| > Why not just make it open source? It is. > And let other people work on it and just cover 3 people managing this + architecture costs. Um, Lets Encrypt, in the course of the last year has inadvertently become one of the largest issuers, and has become critical infrastructure for many of it's users who would suddenly have to pay for certificates, assuming they configured LE certs and Strict Transport Security. If LE was only 3 "managers" + cloud infrastructure, it wouldn't be reliable. > You don't need 2.9 mil per year to process 60k certificate requests a day with system that is practically finished. What else is there to do which open source community could not do it itself? The service isn't "practically finished", they need to continue to improve the service to reduce costs, improve the operations capabilities of the service as it grows,
From LE:
Staffing is our dominant cost. We currently have eight full time employees, plus two full time staff that are employed by other entities (Mozilla and EFF). This includes five operations/sysadmin staff, three software developers, one communications and fundraising person, and an executive director. >Thousands of companies and developers use letsencrypt, a lot of potential man power to help if you ask me. You could easily cut costs 5-6 times. Or am i missing something here? You are missing alot... this is not an open source project that anyone other than an existing CA can consume and hit the ground running. If any other major CA decided to consume Boulder, and offer it as a service, they could eat LE for lunch, but for anyone else, they need a massive investment in the logistics of becoming a CA. Over and above that, LE is a team run on a shoestring, and yet they are building out infrastructure that is likely to be highly targeted by a broad range of attackers. Wether it's DoS, folks trying to get mis-issued certs, or a number of other objectives, that they are running and keeping the service up with that few people and that little money is an impressive feat. |