[vhcr]

Depend on one less third party, you still depend on the DNS Root servers, your ISP / hosting, domain registry, etc.

[1vuio0pswjnm7]

Third party root servers are generally used for looking up TLD nameservers, not for looking up domainnames registered to individuals publishing personal blogs^1

Fortunately, one can publish on the www without using ICANN DNS

For example http://199.233.217.201 or https://199.233.217.201

1. I have run own root server for over 15 years

An individual cannot even mention choosing to publish a personal blog over HTTP without being subjected to a kneejerk barrage of inane blather. This is truly a sad state of affairs

I'm experimenting with non-TLS, per packet encryption with a mechanism for built-in virtual hosting (no SNI) and collision-proof "domainnames" on the home network as a reminder that TLS is not the only way to do HTTPS

It's true we depend on ISPs for internet service but that's not a reason to let an unlimited number of _additional_ third parties intermediate and surveil everything we do over the internet

[JoshTriplett]

> inane blather

And this is why it's a good thing that every major browser will make it more and more painful, precisely so that instead of arguments about it, we'll just have people deciding whether they want their sites accessible by others or not.

Unencrypted protocols are being successfully deprecated.

[JakaJancar]

You have some weird definition of "root".

[1vuio0pswjnm7]

Definition of "root server"

Authoritative DNS nameserver that serves root.zone, e.g., the one provided by ICANN, or maybe a customised one

In own case it is served only to me on local network

Many years ago, one of the former ICANN board members mentioned on his personal blog running his own root

[1vuio0pswjnm7]

People using the web can choose what software to use. This includes both client software and server software. Arguably the later ultimately determines whether HTTP is still available on the internet, regardless of whether it is used by any particular client software, e.g., a popular browser

One advertising company through its popular "free browser", a Trojan Horse to collect data for its own purposes, may attempt to "deprecate" an internet protocol by using its influence

But at least in theory such advertising companies are not in charge of such protocols, and whether the public, including people who write server software or client software, can use them or not

[sam_lowry_]

Let's Encrypt pushes me to run its self-updating certbot on my personal server, which is a big no-go.

I know about acme.sh, but still...

[tialaramex]

They're focused on the thing that'll get the most people up and running for the least extra work from them. When you say "push" do you just mean that's the default or are they trying to get you to not use another ACME client like acme.sh or one built in to servers you run anyway or indeed rolling your own?

Like, the default for cars almost everywhere is you buy one made by some car manufacturer like Ford or Toyota or somebody, but usually making your own car is legal, it's just annoyingly difficult and so you don't do that.

[rpdillon]

I counted by hand, so it might be wrong, but they appear to list and link to 86 different ACME client implementations across more than a dozen languages: https://letsencrypt.org/docs/client-options/

I've used their stuff since it came out and never used certbot, FWIW. If I were to set something up today, I'd probably use https://github.com/dehydrated-io/dehydrated.

[rascul]

There is a plethora of other clients besides certbot or acme.sh.

[dadrian]

Let's Encrypt does not write or maintain certbot

[MYEUHD]

Host an onion website at home using solar energy, and the only third party your website will depend on is your internet provider :)

[Ajedi32]

Onion websites also don't need TLS (they have their own built-in encryption) so that solves the previous commenter's complaint too. Add in decentralized mesh networking and it might actually be possible to eliminate the dependency on an ISP too.

[01HNNWZ0MV43FF]

And an army of volunteers and feds to run relays

[bawolff]

What about the Tor directory authorities?

There is no magic do it all yourself. Communicating with people implies dependence.

[wongogue]

I gave up trying to build a solar panel.

[kelnos]

What about all the third parties running relays and exit nodes?

[treve]

If you think about it the spirit of the internet is based on collaboration with other parties. If you want no third parties, there's always file: and localhost.

[michaelt]

CAs are uniquely assertive about their right to cut off your access.

My hosting provider may accidentally fuck up, but they'll apologise and fix it.

My CA fucks up, they e-mail me at 7pm telling me I've got to fix their fuck-up for them by jumping through a bunch of hoops they have erected, and they'll only give me 16 hours to do it.

Of course, you might argue my hosting provider has a much higher chance of fucking up....

[Dylan16807]

So what does "CA fixes the problem" look like in your head? Because they'll give you a new certificate right away. You have to install it, but you can automate that, and it's hard to imagine any way they could help that would be better than automation. What else do you want them to do? Asking them to not revoke incorrect or compromised certificates isn't good for maintaining security.

[Uvix]

CAs have to follow the baseline rules set by Google and Mozilla regarding incident response timelines. If they gave you more time, the browsers would drop them as a supported CA.