Let's Encrypt is 10 years old now

Re:Let's Encrypt is 10 years old now by account42 on Wednesday November 20, 2024 @06:27AM (#42192864)

The situation is more akin to demanding that pedestrians should be prevented from crossing the road at all cost because a malicious driver could ignore all red lights. And of course banning pedestrias ins't enough. After all, motorcyles are also pretty unsafe so we ban those too. But you see someone could also be pointing a bazooka at the road so then we require all cars to have sufficient armor plating in order to be allowed on the road. That is, before realizing that portable nukes exists and you never know who has one. We don't do that. Instead we develop specific solutions (e.g. an over/underpass for high risk intersections, walls for highways) where they are actually needed without loosing sight of the unreasonable cost (not just monetary) that demanding zero risk would impose.

[ Parent | on HN ]

Re:Let's Encrypt is 10 years old now by ozim on Wednesday November 20, 2024 @09:43AM (#42194300)

For me TLS is an overpass - yeah it costs more to build it, pedestrians have to climb the stairs to get on the other side but it is worth it. Then hopefully we have Let's Encrypt that can be an elevator/lift so pedestrians don't have to climb the stairs.

But that analogy of course runs dry rather quick because you can look both ways when crossing street - on the internet as I mentioned you cannot control where data flows and bad actors already proven that they are doing so.

This is why it is not like overpass that you can build where the need is - because for internet traffic the need is everywhere.

[ Parent | on HN ]

Re:Let's Encrypt is 10 years old now by lcnPylGDnU4H9OF on Wednesday November 20, 2024 @05:10PM (#42198633)

> The situation is more akin to demanding that pedestrians should be prevented from crossing the road at all cost because a malicious driver could ignore all red lights.

Only if you are talking about actual events in which this is happening as a matter of course. Because that's what it is when ISPs inject ads into plain-text HTTP traffic: a matter of course. It's a bit more like saying that we don't have a way to effectively enforce our laws against maliciously reckless driving so we install a series of speed bumps on the road (it's still not quite the same thing because it doesn't make the reckless driving impossible but it does increase the cost).

But it's not like we're talking about agreeable activity here, anyway. This particular case against TLS sounds like a case that favors criticizing an imperfect solution to widespread negative behavior over criticizing the negative behavior. It seems reasonable to look at the speed bumps (which one may or may not find distasteful) and curse the reckless behavior of those who incentivized their construction.

[ Parent | on HN ]