Linux Foundation to host Let's Encrypt [LWN.net]

The Linux Foundation (LF) has announced that it will serve as host of the Let's Encrypt project, as well as the Internet Security Research Group (ISRG). Let's Encrypt is the free, automated SSL/TLS certificate authority that was announced in November 2014 by the Electronic Frontier Foundation (EFF) to provide TLS certificates for every domain on the web. ISRG is the non-profit organization created to spearhead efforts like Let's Encrypt (which, as of now, is ISRG's only public project). In the LF announcement, executive director Jim Zemlin notes that "by hosting this important encryption project in a neutral forum we can accelerate the work towards a free, automated and easy security certification process that benefits millions of people around the world."

to post comments

Linux Foundation to host Let's Encrypt

Posted Apr 10, 2015 7:36 UTC (Fri) by Aissen (subscriber, #59976) [Link] (6 responses)

Call me cynical, but wasn't it the same Linux Foundation that said that hosting a root authority for (UEFI) Secure Boot would be too costly ?

Maybe it's different because they now have all those sponsors for this project, or is this just the "workgroup" that will be hosted by LF ?

Linux Foundation to host Let's Encrypt

Posted Apr 10, 2015 7:57 UTC (Fri) by mjg59 (subscriber, #23239) [Link] (5 responses)

They're not equivalent in any way.

Linux Foundation to host Let's Encrypt

Posted Apr 10, 2015 9:20 UTC (Fri) by ledow (guest, #11753) [Link] (4 responses)

Why not?

UEFI Secure Boot would require them to sign only a handful of bootloaders and then secure the initial keys.

Global, free, SSL certificates requires massive ongoing infrastructure, constant security audits, and may well be a victim of its own success.

Certainly there may be costs involved in being a UEFI root, but do they really compare to running a global CA offering free certs, even via an automated always-online system? You could sign one UEFI bootloader and then never sign another ever again, if necessary.

I think they didn't become UEFI root because they knew they could never fulfill the other side of it (business - convincing manufacturers to put their roots into the BIOS of every computer), not because of infrastructure costs.

But the infrastructure costs of an automated, global, free SSL CA must be humungous, especially if you're intending to verify every domain and sign every cert automatically and include it in an "apt-get" manner in distros.

Linux Foundation to host Let's Encrypt

Posted Apr 10, 2015 10:10 UTC (Fri) by cesarb (subscriber, #6266) [Link]

From what I understood, for an UEFI root they would have a high financial responsibility in case the key is cracked, leaked, or misused.

For SSL certificates, the worst that could happen is that their root is forcibly removed and blacklisted from all browsers.

Adding that variable, the total financial cost is greater for UEFI than for SSL.

Linux Foundation to host Let's Encrypt

Posted Apr 10, 2015 11:12 UTC (Fri) by Limdi (guest, #100500) [Link] (2 responses)

Why does the uefi system rely on molded-in keys instead of everyone having uefi key storage around the neck? haha!

Linux Foundation to host Let's Encrypt

Posted Apr 10, 2015 11:18 UTC (Fri) by Limdi (guest, #100500) [Link] (1 responses)

Is this appropriate here?

Linux Foundation to host Let's Encrypt

Posted Apr 10, 2015 13:43 UTC (Fri) by cesarb (subscriber, #6266) [Link]

> Is this appropriate here?

I believe the answer is "no": that joke added nothing useful to the discussion.

Linux Foundation to host Let's Encrypt

Posted Apr 10, 2015 15:38 UTC (Fri) by idupree (guest, #71169) [Link]

The post on letsencrypt.org has slightly more detail: "The Linux Foundation will provide general and administrative support services, as well as services related to fundraising, financial management, contract and vendor management, and human resources."

TL;DR - When will Let's Encrypt Go Live?

Posted Apr 10, 2015 21:00 UTC (Fri) by Felix_the_Mac (guest, #32242) [Link] (2 responses)

This sounds like a rather boring announcement.
Is there any indication of when Let's Encrypt will Go Live?

TL;DR - When will Let's Encrypt Go Live?

Posted Apr 12, 2015 10:32 UTC (Sun) by debacle (subscriber, #7114) [Link] (1 responses)

The page https://letsencrypt.org/ says very prominently "Arriving Mid-2015". They don't define "mid", however. Might be from June to July or from February to November. Let's see.

TL;DR - When will Let's Encrypt Go Live?

Posted Apr 12, 2015 13:33 UTC (Sun) by cesarb (subscriber, #6266) [Link]

> They don't define "mid", however. Might be from June to July or from February to November.

I'd say that any definition of "mid" wider than from April to September (half of a full year) is stretching the word "mid" too far.

Linux Foundation to host Let's Encrypt

Posted Apr 11, 2015 1:07 UTC (Sat) by pabs (subscriber, #43278) [Link] (6 responses)

Interesting LF calls itself a "nonprofit" when it isn't a 501(c)(3) (USA non-profit) working in the interests of the community, instead it is a 501(c)(6) (USA trade association) working in the interests of a group of wealthy corporations. Personally I'm disappointed in this choice by LE.

Linux Foundation to host Let's Encrypt

Posted Apr 12, 2015 3:02 UTC (Sun) by edgewood (subscriber, #1123) [Link] (1 responses)

All 501(c) organizations are considered non-profits. 501(c)(3)'s are typically called "charities" in colloquial terms.

Having served on the governing board of both a 501(c)(3) and a 501(c)(4) (the latter being somewhat similar to a 501(c)(6)), I can tell you that there are advantages and disadvantages to both forms of organization. You may want to review some of LWN's previous reporting on this topic.

Without some concrete examples of things that the Linux Foundation does that you don't care for, your comment makes it appear like you are fetishizing their non-profit organization structure, not what they actually do (or don't do) for the community.

Linux Foundation to host Let's Encrypt

Posted Apr 16, 2015 18:10 UTC (Thu) by rriggs (guest, #11598) [Link]

QOTW:

501(c)

Posted Apr 12, 2015 12:30 UTC (Sun) by tialaramex (subscriber, #21167) [Link] (2 responses)

The "interests of the community" is an extremely vague (arguably intentionally so) distinction. If you squint you can argue that almost any purpose is in the "interests of the community".

For example, if the maker of drug X wants journalists to run a story asking that readers "Demand government programs and private health insurance pay for drug X" that's just marketing, and might even have a tag saying it's sponsored content. But create a Patient Advocacy charity for patients who could use drug X, pump some funds from the pharmaceutical company into the charity and your story is now "Y Syndrome Foundation told us how patient Z can't get the drug X that would help them so much because it's not currently included in their health insurance. With your help we can change that". And you don't even have to pay tax on this nifty scheme because it has 501(c) status.

The reason why we're seeing more push back for Free Software projects seeking 501(c)3 is similar. If I develop a piece of software that's useful only for my product X, that's a normal taxable business activity. But if I "spin out" the software development as a Free Software project under 501(c)3, I can say that's a charity giving the community this (useless unless buying product X from me) software and that part of the business is suddenly not subject to tax. That's clearly a joke and we shouldn't be surprised that some groups with no clear purpose beyond "make this particular piece of Free Software" are struggling to get 501(c)3 now.

Organising as 501(c)6 often better represents the reality that the Free Software development benefits a bunch of private organisations or individuals and only indirectly the wider community (by reducing duplicated effort among those organisations and individuals).

For 501(c)3 the excuse is often given that organising this way ensures "transparency". In fact, particularly for smaller charities, IRS rules effectively don't require any transparency at all. I strongly recommend that anyone getting involved in one insists the new charity formally agree to provide real transparency - e.g. publishing detailed financial accounts, agendas and subsequently minutes of board meetings, all in a timely fashion - in their founding documents and to wind up the charity if for any reason they cease to achieve that transparency. The problem isn't a lack of will per se, nobody that I've seen sets out to enable fraud and abuse, it's just that actually running the organisation turns out to take more than an occasional five minutes and the promised "transparency" is always bottom of the TODO list, but the _effect_ is that abuse and even fraud take place. Forcing people setting up such charities to face up to that and shut the thing down rather than constantly hope they'll "sort that paperwork out next month" means the abuse gets worse not better. We can't expect the US Federal Government to reform 501(c) any time soon but we can demand new Free Software (and allied) charities do better.

501(c)

Posted Apr 13, 2015 16:31 UTC (Mon) by ballombe (subscriber, #9523) [Link] (1 responses)

> e.g. publishing detailed financial accounts, agendas and subsequently minutes of board meetings, all in a timely fashion
For what is worth, SPI provides all that.

501(c)

Posted Apr 14, 2015 9:38 UTC (Tue) by tialaramex (subscriber, #21167) [Link]

I should hope so - and I'd encourage people looking at starting yet another Free Software charity to support their software project to talk to SPI or one of the other organisations offering to nurture Free Software (e.g. Apache) instead. Probably I should have mentioned that in my earlier comment. I was a bit focused on what happens /after/ they've persuaded themselves that they don't want the shelter of an umbrella but will instead go it alone.

Linux Foundation to host Let's Encrypt

Posted Apr 16, 2015 16:12 UTC (Thu) by gerv (guest, #3376) [Link]

In one sense it's a choice by LE, but it's also about what the IRS will accept. These statuses do have descriptions and qualifications you need to meet.

There have also been some well-documented problems recently with free software projects becoming 501(c)3s, which suggests that the IRS is scrutinizing such applications pretty closely.

Perhaps it was decided that LE's activity didn't really fit in c(3).

Gerv