News for hackers. Stuff that matters.
Re:Let’s Encrypt in the spotlight by hoopyfrood on Monday July 03, 2017 @11:30PM (#14693333)
Every time LetsEncrypt is brought up I am reminded of "if it's for free, You are the product". In this case it is one's servers. A single company has a hand on the pulse and runs software on your server in exchange for continuous "convenience". I am still NOT buying in, diversifying SSL certs from reputable companies with 12 (or sometimes 13) months validity are still ok for me in 2017.
Re:Let’s Encrypt in the spotlight by jaas on Tuesday July 04, 2017 @12:26AM (#14693544)
I don't really understand what you're implying but here's some information that might help.

Let's Encrypt is a non-profit service and we don't use your data for our benefit. We work hard to collect and retain as little of your data as possible.

We do not require you to run software from us on your server. You can use any client you want. In fact, we don't even produce client software -- all Let's Encrypt clients are built and maintained by our community (the client we often recommend, Certbot, is an EFF project).

Re:Let’s Encrypt in the spotlight by duskwuff on Monday July 03, 2017 @11:35PM (#14693355)
This seems a little tin-foil-hatty. The only information which Let's Encrypt receives is the domain name that the certificate is for (which is public anyways for any CA implementing certificate transparency). The Certbot software is open-source and easily verifiable, and there's multiple independently developed alternatives available if you don't like it.
Re:Let’s Encrypt in the spotlight by schoen on Tuesday July 04, 2017 @12:20AM (#14693523)
Certbot developer here.

If you don't like Certbot, we definitely encourage you to use one of the many other implementations:

https://community.letsencrypt.org/t/list-of-client-implement...

Some of these are much lighter weight than Certbot and have many fewer dependencies. You can also take your pick of what language they are written in and how they are installed on your system.

You're also welcome to write your own client that speaks the ACME protocol. Let's Encrypt is near to rolling out an API endpoint that will speak the IETF-standardized version of ACME, developed through an open standards process and in consultation with other implementers.

I know that some people have said they don't like running a large new application as root, even when it's open source. So, please have a look at some of the other clients and see if one of them strikes your fancy!

Let's Encrypt's operational funding is thanks to these entities

https://letsencrypt.org/sponsors/

which view the service as worthwhile and important and have chosen to donate funds to support its operation. The organization is overseen by these people

https://letsencrypt.org/isrg/

In this model there is no need to charge users for certificates or try to indirectly monetize the use of the service, although users are very welcome to donate if they find the service useful, and Let's Encrypt may be more sustainable if some users choose to do so.

Re:Let’s Encrypt in the spotlight by IronBacon on Tuesday July 04, 2017 @04:05AM (#14694318)
> I know that some people have said they don't like running a large new application as root, even when it's open source.

Certbot could be configured to run without root with little effort, at least the part exposed to the web that was my concern.

Re:Let’s Encrypt in the spotlight by wereHamster on Tuesday July 04, 2017 @12:11AM (#14693495)
> runs software on your server

letsencrypt doesn't require you to run anything on your server.

Re:Let’s Encrypt in the spotlight by sliken on Tuesday July 04, 2017 @02:56AM (#14694049)
Cronjob != anything?
Re:Let’s Encrypt in the spotlight by zegl on Tuesday July 04, 2017 @03:02AM (#14694075)
They are not running anything on the server, you can implement your own renewal software with their protocols.
Re:Let’s Encrypt in the spotlight by technion on Tuesday July 04, 2017 @12:17AM (#14693515)
I don't like the idea of a monopoly either.

But the issue here is what is "reputable". Most of (all?) the major commercial suppliers that I am aware of have been involved in major incidents.

The only reputable supplier I could name, is LE.

Re:Let’s Encrypt in the spotlight by enigmabridge on Tuesday July 04, 2017 @06:17AM (#14694851)
I agree, but you could say that any of major issuers was reputable 2, 5, ... years into issuing certificates. Being new doesn't mean you're better long term.

But I personally like the fact there's much less commercial pressure on LE - for the time being at least.