Subject: Re: Website TLS certificates

From: John Goerzen <[email-masked]>
Date: Tue, 03 Aug 2021 10:58:13 -0500

On Wed, Jul 21 2021, Sergey Matveev wrote:

> *** Jonathan Lane [2021-07-21 18:47]:
>>Is there a plan to get proper SSL certificates for the website? 
>>I can't
>>access them from either w3m or Firefox on my machine because of 
>>trust
>>issues.
>
> I do not know any free CAs that are both can by trusted by me 
> and major
> OS/browser vendors. And definitely won't play in those business 
> (not
> security) games. Major OS/browser vendors, being US-based,  were 
> forced
> to reject/remove all free CAs that are not under USA/NATO 
> control to
> create their own one (Let's Encrypt) under "proper" 
> jurisdiction. Great
> and very clever move indeed, because now the most part of the 
> Web is
> authenticated by single centralized USA/NATO-control entity.

Hi Sergey,

So just today I had an exchange here, with a person wondering why 
the TLS for a thing that's all about encryption is broken.  You 
can find it here: 
https://floss.social/web/statuses/106691934299110939

The person I was corresponding with wrote, "With the cost of TLS 
certs being free, why would your group not encrypt?  Your group is 
all about encryption!"  This was AFTER I sent him a link to your 
post in the NNCP archives.

> * Paid ones -- no way. They are not about security, but 
> business.
> * Let's Encrypt -- clearly it can be used for authentication 
> forging.
>   So why bother? Encryption could be done anyway.

I'm not familiar with this problem with Let's Encrypt (and would 
be happy to learn more).

I have been using it for some years now with good success.

As for "why bother", I think we can recognize that TLS with Let's 
Encrypt does provide some measure of improvement, even if 
imperfect.

But the more important reason is: if we're looking to build 
something that attracts security-conscious people, it's big 
perception problem when it LOOKS like "the project can't even 
configure TLS for their website correctly".  It leads to a lack of 
trust from people that could really benefit from NNCP.

To be honest, when I was first looking into NNCP, that put me off 
as well.  I eventually got past that, obviously, but not everyone 
may.

How can I help?

If you don't want to run Let's Encrypt yourself, perhaps I could:

- Operate a mirror of www.nncpgo.org that does support TLS (that 
  would be pretty easy, probably, since it's just built out of the 
  source tree)

- Work with others to raise funds cover the cost of a TLS cert 
  from a vendor you trust (especially if it's not too expensive)

I really want to make sure barriers to entry are low of people to 
get involved!

- John