I really don’t get this opinion. The internet isn’t secure — the public internet is by definition an untrusted network assumed to be malicious and openly hostile. There is no safe way to use unencrypted connections on the public internet. None. Doesn’t matter if you are a good admin on your local network, doesn’t matter if you have a good ISP, you have zero guarantee the network path your packets will take and who has the opportunity to observe and modify them.

Look I get it. It’s no fun when the whole class is punished because because bad actors exist. And it’s no fun when someone pressures you into doing something for the benefit of others but not yourself. But the internet is really really different from 20 years ago.

This is actually one of the utilities of a heavy industry player: they can adopt a best practice to impose it on smaller players.

... and HTTPS on the public internet is a best practice. Your ISP should have no business sniffing your web traffic.

HTTPS is such a scam. It's an obvious ploy to conquer the last corners of the web not yet under corporate control. But apparently calling it "Let's Encrypt" instead of "Let's make your website technically dependent on a Google/Mozilla/Amazon/Facebook-controlled service" is enough to fool people.

It's totally obvious to me that, once HTTPS is mandatory, the next step will be that Let's Encrypt will stop supporting websites that disobey their "content policy" or whatever. It will follow the usual course. First outright illegal things. Then today's "deadly sins" like racism. Then unpopular politicians. And then, whatever they want.

You are literally making a random organization into the censor of the web.

While there are a finite number of trust providers in the HTTPS signed certificate model, "Let's Encrypt" isn't the only one.

But, yes, HTTPS is a trust-rooted security model. It's hypothetically possible to have every cert provider decide you're not trusted. That's kind of in the category of "It's hypothetically possible to have every DNS provider decide you're not trusted" though.

If this is a concern, the solution is probably to come up with an HTTPS modification that allows for decentralized trust, not to set up the average use case of the web to "The user is trusting every machine between their client and the server to be reading their traffic and not acting maliciously on it." Tradeoffs, right?

And you can't just found a new SSL provider. The woke browsers need to accept its certificates.

In other words, something like the substack.com escape from the mainstream media won't work.