The Internet Security Research Group is a nonprofit that runs Let's Encrypt and works on memory-safe internet software like curl and TLS modules.
HN links it mostly for job postings from ISRG and Let's Encrypt, and for its annual reports and memory safety projects.
A lot of this is covered in the Let's Encrypt retrospective paper from 2019: https://www.abetterinternet.org/documents/letsencryptCCS2019.pdf.
From Section 3.1.
"Let’s Encrypt was created through the merging of two simultaneous efforts to build a fully automated certificate authority. In 2012, a group led by Alex Halderman at the University of Michigan and Peter Eckersley at EFF was developing a protocol for automatically issuing and renewing certificates. Simultaneously, a team at Mozilla led by Josh Aas and Eric Rescorla was working on creating a free and automated certificate authority. The groups learned of each other’s efforts and joined forces in May 2013.
...
Initially, ISRG had no full-time staff. Richard Barnes of Mozilla, Jacob Hoffman-Andrews of EFF, and Jeff Hodges (under contract with ISRG) began developing Let’s Encrypt’s CA software stack. Josh Aas and J.C. Jones, both with Mozilla at the time, led infrastructure development with assistance from Cisco and IdenTrust engineers. ISRG’s first full-time employee, Dan Jeffery, joined in April 2015 to help prepare the CA’s infrastructure for launch. Simultaneously, James Kasten, Peter Eckersley, and Seth Schoen worked on the initial ACME client (which would eventually become Certbot) while at the University of Michigan and EFF. Kevin Dick of Right Side Capital Management, John Hou of Hou & Villery, and Josh Aas constituted the team responsible for completing a trusted root partnership deal and signing initial…
Internet Security Research Group (ISRG) | Let's Encrypt Site Reliability Engineer (SRE) | Full time | Remote (USA) | https://abetterinternet.org
ISRG was founded in 2013 to serve as a home for public-benefit digital infrastructure projects, the first of which was the Let's Encrypt certificate authority. In 2021, ISRG launched two new digital security projects: Prossimo, a memory safety project, and Divvi Up, a privacy-preserving metrics system.
We're looking for a mid-level engineer for our Let's Encrypt SRE team!
Position Must Haves:
- 2+ years work experience programming in a compiled language with consistent attention paid to high quality tests.
- 2+ years working professionally with Linux.
- Attention to detail and a willingness to take time to think things through.
- Ability to prioritize and maintain cognizance of your priorities in your work.
- Excellent written, verbal, and collaborative communication skills.
- Reliable time and task management.
Position Nice to Haves (if you don't know these already, we will help you learn on the job):
- Competency writing software in Go and Python.
- Systems and network administration experience. For example, managing firewalls and routers, working with automation tools like SaltStack, and managing virtual machines on both physical and cloud infrastructure.
- Domain-specific knowledge: PKI and some cryptography.
https://www.abetterinternet.org/careers/ for more details
How do these articles keep getting to the front of HN...
> The certificates provide no security: The way you verify your identity to Let's Encrypt... you place a file somewhere on your website, and they access > Automatic renewal is insecure: certbot ... downloads a bunch of untrusted data from the web, and then feeds that data into your web server, all as root...
False, this is NOT the only way. You can do it by setting a TXT DNS record. No files involved. Your server communicates with the registrar through API over an encrypted connection.
> Manual renewal isn't free...
You're not supposed to manually review Let's Encrypt in the first place. The whole point is that you set up cron job once and forget about it.
> HTTPS is a trap: Once you've moved your websites to HTTPS, there's no going back to plain HTTP...
Not true. You can run HTTP version of your website in parallel if you so desire.
> Let's Encrypt is founded on the benevolence of scoundrels: Let's Encrypt isn't free to run, either. Their 2019 operating budget is 3.6 million U.S. dollars. Most of that is donated by… guess who? _Your competitors_[1].
EFF and Mozilla foundation are not my competitors LOL.
[1] https://www.abetterinternet.org/sponsors/
>It's bad engineering: When you install a certificate with a three-month expiration...
https://letsencrypt.org/2015/11/09/why-90-days
https://letsencrypt.org/2025/01/16/6-day-and-ip-certs
Internet Security Research Group (ISRG) | Divvi Up Software Engineer | Full time | Remote (USA) | https://abetterinternet.org
ISRG was founded in 2013 to serve as a home for public-benefit digital infrastructure projects, the first of which was the Let's Encrypt certificate authority. In 2021, ISRG launched two new digital security projects: Prossimo, a memory safety project, and Divvi Up, a privacy-preserving metrics system.
We're looking for a mid-level engineer for our Divvi Up team!
Position Must Haves:
- 2+ years work experience programming in a compiled language.
- Ability to design, develop, ship, and maintain features with some guidance from more experienced engineers.
- Code implementation that is clear, concise, tested, maintainable, and easily understood by others.
- Ability to perform supportive and constructive code reviews.
- Consistent attention paid to producing a high-quality testing strategy.
- Attention to detail and a willingness to take time to think things through.
- Ability to prioritize and maintain cognizance of your priorities in your work.
- Excellent written, verbal, and collaborative communication skills.
- Reliable time and task management.
https://www.abetterinternet.org/careers/ for more details
Let's Encrypt | SENIOR SOFTWARE ENGINEER | US, CANADA | REMOTE | FULL TIME https://www.abetterinternet.org/careers/
We’re making HTTPS easier for developers to use, we’re doing it at scale, and we need your help. We’re a first-of-our-kind Certificate Authority (CA). We make TLS/SSL certificates available to anyone, for free, and we offer an API to do it. This means more people can enable HTTPS on their websites, with less work. That protects everyone’s web traffic from snoops, and makes us all safer.
We’re looking for an additional software engineer. Maybe that’s you!
Here’s what we’d like you to bring to our team:
- At least a year’s experience writing code in Go, or a couple of years in another compiled language.
- Attention to detail and a willingness to spend the time it takes to get things right.
- Experience writing unit tests and integration tests.
- Excellent communication, organization, and prioritization skills.
- Prior experience with cryptography and PKI is not required. We will provide on-the-job training.
Check out the job posting to learn more about what our software engineering team does and how you can help.
https://www.abetterinternet.org/careers
Let's Encrypt & Prio Services (ISRG) | Full-time | 100% Remote (United States or Canada) | Software Engineer (SRE)
We’re looking for an additional software engineer for our Site Reliability Engineering (SRE) team. Maybe that’s you!
Our SRE team works on both Let's Encrypt and Prio Services. At any given time you may work on one or the other.
With Let's Encrypt, we’re making HTTPS easier for developers to use and we’re doing it at scale. We’re a first-of-our-kind Certificate Authority (CA). We make certificates available to anyone, for free, and we offer an API to do it. This means more people can enable HTTPS on their websites, with less work. That protects everyone’s web traffic from snoops, and makes us all safer.
With Prio Services, we're helping organizations collect the metrics they need while fully respecting user privacy.
https://www.abetterinternet.org/careers/isrg-sre-sw/