Insufficient.Coffee

Reflecting on 10 years of Let's Encrypt

2025-12-03T00:00:00+00:00
My friend Christophe Brocas has just published a retrospective on the ten years since we unveiled the ACME protocol to the world</a>. He interviewed me and some colleagues for the piece, and I recommend it!
The Open Source Cryptography Workshop is returning for 2026

2025-11-06T00:00:00+00:00
After taking a year off from organizing OSCW 2025, I'm back for next year's event in Taipei</a>.
Attending Real World Crypto and the Open Source Cryptography Workshop 2024

2024-03-14T00:00:00+00:00
I'll be attending the Real World Crypto Symposium in Toronto</a> in two weeks time, and after that, I'm once again co-organizing the Open Source Cryptography Workshop</a>.
Make It Memory Safe: Adapting curl to use Rustls

2023-03-30T00:00:00+00:00
As I mentioned in my post about attending Real World Crypto 2023 and the Open Source Cryptography Workshop</a>, I've given a talk discussing Rustls-FFI</a> and the work to allow curl</code> and libcurl</code> to use the Rust-based, memory-safe Rustls TLS library</a> in a talk called Make It Memory Safe: Adapting Curl to use Rustls</em>.


Nevermind about RWC and OSCW: COVID instead
2023-03-25T00:00:00+00:00
At this point I'm supposed to be in Tokyo, attending the Real World Crypto Symposium in Tokyo</a> next week, and after that, I'm co-organizing and speaking at</a> the Open Source Cryptography Workshop</a>. But I've gotten COVID-19 again, instead.


Attending Real World Crypto and the Open Source Cryptography Workshop 2023
2023-03-21T00:00:00+00:00
I'll be attending the Real World Crypto Symposium in Tokyo</a> next week, and after that, I'm co-organizing and speaking at</a> the Open Source Cryptography Workshop</a>.


Moving Human Blood Around Arizona
2021-08-06T00:00:00+00:00
I'd never thought about the logistics of moving donated blood around. The actual donation part is known to be a universally good thing to do, but I'd never searched out what happens next until I heard a fellow pilot talk about volunteering to move platelets around Arizona.…
</p>


Design of the CRLite Infrastructure
2020-12-01T00:00:00+00:00
Firefox is the only major browser that still evaluates every website it connects to whether the certificate used has been reported as revoked. Firefox users are notified of all connections involving untrustworthy certificates, regardless the popularity of the site. Inconveniently, checking certificate status sometimes slows down the connection to websites. Worse, the check reveals cleartext information about the website you’re visiting to network observers.…
</p>


Auditing the CRLs in CRLite
2020-11-27T00:00:00+00:00
Since Firefox Nightly is now using CRLite</a> to determine if enrolled websites' certificates are revoked, it's useful to dig into the data to answer why a given certificate issuer gets enrolled or not.…
</p>


Querying CRLite for WebPKI Revocations
2020-11-26T00:00:00+00:00
Firefox Nightly is now using CRLite</a> to determine if websites' certificates are revoked — e.g., if the Certificate Authority published that web browsers shouldn't trust that website certificate. Telemetry shows that querying the local CRLite dataset is much faster than making a network connection for OCSP</a>, which makes intuitive sense. It also avoids sending the website's certificate information in cleartext over the network to check the revocation status: solving one of the remaining cleartext browsing data leakages in Firefox.


Austin or Bust: A Post-Y'allhands Adventure
2020-11-01T00:00:00+00:00
Due to a variety of factors, Mozilla changed venues for our 2017 winter all-hands meeting to Austin, Texas, and Austin being a city with relatively poor commercial airline connectivity, ticket prices were fairly high even for me to fly there from Phoenix.…
</p>


Berlin By Air
2020-10-05T00:00:00+00:00
I have had business dealings requiring me to visit Berlin regularly for the last 5 years, and in 2018 I finally made the trip outside of the city to Strausberg Airport</a> to rent a Cessna 172SP Skyhawk.…
</p>


Returning Home and Flying in Northwest Florida
2020-09-30T00:00:00+00:00
While I lived in a lot of different places as a child, I came of age along the Florida panhandle, and for that reason it'll always hold a special place in my heart.…
</p>


Watching Hawaii Boil the Pacific Ocean
2020-09-29T00:00:00+00:00
I've had a lot more opportunity to travel since I joined Mozilla</a>, and it eventually occurred to me: I could rent aircraft in some of these places I was visiting, and see those places in a different way.…
</p>


Blog upgrades and a long-awaited new domain, insufficient.coffee
2020-06-25T00:00:00+00:00
I've been running this blog on an LTS version of Ubuntu that has recently halted Long Term Support,
so while migrating data I'm also reworking parts of this blog, including a long-anticipated move
from tacticalsecret.com</a> (what a ... term) to the timeless
domain insufficient.coffee</a>.…
</p>


CRLite: Speeding Up Secure Browsing
2020-01-21T00:00:00+00:00
CRLite pushes bulk certificate revocation information to Firefox users, reducing the need to actively query such information one by one. Additionally this new technology eliminates the privacy leak that individual queries can bring, and does so for the whole Web, not just special parts of it.…
</p>


Introducing CRLite: All of the Web PKI’s revocations, compressed
2020-01-09T00:00:00+00:00
CRLite</a> is a technology proposed by a group of researchers at the IEEE Symposium on Security and Privacy 2017</a> that compresses revocation information so effectively that 300 megabytes of revocation data can become 1 megabyte.


The End-to-End Design of CRLite
2020-01-09T00:00:00+00:00
CRLite is a technology to efficiently compress revocation information for the whole Web PKI into a format easily delivered to Web users. It addresses the performance and privacy pitfalls of the Online Certificate Status Protocol (OCSP) while avoiding a need for some administrative decisions on the relative value of one revocation versus another.…
</p>


Web Authentication in Firefox for Android
2019-08-05T00:00:00+00:00
Firefox for Android (Fennec)</a> now supports the Web Authentication API</a> as of version 68</a>.


Making HTTPS Revocations Work: CRLite (Lightning Talk)
2018-12-04T00:00:00+00:00
I gave a lightning talk at our Mozilla All-Hands meeting about CRLite</a>, a new technology for delivering revocations for the Web PKI to all clients in a very compressed form.


Trying Out Web Authentication (WebAuthn)
2018-01-11T00:00:00+00:00
Web Authentication</a> is now enabled in Firefox Nightly</a>, with intent to ship in version 60</a>.


Countering Phishing with Cryptography - WebAuthn (Lightning Talk)
2017-12-04T00:00:00+00:00
At Mozilla's Austin All-Hands I gave a lightning talk about Web Authentication</a>, which is our best technical solution to the scourge of phishing today.


The State of CRLs Today
2017-08-18T00:00:00+00:00
Certificate Revocation Lists (CRLs) are a way for Certificate Authorities to announce to their relying parties (e.g., users validating the certificates) that a Certificate they issued should no longer be trusted. E.g., was revoked.…
</p>


Cutting over Let's Encrypt's Statistics to Map/Reduce
2017-07-10T00:00:00+00:00
We're changing the methodology</a> used to calculate the Let's Encrypt Statistics page</a>, primarily to better cope with the growth of Let's Encrypt. Over the past several months it's become clear that the existing methodology is less accurate than we had expected, over-counting the number of websites using Let's Encrypt, and the number of active certificates. The new methodology is more easily spot-checked, and thus, we believe, is more accurate.


Analyzing Let's Encrypt statistics via Map/Reduce
2017-05-16T00:00:00+00:00
I've been supplying the statistics for Let's Encrypt since they've launched. In Q4 of 2016 their volume of certificates exceeded the ability of my database server to cope, and I moved it to an Amazon RDS instance.…
</p>


The end of SHA-1 on the Public Web
2017-02-23T00:00:00+00:00
Our deprecation plan for the SHA-1 algorithm in the public Web, first announced in 2015</a>, is drawing to a close. Today a team of researchers from CWI Amsterdam and Google revealed the first practical collision for SHA-1</a>, affirming the insecurity of the algorithm and reinforcing our judgment that it must be retired from security use on the Web.


Demoing Let's Encrypt at the Phoenix DevOps Meetup in February
2016-12-19T00:00:00+00:00
The Phoenix DevOps Meetup has asked me to do a walk-through of how to encrypt  a website using Let's Encrypt for their February meetup</a>. I don't believe this talk will be recorded, but for any locals who want to discuss PKI, I'll be available after.


A Big Tent in America
2016-11-10T00:00:00+00:00
The electoral college has legitimized an agenda that seeks to tell many of my friends and colleagues that they are not welcome in America. That they are only to be tolerated in the shadows. That denigrating them is acceptable national discourse, and will be rewarded with prestige.…
</p>


Let's Encrypt's Growth to 10 Million Active Unique FQDNs
2016-09-30T00:00:00+00:00
Yesterday Let's Encrypt reached a new milestone: the unique set of all fully-qualified domain names in the currently-unexpired certificates issued by Let's Encrypt is now 10,022,446</strong>.…
</p>


Long Instrument Cross-Country Training Flight
2016-09-08T00:00:00+00:00
I'm training to be able to fly in clouds and other poor visibility situations. Part of the requirements for this "Instrument Rating" is to fly cross-country, on instrument rules, and do instrument landings at three airports, a task I undertook last Friday…
</p>


Utility of an Instrument Rating
2016-08-11T00:00:00+00:00
I am training right now for my instrument rating add-on</a> to my private pilot certificate. For years I said that there was little point to me having this rating, because in Arizona, when there is</em> weather, you don't want to fly in it.


The Road to Encrypting All The Things: RMLL 2016 (Paris)
2016-07-05T00:00:00+00:00
Today at the RMLL conference's security track</a> I'm talking about some of the challenges, decisions, and trade-offs that occurred while launching Let's Encrypt, in a talk I've called  Let’s Encrypt: The Road To Encrypting All The Things</a>.


124 Days of Let's Encrypt
2016-04-05T00:00:00+00:00
This is a quick status update from the Early Impacts of Let's Encrypt</a> post.…
</p>


Early Impacts of Let's Encrypt
2016-02-19T00:00:00+00:00
During the months I worked in Let's Encrypt's operations team I got fairly used to being the go-to man for any question that a database query could solve.…
</p>


Issuance Rate for Let's Encrypt
2016-01-21T00:00:00+00:00
Gathering data from Certificate Transparency logs</a>, here's a snapshot in time of Let's Encrypt's certificate issuance rate per minute from 15-21 January 2016


Content Security Policy Enabled
2016-01-19T00:00:00+00:00
I spent some time over the last week working up a safe Content Security Policy</a> for this website


Renewing Let's Encrypt Certs (Nginx)
2016-01-15T00:00:00+00:00
All the first Let's Encrypt certs for my websites</a> from the LE private beta began expiring last week, so it was time to work through the renewal tooling


Let's Encrypt: Publicly Trusted
2015-10-20T00:00:00+00:00
A bigger blog post will have to wait, but just as a brief note:</p>
Let's Encrypt is now publicly trusted</a>. In fact, this blog is using a certificate from Let's Encrypt. And so is usr.bin.coffee</a>, of course.


Beta Testing Let's Encrypt
2015-10-08T00:00:00+00:00
One of the advantages to being part of the Let's Encrypt team is early access to the closed beta. As such, I've been able to issue a handful of certificates from the service. For example: usr.bin.coffee</a>. There's a lot of other upsides as well, such as working with incredible people to make something super-high visibility for the public good.


GatorLUG Presentation on Let's Encrypt
2015-04-10T00:00:00+00:00
GatorLUG</a> has invited me to talk about Let's Encrypt</a> at their April 2015 meeting. I'm honored to be playing a role in the architecture and implementation of Let's Encrypt; here are the slides I'll be presenting</a>.


Updated JSONResume
2014-11-20T00:00:00+00:00
I've posted a new version of my Bootstrap Icons</a> theme for JsonResume</a>


Net Neutrality
2014-11-18T00:00:00+00:00
Last night I received this political cartoon in my email:…
</p>


Service Assisted Communication and Simplifying a PKI
2014-09-09T00:00:00+00:00
Because many of the devices in the IoT are headless and have limited ability to interact with their owners, there needs to be a way to authenticate them without passwords, and without the shortcomings of the existing 0000 and 1234 problems</a> in the Bluetooth world.


JSONResume
2014-08-12T00:00:00+00:00
There's a quirky little project on the Internet proving once again that semi-structured data is just plain fun: JSONResume.org</a>.</p>


Garden Imp
2014-08-06T00:00:00+00:00
Using an Electric Imp</a> and two Vegetronix VH400 soil moisture sensors</a>, I am now able to monitor the water content</a> of two locations in my garden.</p>


Different PAN Parts: Auth-Only, Confidential and No Consequence
2014-08-06T00:00:00+00:00
Where the Internet of Things meets locations in the physical world, I envision scores of devices networking together to make life more efficient…
</p>


Public Authentication
2014-07-30T00:00:00+00:00
The public authentication problem is one we have all learned to solve with intuition: How do I decide to trust a new person?</em>…
</p>


Prevalence of Well Known Peers in the Internet of Things
2014-07-04T00:00:00+00:00
The Internet of Things is imagined to be a interconnection of sensors and physical devices of all kinds into the world’s information systems: a collection of machine-to-machine communication devices used to gather and distribute information about the world, contrasted with the human-machine interactions making up the bulk of today’s Internet. The machine-to-machine model places new restrictions on the common practices for security, as the standard practice of user authentication becomes troublesome without the regular involvement of a user.</p>