Hacker News new | past | comments | ask | show | jobs | submit login

This might even make sense as "a great (but evil) business strategy" except Let's Encrypt isn't a business, it's provided by a charity, ISRG, the Internet Security Research Group, set up for exactly this purpose by people from Mozilla (a charity) and the EFF (another charity)

I suspect that the people behind ISRG weren't as paranoid as the Free Software Foundation about being corrupted by some hypothetical evildoers (the FSF has a whole mechanism to try to ensure that if you somehow take over the Foundation you can't use its resources to counter its original purpose) but you're going to need a bit more than a vague idea that people are capable of evil as an explanation for why good things are actually not good.




I don't know who has what legal remedies when a nonprofit acts inappropriately, but another observation is that most of Let's Encrypt's technology is developed in public.

https://github.com/letsencrypt

If you needed to set up another ACME-compatible CA on the same model (which could then be a drop-in replacement compatible with the existing client base), it would be a lot less expensive (although it would require datacenter build-out, hiring an operations team, and a variety of PKI-specific stuff like key ceremonies, HSMs, cross-signing, CPS, and audits).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: