Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Somewhat ironic that https://www.libressl.org/ doesn't work, no?


Not really considering you have to buy certs if you want people to use your site, it doesn't have any sensitive data on it (not even source code or binaries), and they haven't finished cleaning it up to their standards yet.


>(not even source code or binaries

The real see site doesn't have those things, but a MITM'd unsecured version might.


StartCom/StartSSL [1] and, to my knowledge, Comodo [2] do offer free (and widely supported) SSL certs. Charges may apply to revoke certificates if a private key is leaked ($25 at StartSSL, IIRC).

As for why SSL should be used everywhere: It improves security and makes eavesdropping more expensive. For the first point, see the BEAST and CRIME attacks. On vulnerable systems, a single unencrypted connection may be used to reveal data from other, encrypted streams. As for the second: if only sensitive data is encrypted, all encrypted streams automatically become "interesting" to a potential eavesdropper. If, however, everything is encrypted, all streams become equal again. The cost of storing all communications becomes much higher, and the ratio of cost and reward of decrypting a single captured stream worsens (as you may either reveal sensitive or non-sensitive data).

[1] https://www.startssl.com/

[2] http://www.instantssl.com/ssl-certificate-products/free-ssl-...


If you have to pay for revocation, then it is not free certificate. It is just certificate with fees postponed. It is not the same thing. Not sure how you, but when I buy things I do not consider only initial price, but also additional fees.

If we want SSL used everywhere, browsers need accept self signed certificates in less obtuse way or there need to be other way to get really free ones.


Why was this downvoted?


I bet StartSSL would happily (and publicly) waive any revoke fees to FOSS SSL software projects.


And you would lose your money.


the last word of that sentence should be "yes"




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: