trust it with, if not my life, most stuff up to that point.

Re:What It Costs to Run Let's Encrypt by MustardTiger on Monday September 26, 2016 @07:33AM (#12580944)
Ok, but how little you value your life and how little you know about secure coding isn't useful to the rest of us.
Re:What It Costs to Run Let's Encrypt by Dylan16807 on Tuesday September 20, 2016 @04:25PM (#12543054)
I'm not saying they're right, but it's not hard to enumerate 3 or 8 people.
Re:What It Costs to Run Let's Encrypt by Mc_Big_G on Tuesday September 20, 2016 @02:01PM (#12541680)
"plus two full time staff that are employed by other entities (Mozilla and EFF)"

So, that's 10. $206k/employee The accepted amount of benefits & costs per employee is around 35%, so now we're at $134k/employee. This is not a high salary for an engineer in San Francisco. In fact, I'd say it's pretty damn low.

Re:What It Costs to Run Let's Encrypt by JshWright on Tuesday September 20, 2016 @02:05PM (#12541720)
LE isn't paying for the staff coming from Mozilla and EFF. The 2.06m is split across 8 people, not 10.

EDIT: Per a follow up tweet, the staffing is expected to increase to 10 in 2017 (presumably plus the two from third parties), so it is /10, not /8, but not for the reason you described.

Re:What It Costs to Run Let's Encrypt by Mc_Big_G on Tuesday September 20, 2016 @03:33PM (#12542574)
True, I misunderstood who was paying the salary. Even at 8 it's just a normal SF salary.
Re:What It Costs to Run Let's Encrypt by jaas on Tuesday September 20, 2016 @02:06PM (#12541730)
Going to repeat this comment here since people are doing the math: That's for ten employees, not eight. Salary + benefits.

Could have been more clear in the post initially, but we have eight employees now and have budgeted for ten in 2017. I added a sentence to the blog post to make this more clear.

Re:What It Costs to Run Let's Encrypt by cbhl on Tuesday September 20, 2016 @03:33PM (#12542568)
The pay discrepancy between teachers and programmers in San Francisco is really bad.

- School districts in SF and Oakland are short dozens of teachers -- imagine having sixty classrooms on the first day of school where there is no teacher. (e.g. http://www.sfgate.com/education/article/Bay-Area-school-dist... from last year)

- San Francisco is basically building "dorms" for teachers to give them a place to live: http://www.sfgate.com/bayarea/article/Mayor-and-SFUSD-have-a...

- Many teachers are leaving the area to go work in more affordable parts of the country: http://projects.sfchronicle.com/2016/teacher-pay/

Re:What It Costs to Run Let's Encrypt by wtbob on Tuesday September 20, 2016 @08:08PM (#12544435)
> The pay discrepancy between teachers and programmers in San Francisco is really bad.

I'd say, 'reflects the distribution of skills and positions available' rather than 'is really bad.' There is at least an order of magnitude more people capable of being minimally-acceptable public-school teachers than are capable of being minimally-acceptable Silicon Valley programmers.

Re:What It Costs to Run Let's Encrypt by zorked on Wednesday September 21, 2016 @04:36AM (#12546414)
Why is it a given that teachers "must" have low salaries? The sixty classrooms without teachers show otherwise.

SF teachers clearly need raises, and those can be funded by taxes from all those programmers that presumably benefit from having schools in their communities.

In fact there is no reason why teacher wages shouldn't keep up with the general state of the community where they live in.

Re:What It Costs to Run Let's Encrypt by wtbob on Wednesday September 21, 2016 @10:24AM (#12548394)
> Why is it a given that teachers "must" have low salaries?

I explained why: at least an order of magnitude more people are capable of meeting the minimal requirements to be teachers than are capable of meeting the minimal requirements to be developers, thus the former will always be less-well-paid than the latter.

> The sixty classrooms without teachers show otherwise.

They may not be due to pay but due to union rules. And, of course, even if teachers should make more that doesn't mean that they should make much

> In fact there is no reason why teacher wages shouldn't keep up with the general state of the community where they live in.

Are you saying that teachers should make a mean or median wage? I think that's a little silly, as it's hardly a profession requiring high innate talent and intensive study, unlike engineering, medicine, law, religion. Frankly, I think a welder or a plumber should be paid more than a teacher.

But it shouldn't matter what you & I think teachers should be paid: their wages should be set by the market, as should everyone's. That's the closest thing to fair we'll ever be able to get.

Re:What It Costs to Run Let's Encrypt by selllikesybok on Tuesday September 20, 2016 @10:00PM (#12544894)
That's a fascinating assumption.
Re:What It Costs to Run Let's Encrypt by vowelless on Tuesday September 20, 2016 @02:01PM (#12541678)
> an average of $250k seem normal to others on here?

For the work that they are doing (including the overhead of an employee -- health, benefits, taxes, etc), this seems cheap.

Re:What It Costs to Run Let's Encrypt by tonyhb on Tuesday September 20, 2016 @01:59PM (#12541664)
With things such as tax and healthcare it typically costs a business 1/4 to 1/3 more per employee than their wage, so each person here is perhaps on $180-200k assuming a completely even split. Considering this is deep crypto in San Francisco it's not too surprising.
Re:What It Costs to Run Let's Encrypt by lucb1e on Tuesday September 20, 2016 @05:57PM (#12543754)
> deep crypto

I'm sorry but this isn't "deep crypto". Very technical jobs that need a very good job done, since a lot of people depend on it? Sure. But they're not inventing anything new here. With all due respect, signing certificates is something you can grab from the openssl library, rewrite in a memory-safe language, have the community look at, and you're good to go.

I'm not saying I think 200k is too much. There are many reasons why it adds up to that much. I just think the technical requirements are not the reason for those wages.

Re:What It Costs to Run Let's Encrypt by GlennS on Tuesday September 20, 2016 @02:07PM (#12541746)
I suspect salaries for software developers in San Francisco are just a bit mad. The numbers floating around suggest more than twice what you'd get paid working on hedge fund software in London, which is in turn maybe 3 times more than an ordinary software developer elsewhere in the UK.

(If it makes you feel any better, I earn less than you working as a software developer in the UK.)

Re:What It Costs to Run Let's Encrypt by bbcbasic on Tuesday September 20, 2016 @08:20PM (#12544473)
The hedge fund and biz companies are not getting the VC money chasing the unicorns, whose crazy valuations are propped up by cheap money.
Re:What It Costs to Run Let's Encrypt by bkanber on Tuesday September 20, 2016 @03:05PM (#12542308)
Your 30k salary costs your employer around 50-60k (I don't know the deal with your benefits and payroll taxes and all that).

Rule of thumb in the US is that you add about 40% to a salary to get the total cost to the company to support that salary. And that's just taxes and basic benefits. Add a pension and 401k with matching, and it goes higher.

Re:What It Costs to Run Let's Encrypt by morgante on Tuesday September 20, 2016 @02:01PM (#12541684)
A fully loaded cost of ~$250k for a senior developer or SRE is not at all extraordinary. Especially when for something like Lets Encrypt you really want/need to hire experts.
Re:What It Costs to Run Let's Encrypt by Jtsummers on Tuesday September 20, 2016 @02:04PM (#12541716)
A note: You don't cost £30k to your employer, more likely 1.5-3x that. So say an employee costs a total of $250k, their pay could be anywhere between $80-180k with other compensation (retirement packages, health benefits) and overhead making up the rest. (the higher the multiple, the less efficient the company likely is, in this case I'd expect it would be closer to the 1.5x mark than the 3x mark)
Re:What It Costs to Run Let's Encrypt by ddavidn on Tuesday September 20, 2016 @01:59PM (#12541668)
Yes, that seems about right. I also do not get paid nearly that much, but the location (San Francisco), caliber of required employees and the overhead of benefits certainly adds up.
Re:What It Costs to Run Let's Encrypt by rch on Tuesday September 20, 2016 @01:57PM (#12541631)
I guess 20k a month per engineer by default, all in. That's probably out of date since I've been using the same number for over ten years now.
Re:What It Costs to Run Let's Encrypt by pyb on Tuesday September 20, 2016 @02:29PM (#12541977)
Programmers and teachers are not really paid well in the UK !
Re:What It Costs to Run Let's Encrypt by MustardTiger on Tuesday September 20, 2016 @02:09PM (#12541776)
No, it is absurdly high. They should be paying half that.