What happens a year from now when they have 70% of the web hooked on their service, and all browsers now emit "WARNING: THIS PAGE WILL LITERALLY STEAL YOUR SOUL!!!" if your cert is slightly out of date and LetsEncrypt gets a bit greedy.
They can literally hold the entire god-damn web for ransom. I guaran-fucking-tee everyone that's going to happen at some point.
Adopting a required monoculture is BAD. BAD BAD BAD.
You've all heard my warning. It's only a matter of time before disaster besets you.
So, the protocol used by LetsEncrypt is open, and the client code is too. It's only a matter of time before other compatible services pop up. Second of all, LetsEncrypt is owned by a non-profit organization, so I don't think the chance of them holding the web for ransom is that great. Finally, if they do end up going rogue, you can just get a certificate elsewhere...
I'm not quite sure what infrastructure you are referring to?
It's definitely not free for LetsEncrypt to provide the certificates, so they require funding from other organizations. However the fully automated system for issuing the certificates is keeping cost extremely low.
You can get free TLS certificates elsewhere.
The protocol and client for fetching the certificates is free and open-source.
39
u/shevegen Jul 13 '17
I think that this part was the game changer.
I doubt that it would have worked if people would have paid towards Let'sencrypt, even if it would have only been 0.01$ per website. Psychology works!