| ▲ | Schlagbohrer 9 hours ago |
| It is wild to think that enabling HTTPS used to be difficult and expensive before Let's Encrypt came along in the wake of the Snowden revelations. |
|
| ▲ | coldpie 9 hours ago | parent | next [-] |
| Remember Firesheep? It used to be the normal thing to use plain HTTP over open wifi networks. Literally anyone else on that access point could read your whole network session, cookies and all. https://en.wikipedia.org/wiki/Firesheep |
| |
| ▲ | cowlevel 8 hours ago | parent | next [-] | | Firesheep and Snowden are the confluence of factors that happened around the same time and led to the current near-universal use of HTTPS. | |
| ▲ | shim__ 7 hours ago | parent | prev [-] | | There was also an fun Android app which you could use to replace all YouTube videos with a different one |
|
|
| ▲ | tcdent 5 hours ago | parent | prev | next [-] |
| CSRs that seemed like they had to be handled and approved by humans, and thousands of dollars in fees. We have come a long way. |
| |
| ▲ | EvanAnderson 4 hours ago | parent [-] | | > We have come a long way. Except for all the legacy systems and embedded devices I have to deal with that have no certificate automation functionality and are still within their budgeted lifetimes. Those dumb things still require manual enrollment (or, at the very least, ugly one-off scripting to hand-puppet their stupidity) and the decreasing certificate lifetimes makes the problem that much more excruciating. |
|
|
| ▲ | PurpleRamen 5 hours ago | parent | prev | next [-] |
| Depending on the usecase, it's still difficult. Selfhosting can become really annoying because of this. |
| |
| ▲ | jandrese 3 hours ago | parent | next [-] | | Normally I think LetsEncrypt made self hosting a lot easier, at least if you wanted to support HTTPS. LetsEncrypt is what finally solved the problem with the previous systems were perfect was the enemy of the good. There used to be a lot of focus on trying to verify that the person getting the cert was who they said they are, but LetsEncrypt came and sad "that part isn't important, protecting the data is what really matters" and basically solved the real problem wholesale. Very few people inspect the certificates on every website they visit, so those protections were mostly useless and created a roadblock to widespread adoption of HTTPS, scoping the problem down to just making sure nobody can inspect or modify the data in transit made automation not only possible but easy. | |
| ▲ | DaSHacka 5 hours ago | parent | prev [-] | | Caddy and Tailscale can at least alleviate many of the issues and all-but make it automatic and painless (though both are more geared for homelab use). I agree nginx and the more standard webservers/services oftentimes don't have good support and require quite frankly too much manual configuration though. There's no excuse in 2026 for not including acme support OOTB with a single checkbox/config value. Plus, I can't believe the default ACME client is a snap (literally WHO wants this?) and not a simple static binary to help adoption/integration. |
|
|
| ▲ | onionisafruit 9 hours ago | parent | prev | next [-] |
| Before reading this I never considered Snowden could have been a motivator for Let’s Encrypt. |
| |
| ▲ | meuna 9 hours ago | parent [-] | | Same. Fact checking on Wikipedia seems to indicate that the letsencrypt initiative predates Snowden revelations. | | |
| ▲ | onionisafruit 8 hours ago | parent [-] | | I did the same. I found the same about it predating Snowden, but I also found this quote from J Alex Halderman in a remembrance of Peter Eckersley. > That summer, Edward Snowden came forward with chilling revelations
about NSA mass surveillance, and the need for ubiquitous encryption
became clearer than ever. It’s not a claim that it was the instigator, but it seems like it was heavily on their minds. |
|
|
|
| ▲ | educar 9 hours ago | parent | prev [-] |
| how are snowden and LE related? |
| |
| ▲ | iamnothere 9 hours ago | parent | next [-] | | The Snowden revelations did help drive the push towards having HTTPS everywhere, particularly the findings about snooping on internal Google traffic, which seemingly made Google obsessive about HTTPS afterwards. But I don’t think they are directly related. | |
| ▲ | Vvector 8 hours ago | parent | prev [-] | | The Snowden revelations revealed just how vast the intercept of internet communications could be. There was already talk of needing HTTPS everywhere. Snowden's release got more support behind it, and brought the timeline forward. | | |
|
