14 ms·

I'm not sure that's a good thing

by kache_ 4y ago

barbazoo 4y ago
What's a downside of that?
- ipaddr 4y ago
  An Ex-facebook ml engineer who doesn't know what ssl is and takes pride in not having to learn it? Not sure it's a downside/upside thing. It might shed light on the types of people who get hired at facebook.
  - kevinh 4y ago
    It's perfectly reasonable for someone to be into programming and not want to have to care about the details of setting up a networking stack.
    - bogwog 4y ago
      Ok I get not wanting to pick on the guy, but is that really reasonable? Engineering is about solving problems by designing/implementing systems. The more you know about the system(s) you're working with, the better the solutions you can build. Even if you're "just" working at a high level and maximally specialized to a single niche, not knowing how the underlying parts work will really limit you. Pick the brain of any accomplished engineer, and you'll quickly see that the technical knowledge they use to write code on a day to day basis is only the tip of the iceberg. It's not reasonable to expect everyone to know everything all the time, but I don't agree people should be aspiring to just know the bare minimum either. Mediocrity is like gravity: if you don't (at least occasionally) aim higher, your trajectory will be lower than you want.
      - TillE 4y ago
        Right obviously very few people will be deep experts on the nitty gritty details of any particular thing, but it's weird to work with computers and not have a broad high-level understanding of something as crucial as TLS and PKI.
        ipaddr 4y ago
        Not understanding something is to be expected but being proud you don't have to goes against the core of what a programmer is.. curious.
        jjulius 4y ago
        "I don't care to" != "I'm proud I haven't" You don't know why they haven't taken the time to learn. At least they know enough to know they need an SSL cert. Should I not buckle up in a car if I don't understand the mechanics of how the buckle snaps together? I don't understand why you're harping on this person for this.
        ipaddr 4y ago
        The full quote was: "frankly I don't care to know the details" I take issue with that statement not the person. The statement was honest and matter of fact. Few know how SSLs work, few have time or opportunity or even desire to learn it. Not 'wanting' to understand the details goes against what I would expect. A programmer tries to/needs to understand how the world works. Not wanting to understand the entire stack is a new concept to me.
        kelnos 4y ago
        > Not wanting to understand the entire stack is a new concept to me. Then I'd suggest that your experience about the world, and about people in general, is severely lacking. There aren't enough hours in a day or years in a life to learn everything, so we have to be selective. Do you know how CPUs work, down to the various functional units and pipeline stages and how they work together? Can you explain to me how transistors work on an electrochemical level? Can you explain how silicon wafers are fabricated? Hell, I took those classes in college as a part of my EE degree, and I can't really remember it well enough to explain without cheating and looking at Wikipedia. (And even then...) And guess what? That's just fine. I have no need or desire to dive that deeply back into that stuff. Why should the minutiae around TLS certs be any different? I do know how TLS cert provisioning works, and to be honest, it's boring and tedious. And I do it so infrequently that I have to look up a tutorial every time I do it. It's just not worth keeping in my head. If I could use LE for everything, and never try to remember the right `openssl req` command ever again, that would be great. > A programmer tries to/needs to understand how the world works. No, a programmer is someone who solves problems with code. How they do it, and what types of knowledge they pursue, runs the entire gamut of possibilities. Bottom line: knowing technical minutiae doesn't make you cool or special or better than other people. It just makes you someone who's interested in that stuff, or someone who needs to understand it as a part of work they do. Let's not elevate it to something it's not.
      - kelnos 4y ago
        Or maybe we should just avoid judging people based on what they do and don't think is worth their time learning, especially when all we know about them is a previous job title and a short message on an internet message board? I mean, c'mon, it takes quite a bit of arrogance to condemn someone for some little facet of their life when you know next to nothing about them.
    - progmetaldev 4y ago
      I agree somewhat, but this is about programming in the web stack. SSL should be familiar, we aren't speaking about general programming here.
      - kelnos 4y ago
        I think there are a lot of perfectly good programmers who work at the level of the web stack, but couldn't set up a web server with TLS to save their life. There's nothing wrong with that, and suggesting that there is, is just a form of technology elitism and gatekeeping.
        ipaddr 4y ago
        This isn't about being able to. I've love to setup machine learning but lack the understanding. It's about taking pride in not having to learn.. taking pride in not having to understand how things work. Technology shouldn't be a blackbox and shouldn't be celebrated as such.
  - jjulius 4y ago
    Sorry, we're giving an ML engineer grief for not knowing much about SSL? Should we tease dentists for not knowing how to grow oranges, too?
    - ipaddr 4y ago
      Not for not knowing but for being proud that they don't have to.
      - jjulius 4y ago
        That's the entire point of LetsEncrypt; assist people who know they need an SSL cert, but don't know much about SSL.
      - deleted 4y ago
        [deleted]
- otachack 4y ago
  As someone that supports Let's Encrypt's efforts and playing devil's advocate, I imagine a downside is that the bar is lowered and nefarious websites can easily get SSL-equipped channels compared to the high paywall of prior.
  - lxgr 4y ago
    Commercial CAs verify exactly two things: Administrative control over a domain name and a working credit card number. Let’s Encrypt only gets rid of the latter, and given that fraudsters able to spoof the former can probably spare the $10 for the latter, I‘d argue that this is a good thing.
  - CodesInChaos 4y ago
    A plain domain validated certificate cost like $10 for a year or two. So roughly the same cost as the domain name. Hardly a "high paywall".
    - HideousKojima 4y ago
      It meant a paper trail via CC payments (though fraudsters were likely to use stolen CCs, and they probably needed a CC to buy the domain name in the first place). But yeah it's basically not fundamentally different.
    - kelnos 4y ago
      Don't most domains cost $5 or less? I think it's pretty outrageous to have to spend 2x (or more) of the domain name cost to secure connections to it.
      - manuelmoreale 4y ago
        Not sure where you found that figure but most domains definitely don’t cost 5 or less. Most domains are 10+ in my experience.
  - the_optimist 4y ago
    What is the downside of this?
- pedja 4y ago
  Downside existed before Let's Encrypt, it just got amplified with it. General public does not differentiate between the SSL certificate validation level. Let's Encrypt provides domain validation certificates, which only validates that one owns the domain in question. There is another level - Organization Validation SSL certificates, which involves manual checking that this is the legal entity it claims to be. I would expect the financial institutions to use this kind of certificates to avoid phishing, but sadly I've seen some of them use Let's Encrypt.
  - Thiez 4y ago
    Browsers don't differentiate between the SSL certificate validation level. Because it has been shown that the higher validation levels aren't actually significantly more secure, so the distinction is pointless.
  - maxpro 4y ago
    I don't think this is an issue with LE or the implementation. Maybe we need different policies for such organizations, but this is for sure not a LE issue
  - NavinF 4y ago
    OV certs are pointless and that's why nobody uses them. Anyone can pay $30 to register a business with the same name in a different state.
personjerry 4y ago
It saves me from the implementation details, this way I don't need to wear another engineer/sysadmin hat. I think the website content is more important than the SSL implementation!
- ethbr0 4y ago
  Indeed! It's how security should work, and should be the default dual-goal of any piece of security software: provide as much security as possible to as many people as possible.
  - doublerabbit 4y ago
    - Thiez 4y ago
      I should hope HN hashes our passwords, instead of encrypting them. And for encrypted data I would expect them to use symmetric key encryption, rather than certificates with RSA or another form of public key cryptography. Your post contains some very basic misconceptions. This is going to sound harsh, but I would recommend not putting too much stock in your own opinions on security, and instead to trust the experts.
      - doublerabbit 4y ago
        Not harsh at all. I understand I am no security expert, bores the heck out of me. Sadly, you shouldn't trust the "experts" to be if that's LetsEncrypt. No one can be trusted apart from yourself when implementing security. If LE is ran with the following companies, "Electronic Frontier Foundation; Mozilla Foundation; University of Michigan; Akamai Technologies; Cisco Systems" What makes them all trade worthy, especially when they're all American? Especially after the whole Richard Stallman. Mozilla, maybe because they were netscape. I have more than enough experience working within security to know that. I've seen SysOps leak DB's, Passwords in plaintext.. and I've seen it from the age of where such didn't exist to where companies are now installing X security appliances to safe guard there networks. I'm not newb, from 2004 to now, counted 15 years of System and Network engineer experience. Fair from experienced but well seasoned. Why isn't HackerNews using LetsEncrypt, Google, Netflix, Amazon, if promoted as a great thing. Is what I want to know.

I'm not sure that's a good thing

by kache_ 4y ago

I'm not sure that's a good thing

barbazoo 4y ago

What's a downside of that?

ipaddr 4y ago
An Ex-facebook ml engineer who doesn't know what ssl is and takes pride in not having to learn it? Not sure it's a downside/upside thing. It might shed light on the types of people who get hired at facebook.
- kevinh 4y ago
  It's perfectly reasonable for someone to be into programming and not want to have to care about the details of setting up a networking stack.
  - bogwog 4y ago
    Ok I get not wanting to pick on the guy, but is that really reasonable? Engineering is about solving problems by designing/implementing systems. The more you know about the system(s) you're working with, the better the solutions you can build. Even if you're "just" working at a high level and maximally specialized to a single niche, not knowing how the underlying parts work will really limit you. Pick the brain of any accomplished engineer, and you'll quickly see that the technical knowledge they use to write code on a day to day basis is only the tip of the iceberg. It's not reasonable to expect everyone to know everything all the time, but I don't agree people should be aspiring to just know the bare minimum either. Mediocrity is like gravity: if you don't (at least occasionally) aim higher, your trajectory will be lower than you want.
    - TillE 4y ago
      Right obviously very few people will be deep experts on the nitty gritty details of any particular thing, but it's weird to work with computers and not have a broad high-level understanding of something as crucial as TLS and PKI.
      - ipaddr 4y ago
        Not understanding something is to be expected but being proud you don't have to goes against the core of what a programmer is.. curious.
        jjulius 4y ago
        "I don't care to" != "I'm proud I haven't" You don't know why they haven't taken the time to learn. At least they know enough to know they need an SSL cert. Should I not buckle up in a car if I don't understand the mechanics of how the buckle snaps together? I don't understand why you're harping on this person for this.
        ipaddr 4y ago
        The full quote was: "frankly I don't care to know the details" I take issue with that statement not the person. The statement was honest and matter of fact. Few know how SSLs work, few have time or opportunity or even desire to learn it. Not 'wanting' to understand the details goes against what I would expect. A programmer tries to/needs to understand how the world works. Not wanting to understand the entire stack is a new concept to me.
        kelnos 4y ago
        > Not wanting to understand the entire stack is a new concept to me. Then I'd suggest that your experience about the world, and about people in general, is severely lacking. There aren't enough hours in a day or years in a life to learn everything, so we have to be selective. Do you know how CPUs work, down to the various functional units and pipeline stages and how they work together? Can you explain to me how transistors work on an electrochemical level? Can you explain how silicon wafers are fabricated? Hell, I took those classes in college as a part of my EE degree, and I can't really remember it well enough to explain without cheating and looking at Wikipedia. (And even then...) And guess what? That's just fine. I have no need or desire to dive that deeply back into that stuff. Why should the minutiae around TLS certs be any different? I do know how TLS cert provisioning works, and to be honest, it's boring and tedious. And I do it so infrequently that I have to look up a tutorial every time I do it. It's just not worth keeping in my head. If I could use LE for everything, and never try to remember the right `openssl req` command ever again, that would be great. > A programmer tries to/needs to understand how the world works. No, a programmer is someone who solves problems with code. How they do it, and what types of knowledge they pursue, runs the entire gamut of possibilities. Bottom line: knowing technical minutiae doesn't make you cool or special or better than other people. It just makes you someone who's interested in that stuff, or someone who needs to understand it as a part of work they do. Let's not elevate it to something it's not.
    - kelnos 4y ago
      Or maybe we should just avoid judging people based on what they do and don't think is worth their time learning, especially when all we know about them is a previous job title and a short message on an internet message board? I mean, c'mon, it takes quite a bit of arrogance to condemn someone for some little facet of their life when you know next to nothing about them.
  - progmetaldev 4y ago
    I agree somewhat, but this is about programming in the web stack. SSL should be familiar, we aren't speaking about general programming here.
    - kelnos 4y ago
      I think there are a lot of perfectly good programmers who work at the level of the web stack, but couldn't set up a web server with TLS to save their life. There's nothing wrong with that, and suggesting that there is, is just a form of technology elitism and gatekeeping.
      - ipaddr 4y ago
        This isn't about being able to. I've love to setup machine learning but lack the understanding. It's about taking pride in not having to learn.. taking pride in not having to understand how things work. Technology shouldn't be a blackbox and shouldn't be celebrated as such.
- jjulius 4y ago
  Sorry, we're giving an ML engineer grief for not knowing much about SSL? Should we tease dentists for not knowing how to grow oranges, too?
  - ipaddr 4y ago
    Not for not knowing but for being proud that they don't have to.
    - jjulius 4y ago
      That's the entire point of LetsEncrypt; assist people who know they need an SSL cert, but don't know much about SSL.
    - deleted 4y ago
      [deleted]
otachack 4y ago
As someone that supports Let's Encrypt's efforts and playing devil's advocate, I imagine a downside is that the bar is lowered and nefarious websites can easily get SSL-equipped channels compared to the high paywall of prior.
- lxgr 4y ago
  Commercial CAs verify exactly two things: Administrative control over a domain name and a working credit card number. Let’s Encrypt only gets rid of the latter, and given that fraudsters able to spoof the former can probably spare the $10 for the latter, I‘d argue that this is a good thing.
- CodesInChaos 4y ago
  A plain domain validated certificate cost like $10 for a year or two. So roughly the same cost as the domain name. Hardly a "high paywall".
  - HideousKojima 4y ago
    It meant a paper trail via CC payments (though fraudsters were likely to use stolen CCs, and they probably needed a CC to buy the domain name in the first place). But yeah it's basically not fundamentally different.
  - kelnos 4y ago
    Don't most domains cost $5 or less? I think it's pretty outrageous to have to spend 2x (or more) of the domain name cost to secure connections to it.
    - manuelmoreale 4y ago
      Not sure where you found that figure but most domains definitely don’t cost 5 or less. Most domains are 10+ in my experience.
- the_optimist 4y ago
  What is the downside of this?
pedja 4y ago
Downside existed before Let's Encrypt, it just got amplified with it. General public does not differentiate between the SSL certificate validation level. Let's Encrypt provides domain validation certificates, which only validates that one owns the domain in question. There is another level - Organization Validation SSL certificates, which involves manual checking that this is the legal entity it claims to be. I would expect the financial institutions to use this kind of certificates to avoid phishing, but sadly I've seen some of them use Let's Encrypt.
- Thiez 4y ago
  Browsers don't differentiate between the SSL certificate validation level. Because it has been shown that the higher validation levels aren't actually significantly more secure, so the distinction is pointless.
- maxpro 4y ago
  I don't think this is an issue with LE or the implementation. Maybe we need different policies for such organizations, but this is for sure not a LE issue
- NavinF 4y ago
  OV certs are pointless and that's why nobody uses them. Anyone can pay $30 to register a business with the same name in a different state.

personjerry 4y ago

It saves me from the implementation details, this way I don't need to wear another engineer/sysadmin hat. I think the website content is more important than the SSL implementation!

ethbr0 4y ago
Indeed! It's how security should work, and should be the default dual-goal of any piece of security software: provide as much security as possible to as many people as possible.
- doublerabbit 4y ago
  - Thiez 4y ago
    I should hope HN hashes our passwords, instead of encrypting them. And for encrypted data I would expect them to use symmetric key encryption, rather than certificates with RSA or another form of public key cryptography. Your post contains some very basic misconceptions. This is going to sound harsh, but I would recommend not putting too much stock in your own opinions on security, and instead to trust the experts.
    - doublerabbit 4y ago
      Not harsh at all. I understand I am no security expert, bores the heck out of me. Sadly, you shouldn't trust the "experts" to be if that's LetsEncrypt. No one can be trusted apart from yourself when implementing security. If LE is ran with the following companies, "Electronic Frontier Foundation; Mozilla Foundation; University of Michigan; Akamai Technologies; Cisco Systems" What makes them all trade worthy, especially when they're all American? Especially after the whole Richard Stallman. Mozilla, maybe because they were netscape. I have more than enough experience working within security to know that. I've seen SysOps leak DB's, Passwords in plaintext.. and I've seen it from the age of where such didn't exist to where companies are now installing X security appliances to safe guard there networks. I'm not newb, from 2004 to now, counted 15 years of System and Network engineer experience. Fair from experienced but well seasoned. Why isn't HackerNews using LetsEncrypt, Google, Netflix, Amazon, if promoted as a great thing. Is what I want to know.