So .. "apparently nowadays HTTP::// is dead" .. everything ( with lot of computational waste ) should be "HTTPS://" ..
Which means "you need a digital certificate", which theorectically/practically as far as I know you COULD even generate yourself ( with any thing like OpenSSL or such or similar tools I suppose ) the only difference is that "it would NOT be TRUSTED" because you made it it's like "I made a passport my own and slapped a name and a pic on it".
Right so I suppose you need that "Certified by Verisign" or shit like that saying "you bought if from me, I guarantee is genuine IF you want to trust me" ..
I used to think "probably they want a small fee" ..
Then this morning I see an email from my provider offering "GOOD offers/prices for Digital Certificates for SSL" ..
One for "small companies/site" one for "bigger sites" ..
Price .. 120 + VAT / YEAR EUR !!! and/or 220 + VAT / YEAR EUR for the second type !!
PER YEAR !!!
Are they insane ??!!
This is really "money from thin air" ...
Are they insane ( SSL certificates ) ?
-
gilesgoat
- Sheepie Whore
- Posts: 27258
- Joined: Wed Sep 03, 2003 7:54 am 0
- Location: Monfalcone, Italy
- Contact:
Are they insane ( SSL certificates ) ?
Giles the billy goat
"Baa"
"Baa"
Re: Are they insane ( SSL certificates ) ?
Yeah, you want to use Let's Encrypt.
Free SSL certificates.
Most control panels - like cPanel - automatically support it and most web hosting will have "certbot" installed.
The way it works is that there's a utility called "certbot" on the server. It checks for soon-to-be-expiring certificates and then calls the "Let's Encrypt" servers to get it renewed. And you just create a cronjob to regularly run "certbot" every so often to check and re-new certificates automatically.
Basically, what "certbot" is doing is that it creates a folder called ".well-known" on the root of the server. And, inside that folder, is a file.
So it creates the file on the server, then sends a request to "Let's Encrypt" to renew the certificate and those servers browse to your website and look for the ".well-known" file. And, basically, if the file and the request match up with each other, this proves the request is legitimate, and coming from that website (because only someone with write access - the owner of the site, or the web hosting providing the web space - could be creating the folder and the file).
Then they'll issue a free SSL certificate for the site. And "Let's Encrypt" are on all the "trusted" lists, so all browsers will respect the certificate and not throw up an error.
The idea behind "Let's Encrypt" is that they agree with the "SSL everywhere" philosophy - particularly in light of the Edward Snowdon revelations that the NSA / GCHQ were basically trawling the entire Internet - but, sure, no-one would do it, if it costs a ton of money. So they offer free SSL certificates, to encourage everyone to use "HTTPS" - for Internet privacy - by not charging for them (they get sponsored and receive donations and stuff instead).
The prices of commercial SSL certificates are perfectly ridiculous. Particularly because, yes, there's nothing special about their SSL certificates - created using "OpenSSL" like one you could create yourself - and so really what they're charging for is just the fact that they're on a special "trusted" list.
It's a nice little "money for nothing" scam. Big businesses pay a lot of money for the big fancy SSL certificates, because businesses are easily conned into paying far too much for everything. But these certificates really aren't any better or special, compared to the free "Let's Encrypt" ones.
After all, in the end, it's just a pair of big numbers. The public and private key. There's nothing inherently better or worse about a pair of big numbers that was extortionately paid for, and the free ones you can create yourself with the "openssl" command in the terminal... except they are on the "trusted" list that browsers won't throw a big "untrusted" warning on your screen for.
It's one of the many "money for nothing" scams perpetrated on businesses. Because businesses are typically ran by clueless people who think "it costs a lot of money, so it must be good, right?" and who shy away from the free option because they wrongly think expensive things are better than free things.
Except they're totally wrong - I've dealt with "Let's Encrypt" and paid-for certificates on behalf of many businesses, managing their websites for them, and "Let's Encrypt" is vastly more trustworthy. They actually regularly update their security - have that "certbot" utility that gets regular updates to make it more secure - while there was one paid-for certificate I was managing for a business, where they were struck from the "trusted" lists, as it was shown they were doing things insecurely and there were dodgy certificates, signed by them, out in the wild.
And the thing is, that paid-for certificate was useless - every browser, once they were struck from the "trusted" lists, threw up a "WARNING: UNTRUSTED" page when you browsed to the website - and this company basically did nothing about it. They adopted a "well, we've given you the certificate you paid for, so we're legally off the hook" attitude and offered no refunds, no new certificates or anything.
It was a nightmare, as I had to explain to this business - that had paid a handsome sum of money for it - that the certificate they had was useless. That was fun. But, ah, I steered them into using "Let's Encrypt" and zero problems ever since.
So, like, it's not just money. From experience, "Let's Encrypt" and "certbot" are way more reliable and trustworthy in practice. The paid-for ones are not just stupidly expensive, but I had a certificate issued by one of them that became useless - as they were struck from all "trusted" lists for dodgy practices - and they did a fat load of fuck all about it. No compensation, no refund, nothing. Just "tough shit".
It's not just that the free option is free. It's honestly the better option too. They're genuine, and not just trying to make a quick buck, so they actually give a shit to be secure and actually preserve their certificates' reputation.
(And, yes, "HTTP" is dead. But the true blame for that is the NSA and GCHQ trawling all the Internet's data. Companies like Facebook with their tracking ads. And public / private key cryptography is the way to block all this shit - the "SSL everywhere" philosophy that the Internet should be encypted by default, so no-one can trawl anything, so it's "opt in" by default - but some arseholes will always, you know, try to make a quick buck out of anything.
The real solution - which does exist in IPv6 - is that the protocols themselves should be "secure by default" at the lowest level. Oh, and don't worry too much about the computational side of things, as modern CPUs have cryptographic instructions in them already. They have "cryptography acceleration" in the hardware / instruction sets now.)
But, yeah, you do have to keep an eye on this bullshit. As I've complained about before, I don't think that the "SecureBoot" / "TPM 2.0" stuff with Windows is actually legitimate, it's just a slow manoeuvre to set up a future "walled garden".
It's the old thing. There is legitimate need and usage. But there's also always a bunch of scamsters out there, trying to make a quick buck out of things people don't really fully understand.
Kind of like with blockchain. The technology itself is perfectly legitimate - making things "tamper-proof" with cryptographic chains - but, yeah, there's also always people who'll make stupid shit - like NFTs - to try to make a quick buck.
But, for example, there was talk in one of the Scandinavian countries about using blockchain for their land registry. Which would allow all the records to be made public - which is important for oversight and transparency, to ensure no-one is abusing the system - while it's all cryptographically tamper-proof. This makes sense and it would be a really good legitimate use of blockchain, that actually stops abuse and makes it more reliable and trustworthy. But, elsewhere, folks are selling NFTs for stupid money and it doesn't really work, as you can just right-click on an image anyway.
The technology itself is sound. But that doesn't stop some people abusing it and being arseholes, trying to make money out of anything and everything. You've just got to be wary and know who's dodgy and who's legitimate. Go with "Let's Encrypt". They're not just free, they're also definitely not a scam to make money (as they don't make any money that way).
Free SSL certificates.
Most control panels - like cPanel - automatically support it and most web hosting will have "certbot" installed.
The way it works is that there's a utility called "certbot" on the server. It checks for soon-to-be-expiring certificates and then calls the "Let's Encrypt" servers to get it renewed. And you just create a cronjob to regularly run "certbot" every so often to check and re-new certificates automatically.
Basically, what "certbot" is doing is that it creates a folder called ".well-known" on the root of the server. And, inside that folder, is a file.
So it creates the file on the server, then sends a request to "Let's Encrypt" to renew the certificate and those servers browse to your website and look for the ".well-known" file. And, basically, if the file and the request match up with each other, this proves the request is legitimate, and coming from that website (because only someone with write access - the owner of the site, or the web hosting providing the web space - could be creating the folder and the file).
Then they'll issue a free SSL certificate for the site. And "Let's Encrypt" are on all the "trusted" lists, so all browsers will respect the certificate and not throw up an error.
The idea behind "Let's Encrypt" is that they agree with the "SSL everywhere" philosophy - particularly in light of the Edward Snowdon revelations that the NSA / GCHQ were basically trawling the entire Internet - but, sure, no-one would do it, if it costs a ton of money. So they offer free SSL certificates, to encourage everyone to use "HTTPS" - for Internet privacy - by not charging for them (they get sponsored and receive donations and stuff instead).
The prices of commercial SSL certificates are perfectly ridiculous. Particularly because, yes, there's nothing special about their SSL certificates - created using "OpenSSL" like one you could create yourself - and so really what they're charging for is just the fact that they're on a special "trusted" list.
It's a nice little "money for nothing" scam. Big businesses pay a lot of money for the big fancy SSL certificates, because businesses are easily conned into paying far too much for everything. But these certificates really aren't any better or special, compared to the free "Let's Encrypt" ones.
After all, in the end, it's just a pair of big numbers. The public and private key. There's nothing inherently better or worse about a pair of big numbers that was extortionately paid for, and the free ones you can create yourself with the "openssl" command in the terminal... except they are on the "trusted" list that browsers won't throw a big "untrusted" warning on your screen for.
It's one of the many "money for nothing" scams perpetrated on businesses. Because businesses are typically ran by clueless people who think "it costs a lot of money, so it must be good, right?" and who shy away from the free option because they wrongly think expensive things are better than free things.
Except they're totally wrong - I've dealt with "Let's Encrypt" and paid-for certificates on behalf of many businesses, managing their websites for them, and "Let's Encrypt" is vastly more trustworthy. They actually regularly update their security - have that "certbot" utility that gets regular updates to make it more secure - while there was one paid-for certificate I was managing for a business, where they were struck from the "trusted" lists, as it was shown they were doing things insecurely and there were dodgy certificates, signed by them, out in the wild.
And the thing is, that paid-for certificate was useless - every browser, once they were struck from the "trusted" lists, threw up a "WARNING: UNTRUSTED" page when you browsed to the website - and this company basically did nothing about it. They adopted a "well, we've given you the certificate you paid for, so we're legally off the hook" attitude and offered no refunds, no new certificates or anything.
It was a nightmare, as I had to explain to this business - that had paid a handsome sum of money for it - that the certificate they had was useless. That was fun. But, ah, I steered them into using "Let's Encrypt" and zero problems ever since.
So, like, it's not just money. From experience, "Let's Encrypt" and "certbot" are way more reliable and trustworthy in practice. The paid-for ones are not just stupidly expensive, but I had a certificate issued by one of them that became useless - as they were struck from all "trusted" lists for dodgy practices - and they did a fat load of fuck all about it. No compensation, no refund, nothing. Just "tough shit".
It's not just that the free option is free. It's honestly the better option too. They're genuine, and not just trying to make a quick buck, so they actually give a shit to be secure and actually preserve their certificates' reputation.
(And, yes, "HTTP" is dead. But the true blame for that is the NSA and GCHQ trawling all the Internet's data. Companies like Facebook with their tracking ads. And public / private key cryptography is the way to block all this shit - the "SSL everywhere" philosophy that the Internet should be encypted by default, so no-one can trawl anything, so it's "opt in" by default - but some arseholes will always, you know, try to make a quick buck out of anything.
The real solution - which does exist in IPv6 - is that the protocols themselves should be "secure by default" at the lowest level. Oh, and don't worry too much about the computational side of things, as modern CPUs have cryptographic instructions in them already. They have "cryptography acceleration" in the hardware / instruction sets now.)
But, yeah, you do have to keep an eye on this bullshit. As I've complained about before, I don't think that the "SecureBoot" / "TPM 2.0" stuff with Windows is actually legitimate, it's just a slow manoeuvre to set up a future "walled garden".
It's the old thing. There is legitimate need and usage. But there's also always a bunch of scamsters out there, trying to make a quick buck out of things people don't really fully understand.
Kind of like with blockchain. The technology itself is perfectly legitimate - making things "tamper-proof" with cryptographic chains - but, yeah, there's also always people who'll make stupid shit - like NFTs - to try to make a quick buck.
But, for example, there was talk in one of the Scandinavian countries about using blockchain for their land registry. Which would allow all the records to be made public - which is important for oversight and transparency, to ensure no-one is abusing the system - while it's all cryptographically tamper-proof. This makes sense and it would be a really good legitimate use of blockchain, that actually stops abuse and makes it more reliable and trustworthy. But, elsewhere, folks are selling NFTs for stupid money and it doesn't really work, as you can just right-click on an image anyway.
The technology itself is sound. But that doesn't stop some people abusing it and being arseholes, trying to make money out of anything and everything. You've just got to be wary and know who's dodgy and who's legitimate. Go with "Let's Encrypt". They're not just free, they're also definitely not a scam to make money (as they don't make any money that way).
"Words ought to be a little wild - for they are assaults of thought on the unthinking."
- John Maynard Keynes
- John Maynard Keynes
-
gilesgoat
- Sheepie Whore
- Posts: 27258
- Joined: Wed Sep 03, 2003 7:54 am 0
- Location: Monfalcone, Italy
- Contact:
Re: Are they insane ( SSL certificates ) ?
????KlaxonCow wrote:
*SNIP*
But, for example, there was talk in one of the Scandinavian countries about using blockchain for their land registry. Which would allow all the records to be made public - which is important for oversight and transparency, to ensure no-one is abusing the system - while it's all cryptographically tamper-proof. This makes sense and it would be a really good legitimate use of blockchain, that actually stops abuse and makes it more reliable and trustworthy. But, elsewhere, folks are selling NFTs for stupid money and it doesn't really work, as you can just right-click on an image anyway.
*SNIP*
In the place where I live in Italy ( note, 2022 and as far as I know this is still NOT applied to ALL the territory of Italy ) in Friuli, cause "an ancient law derived from the former Austro-Hungarian empire" we do have the "Registro Catastale" for land/houses/buildings/who-owns-who and such.
It's ALL public and it's "paper documents" so unecrpyted .. anyone can go to the registry as "need to see this", probably pay "a small fee for the vision" and got handled documents to see.
But the real problem is that "as soon as you go outside Friuli" things start to crumble very rapidly because "almost all other parts of Italy" don't have/apply such mechanism, when you go to South Italy there is "total chaos" that not even 1000 NFTs can sort or will ever sort.
The other even bigger problem ( in Italy ) is "how you establish a land registration/registry in the first place", you need somene with authority/trusted that can come "see a piece of land" and say "this belong to X, this to Y" and there is where A LOT of problems already start.
On the other side I would *NOT* be surprised at all if someone could come out with a paper written by Julius Caesar himself saying "that piece of land belongs to X and all his descendants for 1000 years" .. because we may have papers like that for real .. as well as people that could claim to sell you "a piece of land X" claiming they own it to be found "no they don't" but the same time you can NOT establish a legal owner AND is *NOT* "the council" by default OH NO that would be FAR too easy !
Buying/selling land/properties in Italy is .. complicated .. lenghty process .. expensive ... very much subject of scams ...
The problem is not "measuring" the land it's establishing ownerships and borders.
I've seen people spending "their entiere lives" in legal battles over 1m of land .. trust me, it does happen ... "all the time" ...
Giles the billy goat
"Baa"
"Baa"