hedgehog

Not to mention books. I'm not sure if we'll ever see another Harry Potter level book again, at least in our lifetimes.

Are you talking quality or popularity? Because there are many, many books that are just as good or better than Harry Potter.

Good call - I took it upon myself to add one, here you go:

They’re focused entirely on the shitty practices those other manufacturers engaged in. In that regard, Valve didn’t do much (and that’s a good thing).

Anyone buying a new iPhone still gets a USB C cable. This only applies to Airpods.

This isn’t relevant to people purchasing iPhones, as those come with a cable. This is only relevant to people purchasing the newest Airpods.

Which system(s) are you playing on?

This is about Airpods. The phone still includes the cable.

I’m more concerned about them using the word “sapient.” My dog is sentient; it’s not a high bar to clear.

But what about ... new users entering the Apple ecosystem?

What ecosystem do they think people are coming from where they didn’t already have a USB C cable or wireless charger?

EDIT: This refers only to the new Airpods, not to iPhones. iPhones still come with a charging cable.

Good to know! I saw that mentioned on some (apparently outdated) Comodo marketing copy as a benefit over LE

EV certs give you an extra green bar or something along those lines. If your customers care about it, then you have to. If they don’t - and they probably don’t - it’s a waste.

What exactly are you trusting a cert provider with and what are the security implications?

End users trust the cert provider. The cert provider has a process that they use to determine if they can trust you.

What attack vectors do you open yourself up to when trusting a certificate authority with your websites' certificates?

You’re not really trusting them with your certificates. You don’t give them your private key or anything like that, and the certs are visible to anyone navigating to your website.

Your new vulnerabilities are basically limited to what you do for them - any changes you make to your domain’s DNS config, or anything you host, etc. - and depend on that introducing a vulnerability of its own. You also open a new phishing attack vector, where someone might contact you, posing as the certificate authority, and ask you to make a change that would introduce a vulnerability.

In what way could it benefit security and/or privacy to utilize a paid service?

For most use cases, as far as I know, it doesn’t.

LetsEncrypt doesn’t offer EV or OV certificates, which you may need for your use case. However, these are mostly relevant at the enterprise level. Maybe you have a storefront and want an EV cert?

LetsEncrypt also only offers community support, and if you set something up wrong you could be less secure.

Other CAs may offer services that enhance privacy and security, as well, like scanning your site to confirm your config is sound… but the core offering isn’t really going to be different (aside from LE having intentionally short renewal periods), and theoretically you could get those same services from a different vendor.