Re:Let's Encrypt tls-sni-01 disabled due to credible vulnera...
by stephenr on Wednesday January 10, 2018 @12:19PM
(#16116788)
> Very, very few ACME clients have a renewal mechanism that supports automatic fallback to a different challenge type. I know a couple and the only one I can think of is certbot, and even there that's only true if you use the standalone or manual plugin (the others don't support "--preferred-challenges").
And that's why I use and recommend certbot in standalone mode.
> You're changing goal posts.
No, I'm trying to explain my overall point.
> Part of knowing what you're doing as a developer is knowing that you either have sane defaults or stuff is going to break for a lot of people.
Right, but in this case Caddy doesn't have "defaults" that experienced dev's can change, it has "this is just how I fucking work".
> Are you implying anyone using the default instructions for certbot is inexperienced?
I'm suggesting that anyone whose sole research into how to use ACME generated certificates in production is "what's the quick start for certbot say?" is inexperienced.
> so they're better off with a "managed" solution like Caddy.
Managed, except that they have to keep intervening or updating to a new build to restore functionality because it manages things like a drunk on a snow mobile.
> It's just silly to go on about how terrible Caddy is when they happen to have a mitigation in place.
Caddy requires a 'mitigation'. Certbot can and is deployed with a configuration that doesn't require any mitigation. It's just silly to keep claiming Caddy's approach is "the best" when you require a mitigation.
And that's why I use and recommend certbot in standalone mode.
> You're changing goal posts.
No, I'm trying to explain my overall point.
> Part of knowing what you're doing as a developer is knowing that you either have sane defaults or stuff is going to break for a lot of people.
Right, but in this case Caddy doesn't have "defaults" that experienced dev's can change, it has "this is just how I fucking work".
> Are you implying anyone using the default instructions for certbot is inexperienced?
I'm suggesting that anyone whose sole research into how to use ACME generated certificates in production is "what's the quick start for certbot say?" is inexperienced.
> so they're better off with a "managed" solution like Caddy.
Managed, except that they have to keep intervening or updating to a new build to restore functionality because it manages things like a drunk on a snow mobile.
> It's just silly to go on about how terrible Caddy is when they happen to have a mitigation in place.
Caddy requires a 'mitigation'. Certbot can and is deployed with a configuration that doesn't require any mitigation. It's just silly to keep claiming Caddy's approach is "the best" when you require a mitigation.