Internet Security Research Group

Internet Security Research Group (ISRG) | Divvi Up Software Engineer | Full time | Remote (USA) | https://abetterinternet.org ISRG was founded in 2013 to serve as a home for public-benefit digital infrastructure projects, the first of which was the Let's Encrypt certificate authority. In 2021, ISRG launched two new digital security projects: Prossimo, a memory safety project, and Divvi Up, a privacy-preserving metrics system. We're looking for a mid-level engineer for our Divvi Up team! Position Must Haves: - 2+ years work experience programming in a compiled language. - Ability to design, develop, ship, and maintain features with some guidance from more experienced engineers. - Code implementation that is clear, concise, tested, maintainable, and easily understood by others. - Ability to perform supportive and constructive code reviews. - Consistent attention paid to producing a high-quality testing strategy. - Attention to detail and a willingness to take time to think things through. - Ability to prioritize and maintain cognizance of your priorities in your work. - Excellent written, verbal, and collaborative communication skills. - Reliable time and task management. https://www.abetterinternet.org/careers/ for more details

Internet Security Research Group (ISRG) | Let's Encrypt Site Reliability Engineer (SRE) | Full time | Remote (USA) | https://abetterinternet.org ISRG was founded in 2013 to serve as a home for public-benefit digital infrastructure projects, the first of which was the Let's Encrypt certificate authority. In 2021, ISRG launched two new digital security projects: Prossimo, a memory safety project, and Divvi Up, a privacy-preserving metrics system. We're looking for a mid-level engineer for our Let's Encrypt SRE team! Position Must Haves: - 2+ years work experience programming in a compiled language with consistent attention paid to high quality tests. - 2+ years working professionally with Linux. - Attention to detail and a willingness to take time to think things through. - Ability to prioritize and maintain cognizance of your priorities in your work. - Excellent written, verbal, and collaborative communication skills. - Reliable time and task management. Position Nice to Haves (if you don't know these already, we will help you learn on the job): - Competency writing software in Go and Python. - Systems and network administration experience. For example, managing firewalls and routers, working with automation tools like SaltStack, and managing virtual machines on both physical and cloud infrastructure. - Domain-specific knowledge: PKI and some cryptography. https://www.abetterinternet.org/careers/ for more details

https://www.abetterinternet.org/ https://www.abetterinternet.org/about/ https://www.memorysafety.org/

>Side note: I was expecting this CEO letter to end with layoffs. Best I can tell from their 2022 Annual Report, they operate pretty lean...22 employees and 10 board members. (see page 44) https://www.abetterinternet.org/documents/2022-ISRG-Annual-Report.pdf

Let's Encrypt / ISRG | Software Engineer (SRE) | REMOTE (U.S. or Canada) | FULL-TIME Billions of people rely on Let's Encrypt (ISRG) to operate critical digital infrastructure for a more secure and privacy-respecting world. Living up to such great responsibility starts with hiring excellent people and providing them with an environment in which they can do their best work. People generally do their best work when they're able to live their best lives outside of work. All of our position are remote so you can live near whoever, or whatever, is most important to you. Competitive salaries and 100% 401(k) matching help you to reach your financial goals. Top-tier health insurance gives you peace of mind and great options for staying healthy. Multiple positions: https://www.abetterinternet.org/careers/

Let's encrypt is not run for profit, and is sponsored by many companies. https://letsencrypt.org/about/ https://www.abetterinternet.org/

Let's Encrypt | SENIOR SOFTWARE ENGINEER | US, CANADA | REMOTE | FULL TIME https://www.abetterinternet.org/careers/ We’re making HTTPS easier for developers to use, we’re doing it at scale, and we need your help. We’re a first-of-our-kind Certificate Authority (CA). We make TLS/SSL certificates available to anyone, for free, and we offer an API to do it. This means more people can enable HTTPS on their websites, with less work. That protects everyone’s web traffic from snoops, and makes us all safer. We’re looking for an additional software engineer. Maybe that’s you! Here’s what we’d like you to bring to our team: - At least a year’s experience writing code in Go, or a couple of years in another compiled language. - Attention to detail and a willingness to spend the time it takes to get things right. - Experience writing unit tests and integration tests. - Excellent communication, organization, and prioritization skills. - Prior experience with cryptography and PKI is not required. We will provide on-the-job training. Check out the job posting to learn more about what our software engineering team does and how you can help. https://www.abetterinternet.org/careers

Let's Encrypt is run by a nonprofit organization [1], funded by corporate and individual sponsors (like Google and AWS, but also the EFF and Mozilla) [2]. That doesn't guarantee they don't have malicious intents, but it's different from a for-profit company that tries to make money with you. [1] https://www.abetterinternet.org/about/ [2] https://www.abetterinternet.org/sponsors/

No, Let's Encrypt is an independent entity. https://www.abetterinternet.org/about/ > ISRG is a California public benefit corporation, and is recognized by the IRS as a tax-exempt organization under Section 501(c)(3) of the Internal Revenue Code.

But Google is one of their top sponsors: https://www.abetterinternet.org/sponsors/

Includes this letter from Executive Director: https://www.abetterinternet.org/post/eoy-letter-2024/

Parent 501(c)(3) of Let's Encrypt, among other projects, and $300-350k per year donation. https://www.abetterinternet.org/about/ https://www.abetterinternet.org/sponsor/

This post lists ISRG (Internet Security Research Group) and Google as to be thanked in particular for financial support. I'm sure everybody reading HN knows who Google are, but ISRG are the not-for-profit behind Let's Encrypt among other things: https://www.abetterinternet.org/about/

Earlier this year the ISRG made a post titled "Preparing ?Rustls for Wider Adoption" https://www.abetterinternet.org/post/preparing-rustls-for-wider-adopti… that references Curl, Apache, and Let's Encrypt. Cloudflare uses ring, but not exclusively (last I heard).

Let's Encrypt & Prio Services (ISRG) | Full-time | 100% Remote (United States or Canada) | Software Engineer (SRE) We’re looking for an additional software engineer for our Site Reliability Engineering (SRE) team. Maybe that’s you! Our SRE team works on both Let's Encrypt and Prio Services. At any given time you may work on one or the other. With Let's Encrypt, we’re making HTTPS easier for developers to use and we’re doing it at scale. We’re a first-of-our-kind Certificate Authority (CA). We make certificates available to anyone, for free, and we offer an API to do it. This means more people can enable HTTPS on their websites, with less work. That protects everyone’s web traffic from snoops, and makes us all safer. With Prio Services, we're helping organizations collect the metrics they need while fully respecting user privacy. https://www.abetterinternet.org/careers/isrg-sre-sw/

The example from the ISRG blog [1] directly contradicts the assumption you're making: > Memory safety vulnerabilities represent one of the biggest threats to Internet security. As such, we at ISRG are interested in finding ways to make the most heavily relied-upon software on the Internet memory safe. Today we’re excited to announce that we’re working with Daniel Stenberg, author of ubiquitous curl software, and WolfSSL, to make critical parts of the curl codebase memory safe. > ISRG is funding Daniel to work on adding support for Hyper as an HTTP back-end for curl. Hyper is a fast and safe HTTP implementation written in Rust. I too found the post terse and the lack of quantification of the financial commitment makes me suspicious but I think they deserve the benefit of the doubt for now. [1] https://www.abetterinternet.org/post/memory-safe-curl/

Since they don't do that (it's right there in the announcement, which no one in this thread seems to have bothered to read) that whole point is moot: > The ISRG's approach of working directly with maintainers to support rewriting tools and libraries incrementally falls directly in line with our perspective here at Google. And a link to: https://www.abetterinternet.org/post/memory-safe-curl/

The article says that Google is committing funding to the ISRG (https://abetterinternet.org). It isn't really clear whether that is one-off funding, or the start of an ongoing relationship. The ISRG seems to have two projects of this type mentioned on its website: an improvement to curl (https://www.abetterinternet.org/post/memory-safe-curl/), in which the ISRG funded the curl author directly; and an improvement to httpd (https://www.abetterinternet.org/post/memory-safe-tls-apache/), in which Google (via the ISRG) are funding an httpd committer.

At least for curl the project leadership is closely involved, as evidenced by a related article on Stenbergs blog [1] and the ISRG annoucement [2], which mentions funding Stenberg directly and is actually linked from this anouncement... Please don't make statements like that without doing a minimal amount of effort to verify. [1] https://daniel.haxx.se/blog/2020/10/09/rust-in-curl-with-hyper/ [2] https://www.abetterinternet.org/post/memory-safe-curl/

I guess we'll change the URL to that from https://www.abetterinternet.org/post/memory-safe-curl/, since the blog post has at least some technical detail. Thanks!

How is LE funded? [edit] At least partly through corporate sponsership: https://www.abetterinternet.org/sponsors/

A lot of this is covered in the Let's Encrypt retrospective paper from 2019: https://www.abetterinternet.org/documents/letsencryptCCS2019.pdf. From Section 3.1. "Let’s Encrypt was created through the merging of two simultaneous efforts to build a fully automated certificate authority. In 2012, a group led by Alex Halderman at the University of Michigan and Peter Eckersley at EFF was developing a protocol for automatically issuing and renewing certificates. Simultaneously, a team at Mozilla led by Josh Aas and Eric Rescorla was working on creating a free and automated certificate authority. The groups learned of each other’s efforts and joined forces in May 2013. ... Initially, ISRG had no full-time staff. Richard Barnes of Mozilla, Jacob Hoffman-Andrews of EFF, and Jeff Hodges (under contract with ISRG) began developing Let’s Encrypt’s CA software stack. Josh Aas and J.C. Jones, both with Mozilla at the time, led infrastructure development with assistance from Cisco and IdenTrust engineers. ISRG’s first full-time employee, Dan Jeffery, joined in April 2015 to help prepare the CA’s infrastructure for launch. Simultaneously, James Kasten, Peter Eckersley, and Seth Schoen worked on the initial ACME client (which would eventually become Certbot) while at the University of Michigan and EFF. Kevin Dick of Right Side Capital Management, John Hou of Hou & Villery, and Josh Aas constituted the team responsible for completing a trusted root partnership deal and signing initial…

How do these articles keep getting to the front of HN... > The certificates provide no security: The way you verify your identity to Let's Encrypt... you place a file somewhere on your website, and they access > Automatic renewal is insecure: certbot ... downloads a bunch of untrusted data from the web, and then feeds that data into your web server, all as root... False, this is NOT the only way. You can do it by setting a TXT DNS record. No files involved. Your server communicates with the registrar through API over an encrypted connection. > Manual renewal isn't free... You're not supposed to manually review Let's Encrypt in the first place. The whole point is that you set up cron job once and forget about it. > HTTPS is a trap: Once you've moved your websites to HTTPS, there's no going back to plain HTTP... Not true. You can run HTTP version of your website in parallel if you so desire. > Let's Encrypt is founded on the benevolence of scoundrels: Let's Encrypt isn't free to run, either. Their 2019 operating budget is 3.6 million U.S. dollars. Most of that is donated by… guess who? _Your competitors_[1]. EFF and Mozilla foundation are not my competitors LOL. [1] https://www.abetterinternet.org/sponsors/ >It's bad engineering: When you install a certificate with a three-month expiration... https://letsencrypt.org/2015/11/09/why-90-days https://letsencrypt.org/2025/01/16/6-day-and-ip-certs