I am a co-author of Mandos – thanks for the plug! ☺ The canonical link is (https...

benedikt · on May 27, 2015

I saw your talk at FOSDEM this year and Mandos was one of the biggest take-aways this year for me.

ryan-c · on May 27, 2015

I am assuming you're morally opposed to paying $10/yr for a certificate, but why not use StartSSL and avoid what is probably a very high bounce rate?

teddyh · on May 27, 2015

1. The web page is not the primary entry point for the program; the Debian package is. So I don’t think the “bounce rate” is that large of a problem.

2. CAcert was chosen when the system was used for different purposes, in a different environment, by a different audience, and at a time when Debian shipped browsers with CACert’s root cert included. After that, it’s just been inertia.

3. I quote from the StartSSL F.A.Q.¹: “The Terms and Conditions of StartCom and the StartCom Certification Policy requires subscribers to provide the correct and complete personal details during registration.”. I generally don’t create accounts with external services, and as a sysadmin, I can and do run everything myself.

① https://www.startssl.com/?app=25#1