Re: Website TLS certificates

John Goerzen
2021-08-03T15:59:29Z

On Wed, Jul 21 2021, Sergey Matveev wrote:

> *** Jonathan Lane [2021-07-21 18:47]:
>>Is there a plan to get proper SSL certificates for the website?
>>I can't
>>access them from either w3m or Firefox on my machine because of
>>trust
>>issues.
>
> I do not know any free CAs that are both can by trusted by me
> and major
> OS/browser vendors. And definitely won't play in those business
> (not
> security) games. Major OS/browser vendors, being US-based, were
> forced
> to reject/remove all free CAs that are not under USA/NATO
> control to
> create their own one (Let's Encrypt) under "proper"
> jurisdiction. Great
> and very clever move indeed, because now the most part of the
> Web is
> authenticated by single centralized USA/NATO-control entity.

Hi Sergey,

So just today I had an exchange here, with a person wondering why
the TLS for a thing that's all about encryption is broken. You
can find it here:
https://floss.social/web/statuses/106691934299110939

The person I was corresponding with wrote, "With the cost of TLS
certs being free, why would your group not encrypt? Your group is
all about encryption!" This was AFTER I sent him a link to your
post in the NNCP archives.

> * Paid ones -- no way. They are not about security, but
> business.
> * Let's Encrypt -- clearly it can be used for authentication
> forging.
> So why bother? Encryption could be done anyway.

I'm not familiar with this problem with Let's Encrypt (and would
be happy to learn more).

I have been using it for some years now with good success.

As for "why bother", I think we can recognize that TLS with Let's
Encrypt does provide some measure of improvement, even if
imperfect.

But the more important reason is: if we're looking to build
something that attracts security-conscious people, it's big
perception problem when it LOOKS like "the project can't even
configure TLS for their website correctly". It leads to a lack of
trust from people that could really benefit from NNCP.

To be honest, when I was first looking into NNCP, that put me off
as well. I eventually got past that, obviously, but not everyone
may.

How can I help?

If you don't want to run Let's Encrypt yourself, perhaps I could:

- Operate a mirror of www.nncpgo.org that does support TLS (that
would be pretty easy, probably, since it's just built out of the
source tree)

- Work with others to raise funds cover the cost of a TLS cert
from a vendor you trust (especially if it's not too expensive)

I really want to make sure barriers to entry are low of people to
get involved!

- John