An Ex-facebook ml engineer who doesn't know what ssl is and takes pride in not having to learn it?

Not sure it's a downside/upside thing. It might shed light on the types of people who get hired at facebook.

It's perfectly reasonable for someone to be into programming and not want to have to care about the details of setting up a networking stack.

Ok I get not wanting to pick on the guy, but is that really reasonable? Engineering is about solving problems by designing/implementing systems. The more you know about the system(s) you're working with, the better the solutions you can build. Even if you're "just" working at a high level and maximally specialized to a single niche, not knowing how the underlying parts work will really limit you.

Pick the brain of any accomplished engineer, and you'll quickly see that the technical knowledge they use to write code on a day to day basis is only the tip of the iceberg.

It's not reasonable to expect everyone to know everything all the time, but I don't agree people should be aspiring to just know the bare minimum either. Mediocrity is like gravity: if you don't (at least occasionally) aim higher, your trajectory will be lower than you want.

Right obviously very few people will be deep experts on the nitty gritty details of any particular thing, but it's weird to work with computers and not have a broad high-level understanding of something as crucial as TLS and PKI.

Not understanding something is to be expected but being proud you don't have to goes against the core of what a programmer is.. curious.

"I don't care to" != "I'm proud I haven't"

You don't know why they haven't taken the time to learn. At least they know enough to know they need an SSL cert. Should I not buckle up in a car if I don't understand the mechanics of how the buckle snaps together?

I don't understand why you're harping on this person for this.

The full quote was:

"frankly I don't care to know the details"

I take issue with that statement not the person. The statement was honest and matter of fact.

Few know how SSLs work, few have time or opportunity or even desire to learn it. Not 'wanting' to understand the details goes against what I would expect. A programmer tries to/needs to understand how the world works. Not wanting to understand the entire stack is a new concept to me.

> Not wanting to understand the entire stack is a new concept to me.

Then I'd suggest that your experience about the world, and about people in general, is severely lacking.

There aren't enough hours in a day or years in a life to learn everything, so we have to be selective.

Do you know how CPUs work, down to the various functional units and pipeline stages and how they work together? Can you explain to me how transistors work on an electrochemical level? Can you explain how silicon wafers are fabricated? Hell, I took those classes in college as a part of my EE degree, and I can't really remember it well enough to explain without cheating and looking at Wikipedia. (And even then...)

And guess what? That's just fine. I have no need or desire to dive that deeply back into that stuff.

Why should the minutiae around TLS certs be any different? I do know how TLS cert provisioning works, and to be honest, it's boring and tedious. And I do it so infrequently that I have to look up a tutorial every time I do it. It's just not worth keeping in my head. If I could use LE for everything, and never try to remember the right `openssl req` command ever again, that would be great.

> A programmer tries to/needs to understand how the world works.

No, a programmer is someone who solves problems with code. How they do it, and what types of knowledge they pursue, runs the entire gamut of possibilities.

Bottom line: knowing technical minutiae doesn't make you cool or special or better than other people. It just makes you someone who's interested in that stuff, or someone who needs to understand it as a part of work they do. Let's not elevate it to something it's not.

Are programmers losing that childhood curiosity for how things work? Do programmers even value that anymore? Should that be the filter employers use to select candidates vs leetcode?

People may think they are Cool or special for millions of reasons (like not knowing what ssl is for example).

Who says they've lost the curiosity? What if all of their programming effort and energy is put into whatever the website is for? Why should they shift their focus over to learning all about SSL when that's not the point of whatever the project is and it will suck up too much time?

I could absolutely be wrong about that reasoning, though, but that's my point - we don't know why, so why assume a negative and then lean into that?

Or maybe we should just avoid judging people based on what they do and don't think is worth their time learning, especially when all we know about them is a previous job title and a short message on an internet message board?

I mean, c'mon, it takes quite a bit of arrogance to condemn someone for some little facet of their life when you know next to nothing about them.

I agree somewhat, but this is about programming in the web stack. SSL should be familiar, we aren't speaking about general programming here.

I think there are a lot of perfectly good programmers who work at the level of the web stack, but couldn't set up a web server with TLS to save their life. There's nothing wrong with that, and suggesting that there is, is just a form of technology elitism and gatekeeping.

This isn't about being able to. I've love to setup machine learning but lack the understanding. It's about taking pride in not having to learn.. taking pride in not having to understand how things work.

Technology shouldn't be a blackbox and shouldn't be celebrated as such.

Sorry, we're giving an ML engineer grief for not knowing much about SSL? Should we tease dentists for not knowing how to grow oranges, too?

Not for not knowing but for being proud that they don't have to.

That's the entire point of LetsEncrypt; assist people who know they need an SSL cert, but don't know much about SSL.

As someone that supports Let's Encrypt's efforts and playing devil's advocate, I imagine a downside is that the bar is lowered and nefarious websites can easily get SSL-equipped channels compared to the high paywall of prior.

Before Let's Encrypt there were all kinds of bullshit CAs that would distribute secure sites "seals", and lie all over the internet on how those meant anything.

All of that noise is gone now. That makes the internet much safer.

Commercial CAs verify exactly two things: Administrative control over a domain name and a working credit card number.

Let’s Encrypt only gets rid of the latter, and given that fraudsters able to spoof the former can probably spare the $10 for the latter, I‘d argue that this is a good thing.

A plain domain validated certificate cost like $10 for a year or two. So roughly the same cost as the domain name. Hardly a "high paywall".

It meant a paper trail via CC payments (though fraudsters were likely to use stolen CCs, and they probably needed a CC to buy the domain name in the first place). But yeah it's basically not fundamentally different.

Don't most domains cost $5 or less? I think it's pretty outrageous to have to spend 2x (or more) of the domain name cost to secure connections to it.

Not sure where you found that figure but most domains definitely don’t cost 5 or less. Most domains are 10+ in my experience.

What is the downside of this?

My guess is a misunderstanding of how easy it is to get a credit card to make a payment. This hasn't gotten any easier, so there truly is no downside at this point, unless people automatically think a SSL means a site is trustworthy. I think that's just education, and is likely to come into public consciousness the longer secure sites are pushed as the default.

Downside existed before Let's Encrypt, it just got amplified with it.

General public does not differentiate between the SSL certificate validation level.

Let's Encrypt provides domain validation certificates, which only validates that one owns the domain in question.

There is another level - Organization Validation SSL certificates, which involves manual checking that this is the legal entity it claims to be. I would expect the financial institutions to use this kind of certificates to avoid phishing, but sadly I've seen some of them use Let's Encrypt.

Browsers don't differentiate between the SSL certificate validation level. Because it has been shown that the higher validation levels aren't actually significantly more secure, so the distinction is pointless.

I don't think this is an issue with LE or the implementation. Maybe we need different policies for such organizations, but this is for sure not a LE issue

OV certs are pointless and that's why nobody uses them. Anyone can pay $30 to register a business with the same name in a different state.