Hacker News new | past | comments | ask | show | jobs | submit | threesevenths's comments login

The difficult part of running a ca is convincing others you’re trustworthy. You need to have your business processes audited but an independent third party and then wait for your root to be adopted and deployed in browsers.

The value in exiting providers is their reach; versign for example is deployed in practically every trusted root bundle. When GoDaddy wanted to enter the market, they bought Starfield who already had a root which was widely trusted and crossed that with their own.

The reason people will pay for you to compute a number based on a number they give you and your super secret number is that people trust what you’re doing with your super secret number. And that trust takes time.


And when you want to run a public one, you should learn at least everything that cacert did. They tried hard and still never got included. https://www.cacert.org/ That effort seems to be dying and it's been years since anyone asked me to authenticate them.

Some history here. http://wiki.cacert.org/InclusionStatus And that's before root stores had to deal with Honest Achmed's Used Cars and Certificates.


How did LetsEncrypt get acceptance everywhere?


In the beginning they partnered with an existing CA so that they could issue certificates that where chained to roots already trusted by the major browsers.

“Getting a new root trusted and propagated broadly can take 3-6 years. In order to start issuing widely trusted certificates as soon as possible, we partnered with another CA, IdenTrust, which has a number of existing trusted roots. As part of that partnership, an IdenTrust root ‘vouches for’ the certificates that we issue, thus making our certificates trusted.”

https://letsencrypt.org/2015/10/19/lets-encrypt-is-trusted/

https://letsencrypt.org/2016/08/05/le-root-to-be-trusted-by-...

https://letsencrypt.org/2023/07/10/cross-sign-expiration/


They were Mozilla's child.


I’d be willing to bet some internet karma that this was a simple mistake during packaging and an errant folder create was accidentally included. I’d be incredibly surprised if any IIS components are activated by this update or if anything beyond the folder existing is out of the ordinary for the system.


A British company making a chat app. What’s the privacy policy? 5 eyes first then you?


It's open source and you can self host it.


You know it includes a backdoor for the government.


it's open sourced and self-hostable


The bigger question mark for me is. Is this still at risk from the online safety act that seems to be killing lots of smaller UK communities/games?


Slack belongs to Salesforce (US), Discord is based in the US, Microsoft, Google, Facebook, Apple...

Not saying this is better, but is definitely not worse. At least in Europe there is the GDPR, whereas in the US there is a president officially supporting corruption [1].

If you care about privacy, you have to go for open source end-to-end encryption. Probably Signal. At least this you can self-host.

[1]: https://www.cbsnews.com/news/trump-fcpa-anti-bribery-law-exe...


I read this article overwhelmingly thinking: do a test Ars. The subtext read like “Oh woe is us well just have to wait and see what happens there’s nothing we could do to move this along. We have an editor that has one but theirs isn’t internet connected. Oh if only there was something we could do to give more substantive reporting.”

Buy a printer, buy third party toner, and try and confirm or refute the claims.


What a shitty world when we now have paywalled content on medium.


I’ll have what they’re having.


Run a discord server. Hang out and chat, even if you’re playing different games or watching shows and movies. Sometimes knowing you’ll be heard even if no one is actively speaking is a good activity.


I don’t know why but discord isn’t prevalent in my circle, maybe we’re just a bit older?


In my experience Discord is mostly popular among the gamers. Not for me personally, I find Discord bloated and overwhelming. Slack for work is barely tolerable


Discord is not for me either, I guess. young kids seem to be having all the fun there.


> we used a combination of two data collection methods: a survey administered to 651 employees and in-depth interviews conducted with 35 employees from the same organization.

I’m no statistician but surveying a single org does not seem to be a representative sample of the whole population of software developers.


Question about data collection. On the App Store it says that no data is collected by the app. In your privacy policy on the site it states that you do collect data related to the work that the app does and among other things, device metrics. If you do collect data, would you mind updating your App Store listing to clearly indicate that you collect data. If you don’t collect anything, could that be clearly indicated in your privacy policy.

Thanks, app looks clean and useful.


Thanks. Updated the data-collection section.


What main board do you have the issue with? Is it a 13 or 16?


13, first generation.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: