News for hackers. Stuff that matters.
Re:Automate Public Certificates Lifecycle Management via RFC... by lights0123 on Monday April 11, 2022 @11:20PM (#30998220)
> only for Google Cloud customers

for which there's no payment required as far as I can tell—just creating a Google Cloud account.

Re:Automate Public Certificates Lifecycle Management via RFC... by ipaddr on Monday April 11, 2022 @11:58PM (#30998436)
Aside from providing a credit card that you give permission for google to hold and make transactions against.
Re:Automate Public Certificates Lifecycle Management via RFC... by matyasrichter on Tuesday April 12, 2022 @03:16AM (#30999607)
Don't be ridiculous. Google isn't a scam company that would charge your card for no reason.
Re:Automate Public Certificates Lifecycle Management via RFC... by zippydonk on Tuesday April 12, 2022 @03:18AM (#30999626)
You’ve never put your own credit card on public cloud, I take it? Random, mysterious charges are practically a sport.
Re:Automate Public Certificates Lifecycle Management via RFC... by csnweb on Tuesday April 12, 2022 @03:35AM (#30999705)
I did with several public cloud providers, including google cloud. Didn’t had any charges for something I didn’t order once.
Re:Automate Public Certificates Lifecycle Management via RFC... by michaelt on Tuesday April 12, 2022 @06:14AM (#31000671)
But what if I were to lend my old android tablet to my visiting 4-year-old nephew, and I found they'd used my linked credit card to spend $500 on lootboxes in whalecraft?

Google is pretty famous for their nonexistent customer support, so I can't expect satisfaction there. And a chargeback would risk getting my entire account blocked.

Re:Automate Public Certificates Lifecycle Management via RFC... by magicalist on Tuesday April 12, 2022 @09:02AM (#31002069)
> But what if I were to lend my old android tablet to my visiting 4-year-old nephew, and I found they'd used my linked credit card to spend $500 on lootboxes in whalecraft?

Google cloud billing doesn't use google pay, so...nothing?

Re:Automate Public Certificates Lifecycle Management via RFC... by ipaddr on Tuesday April 12, 2022 @11:39AM (#31004136)
I won't wade into if Google is a scam company, scam companies usually offer a support option they ignore which is more than can be said about google.

You gave them permission to bill for a reason. They decide the reason and amount and you pay. Seems risky without support.

Re:Automate Public Certificates Lifecycle Management via RFC... by neiman on Tuesday April 12, 2022 @12:37AM (#30998673)
For me creating an account is a sort of payment.
Re:Automate Public Certificates Lifecycle Management via RFC... by kerng on Tuesday April 12, 2022 @11:52AM (#31004315)
And the risk that Google AI decides you are not worthy, your account is deactivated and you loose access to this in the same second.

Centralization with no accountability besides blaming things on AI is problematic.

Re:Automate Public Certificates Lifecycle Management via RFC... by Spivak on Tuesday April 12, 2022 @12:11PM (#31004587)
I mean sure but you have an account with Let's Encrypt too which can be arbitrarily banned. LE has even less accountability.
Re:Automate Public Certificates Lifecycle Management via RFC... by kerng on Tuesday April 12, 2022 @04:29PM (#31007860)
Fair point, but it wouldn't be banned because of some other unrelated activity. Much more isolated implications that way.
Re:Automate Public Certificates Lifecycle Management via RFC... by mlindner on Tuesday April 12, 2022 @12:23AM (#30998602)
For now.

They've changed free things to not free things many times in the past. Or started restricting features once it gets popular. Don't depend on it for anything you want to last a while.

Re:Automate Public Certificates Lifecycle Management via RFC... by brazzledazzle on Tuesday April 12, 2022 @12:48AM (#30998735)
I’m certainly overlooking something but the risk seems small since it uses an open standard. You should be able to fallback to another acme provider right?
Re:Automate Public Certificates Lifecycle Management via RFC... by throwaway81523 on Tuesday April 12, 2022 @01:02AM (#30998817)
More like: first they become the dominant acme provider, then the other ones go away so they are the only one left, and then they have you where they want you.
Re:Automate Public Certificates Lifecycle Management via RFC... by tobltobs on Tuesday April 12, 2022 @02:24AM (#30999290)
They have you where they want, you are willing to pay, ... but the close down the service anyway with a three months notice.
Re:Automate Public Certificates Lifecycle Management via RFC... by pdkl95 on Tuesday April 12, 2022 @05:19AM (#31000334)
> first they become the dominant acme provider

The traditional way a big tech company becomes the dominant provider is to embrace an open interoperable protocol to minimize the friction of switching from another provider. Later, when they have captured enough of the market, they extend the protocol to gradually reduce the de facto interoperability with other providers to increase the friction of switching to any other provider.

https://en.wikipedia.org/wiki/Embrace%2C_extend%2C_and_extin...

Re:Automate Public Certificates Lifecycle Management via RFC... by danielheath on Tuesday April 12, 2022 @12:59AM (#30998804)
Yeah, but... given there are other ACME providers, why would I choose one from the a company with googles reputation for sunsetting products?
Re:Automate Public Certificates Lifecycle Management via RFC... by minerva23 on Tuesday April 12, 2022 @01:08AM (#30998847)
As a Let’s Encrypt user and fan, I can answer this.

LE is great, but their SLO is significantly below our customers’ expectations. For us, Google wouldn’t replace LE, it would supplement LE for higher reliability.

Seeing more providers conforming to ACME at a price point of “free” is great for the ecosystem.

Re:Automate Public Certificates Lifecycle Management via RFC... by tehbeard on Tuesday April 12, 2022 @03:54AM (#30999797)
Is this with provisioning many new certs?

The recommended renewal cycle gives you a 30 day lead on failure becoming a problem, plenty of time for multiple retries or recovery processes to use an alternate.

The only issues I've ran into, have stemmed from DNS for wildcard certs, where a client's DNS provider is... pretty crap about updating records despite low ttls being set.

Re:Automate Public Certificates Lifecycle Management via RFC... by minerva23 on Tuesday April 12, 2022 @10:22AM (#31003133)
It’s a web hosting business. New customers want effortless free TLS asap. We get customers who routinely create new sites who come to expect fast provisioning.
Re:Automate Public Certificates Lifecycle Management via RFC... by michaelt on Tuesday April 12, 2022 @06:19AM (#31000701)
Some people on the cloud like to issue a certificate per machine, so no ACME = no new VMs.
Re:Automate Public Certificates Lifecycle Management via RFC... by jwandborg on Tuesday April 12, 2022 @03:57AM (#30999822)
Does Google Cloud also have that reputation? I've seen renames and well-motivated deprecations, but not the Google Graveyard kind of events.
Re:Automate Public Certificates Lifecycle Management via RFC... by danielheath on Tuesday April 12, 2022 @09:17AM (#31002253)
"This API you use has changed, you have 6 months to update your code" is not unheard of.

On AWS, the equivalent is "We no longer recommend this, and it's not visible in the AWS console unless you are already using it or have asked support to enable it, but it will keep working indefinitely".

Re:Automate Public Certificates Lifecycle Management via RFC... by winternett on Tuesday April 12, 2022 @01:16AM (#30998887)
Its probably already worked into the hosting bill somehow anyway... There are numerous places to hide the cost in any CSP bill.

Even traditional host providers are raising their costs for the same mysterious reasons, although hardware costs are historically trending lower over time.

Re:Automate Public Certificates Lifecycle Management via RFC... by ithkuil on Tuesday April 12, 2022 @03:00AM (#30999506)
> hide the cost ...

That's one way to put it.

Solving your customer's problems and making it more likely they will keep using your main offering is another way to put it.

Re:Automate Public Certificates Lifecycle Management via RFC... by mcpherrinm on Monday April 11, 2022 @11:41PM (#30998332)
I think you do have to have a payment card on file, even if there’s no payments to be made.
Re:Automate Public Certificates Lifecycle Management via RFC... by onion2k on Tuesday April 12, 2022 @12:42AM (#30998707)
... which is how they connect your account to who you are (or who you work for), so they can extract value from your social graph instead.

As the adage goes, if it's free you are the product, not the customer.

Re:Automate Public Certificates Lifecycle Management via RFC... by derefr on Tuesday April 12, 2022 @01:41AM (#30999010)
GCP, AWS, other IaaS providers, and more generally, any "post-paid" service company, needs your credit card, because the services these providers provide allow users to generate costs that can only be measured after-the-fact; and where those costs greatly exceed the free-plan limits, the provider wants to be able to pass those costs to the user.

As well, post-paid providers rely on credit-card billing information to deduplicate/KYC users. Without this sort of information, an, er, "ingenious" user could just sign up for a million free-tier accounts and lash them together into a quota-evading resource-sucking behemoth.

Re:Automate Public Certificates Lifecycle Management via RFC... by onion2k on Tuesday April 12, 2022 @03:15AM (#30999600)
Sure. All that is true. And the credit card number ties your free GCE account to your profile with credit agencies that ad companies use to improve their targeting. It's not one thing or the other. It's both.
Re:Automate Public Certificates Lifecycle Management via RFC... by derefr on Tuesday April 12, 2022 @12:36PM (#31004946)
Do you think it's really that valuable for Google to spend engineering hours on an ad-targeting integration that will only improve targeting for maybe ~100k users at most?

And probably far less, actually. As many GCP users as there might be in the world, most of them are IT staff working for some-or-another enterprise; where that enterprise only has a single GCP billing-account administrator. Nobody else in the enterprise has their card on file. (And that billing-account administrator's card-on-file is just a corporate credit card, that tells you what the corporation buys, but tells you nothing about the individual. And their email is just a group/alias — billing@ or somesuch. Impossible to log into; impossible to browse the web as; no way to target ads at.)

You'd think the long tail of individual accounts could have more value, but those are the same users who GCP is least interested in recruiting to their platform, and the ones whose entered data is least trustworthy, because of all the spammers and crypto-miners attempting to use stolen credit cards to pay for service. You want to bind some poor random Joe's card-hubbed ad-profile to a spoke created by the person who stole their identity? That's negative average ad-targeting ROI!

Re:Automate Public Certificates Lifecycle Management via RFC... by upsidesinclude on Tuesday April 12, 2022 @12:00AM (#30998449)
No payment in cash. If it's Google, you're paying

Edot: Absolutely zero surprise this is getting voted to nowhere. CHEERS

Re:Automate Public Certificates Lifecycle Management via RFC... by judge2020 on Tuesday April 12, 2022 @12:11AM (#30998531)
They don't use GCP data whatsoever for ads. Thinking they'd peep into cloud customer data for the advertising boost (besides the small data point 'visited hostname console.cloud.google.com') is just as irrational as thinking Amazon would leverage AWS to look into Walmarts' suppliers' data to gain a competitive advantage.
Re:Automate Public Certificates Lifecycle Management via RFC... by RKearney on Tuesday April 12, 2022 @12:31AM (#30998644)
Unless something has changed, Walmart does not want its suppliers to use AWS to mitigate that very risk.

https://www.cnbc.com/2017/06/21/wal-mart-is-reportedly-telli...

Re:Automate Public Certificates Lifecycle Management via RFC... by judge2020 on Tuesday April 12, 2022 @01:07AM (#30998844)
That’s my point, it’s irrational to think that. Amazon has so little to gain by doing that compared to the absolute mass of customers that would be migrated off of aws within a few years of such a scandal.
Re:Automate Public Certificates Lifecycle Management via RFC... by exikyut on Tuesday April 12, 2022 @04:05AM (#30999876)
Counterpoint: at the same time, it's something you can do and not do at the same time - everything in AWS is virtualized (save for $$$$$ physical hosts almost nobody uses) and it's not like it's impossible to undetectably analyse/monitor running VMs in realtime.

So you can both do this (silently) and "not" do it (because it's impossible to detect), and it would thus be stupid to not actually do it because it's free data.

Zooming out I think this and the opposite view are equally possible. Just articulating what this perspective looks like.

Re:Automate Public Certificates Lifecycle Management via RFC... by antonvs on Tuesday April 12, 2022 @02:09AM (#30999192)
That was because Amazon is a competitor to Walmart. It's not a risk that would apply to most companies. And it's probably not a very realistic risk, either. Walmart may have just been trying to hurt a competitor.
Re:Automate Public Certificates Lifecycle Management via RFC... by RL_Quine on Tuesday April 12, 2022 @12:17AM (#30998568)
Expecting good will of Google at this point seems sort of silly given repeating pattern of betrayal of trust.
Re:Automate Public Certificates Lifecycle Management via RFC... by antonvs on Tuesday April 12, 2022 @02:27AM (#30999311)
Google Cloud is very different from Google's consumer product and advertising side. It has revenues of $13 billion which all comes directly from customers paying them money, not indirectly via advertising etc. Larger companies sign agreements with Google that cover what it does and doesn't promise, and enterprise companies are their highest priority target market. Google Cloud has its own CEO, Thomas Kurian, previously president of product development at Oracle, who was at Oracle for over 20 years.

The pattern you're referring to really doesn't apply to this business. If anything it's the opposite: Kurian's goal is to make Gcloud more like Oracle, and part of that involves making sure enterprise customers don't need to be skittish about the kinds of concerns you seem to be thinking of.

Re:Automate Public Certificates Lifecycle Management via RFC... by woadwarrior01 on Tuesday April 12, 2022 @02:42AM (#30999406)
It's still losing money[1], which means that it's still cross subsidized by the ads business.

[1]: https://techcrunch.com/2022/02/02/with-a-22b-run-rate-does-i...

Re:Automate Public Certificates Lifecycle Management via RFC... by antonvs on Tuesday April 12, 2022 @03:03AM (#30999534)
Yes, but that's because they're investing heavily to grow the business, as that article explains, which is hugely strategic for Google.

The fact that the current run rate is $22bn compared to the $13bn revenue in 2020 suggests that they're succeeding - that's some pretty significant growth.

It's a completely different business model from the consumer/ad side, and confusing the two is a mistake.

Re:Automate Public Certificates Lifecycle Management via RFC... by woadwarrior01 on Tuesday April 12, 2022 @04:37AM (#31000061)
How do you square it with the fact that AWS is Amazon's most profitable division and is still arguably is innovating at a faster pace?

The counterfactual question one should be asking here is: Would gCloud exist if it were an independent company and not a bet?

Full disclosure: Xoogler here.

Re:Automate Public Certificates Lifecycle Management via RFC... by antonvs on Wednesday April 13, 2022 @02:56AM (#31011901)
They're at different points in their lifecycle and have very different revenues and budgets. Amazon itself was famously unprofitable for many years, for exactly the same reason Gcloud is now: to grow the business as fast as possible.

Independent companies like that are funded by investors for years, all the time. The cloud market is expected to hit close to a trillion dollars by 2026. Gcloud doesn't have to take away a single existing AWS customer to win big.

> Xoogler

So what's your take? You think Google might just decide to shut down a fast-growing business with $13-20bn revenues and huge upside potential as if it were a free product like Reader? Or you think they somehow aren't able to make it profitable so will just give up?

Neither of those are really how these things work.

Re:Automate Public Certificates Lifecycle Management via RFC... by woadwarrior01 on Friday April 15, 2022 @05:26PM (#31046052)
> So what's your take?

All I'm saying is that this business isn't a monopoly like search or a near duopoly like ads. The competition is stiff. There are two players who are well ahead of them and the ones behind aren't sitting still. I don't expect any miracles with run of the mill management consulting leadership at the helm.

Re:Automate Public Certificates Lifecycle Management via RFC... by brippalcharrid on Tuesday April 12, 2022 @06:26AM (#31000748)
I'm sure they're just "using insights from their operational infrastructure to improve the services they provide to customers". Which is still something that all but the most skeptical of engineers and managers would fail to see a potential problem with.
Re:Automate Public Certificates Lifecycle Management via RFC... by onion2k on Tuesday April 12, 2022 @12:45AM (#30998721)
besides the small data point 'visited hostname console.cloud.google.com'

That's a pretty huge data point though. It puts you into a very specific market segment.