Re:Let's Encrypt is 10 years old now
by michaelt on Wednesday November 20, 2024 @08:23AM
(#42193727)
A daily certbot run won't protect you if the CA discovers the problem at 2pm (starting the 24 hour revocation timer) but they only have a fix rolled out by 6pm.
Anyone whose certbot run was between 2pm and 6pm would get their cert revoked the next day at 2pm anyway - even if it was only issued 18 hours ago.
There's also a higher level question: Is this the web we want to be building? One where every site and service has to apply for permission to continue existing every 24 hours? Do we want a web where the barrier to entry for hosting is a round-the-clock ops team, complete with holiday cover? And if you don't have that, you should be using Facebook or Twitter instead?
Anyone whose certbot run was between 2pm and 6pm would get their cert revoked the next day at 2pm anyway - even if it was only issued 18 hours ago.
There's also a higher level question: Is this the web we want to be building? One where every site and service has to apply for permission to continue existing every 24 hours? Do we want a web where the barrier to entry for hosting is a round-the-clock ops team, complete with holiday cover? And if you don't have that, you should be using Facebook or Twitter instead?