[hosh]

As far as I can tell, Let's Encrypt isn't a business model. It's funded by ISRG who describes themselves as a public-benefit corporation and is tax-exempt by the US tax authority. I don't see any direct profit motive for the ISRG itself, though there may be indirect profit benefits to the sponsors[1]. I don't see any direct ways Let's Encrypt takes payment; more likely, their revenue comes from donations.

What I don't get is why the CEO of Comodo, all the people on the thread all seem to assume Let's Encrypt has a business model, and that they are a competitor. The Comodo CEO seemed to keep coming back to that point, taking all of this personally. There is no business model to steal from Comodo because Let's Encrypt is not a business. And people kept responding and upholding that assumption?

Can someone give me a sanity check here on my logic? Am I the only person who sees this?

[1] https://community.letsencrypt.org/t/what-is-the-business-mod...

[mikeash]

Let's Encrypt offers something for free that Comodo charges money for. They are a competitor, even if they don't make money.

I think Comodo was crazy here, but I can totally understand why they see Let's Encrypt as a threat.

[hosh]

The Comodo CEO makes it sound as if Let's Encrypt was created to personally target him and his ideas. It's one thing to see Let's Encrypt as an existential threat, it's another to attribute malicious, personal intent on the part of Let's Encrypt. I don't think people are careful to make a distinction between impersonal competition and personal competition when speaking about this.

Also, by your argument, why would any CA allow the ISRG to use their certificates to sign free certificates? In the article I linked, there was a good argument made that creating a free SSL cert creates or enhances the market for more expensive certificates. There's a path open.

[thanatropism]

"Business model", "business plan" are terms of art which are not necessarily constrained to the profit motive.

Nonprofits need business models too.

[hosh]

I disagree. Not everything need a business model. We only think that because that is normative, not because it is necessarily true.

If by "business model" you mean, "how do we keep the lights going", that's fair. However, that's not the primary mission of Let's Encrypt.

[MaulingMonkey]

> If by "business model" you mean, "how do we keep the lights going", that's fair.

That was roughly my read. While "business" is frequently used as a synonym for "for profit company", that's not the only definition. Someone saying "that's none of your business" is unlikely to be talking about S corps.

> However, that's not the primary mission of Let's Encrypt.

It's the means by which they accomplish their primary mission. Can't encrypt the world if you can't keep your servers on.

[paulftw]

Bittorrent uploaders in general don't have a "business model" but are still a threat and a "competitor" to copyright holders. And are still breaking the law.

The point Comodo guy is trying to make is they invented/own the 90-day certificate, or specifically the magic number 90. If they actually do he has the moral right to be upset (but of course that doesn't mean trademark law or common sense stop being applicable to the words "Let's encrypt")

[johncolanduoni]

> invented/own the 90-day certificate

Seriously? Even the US patent office would balk at an application to patent 90-day trials or 90-day certificates. Also, Let's Encrypt isn't doing trials, so patenting the first wouldn't even make sense.

[_asummers]

Even if it doesn't... wouldn't Let's Encrypt just be able to change the default to 60 or something like that?

[johncolanduoni]

Yeah, but if it was a defensible patent they would still be on the hook for using it at all. Thankfully, Let's Encrypt could show literally hundreds of cases of prior art for X-day trials.