←back to thread

Running a Certificate Transparency log

(words.filippo.io)
160 points Metalnem | 3 comments | 07 Jul 25 20:36 UTC | HN request time: 0s | source
Show context
gslin ◴[08 Jul 25 00:24 UTC] No.44495857[source]▶
> You Should Run a Certificate Transparency Log

And:

> Bandwidth: 2 – 3 Gbps outbound.

I am not sure if this is correct, is 2-3Gbps really required for CT?

replies(3): >>44497422 #>>44497536 #>>44501107 #
remus ◴[08 Jul 25 05:45 UTC] No.44497422[source]▶
It seems like Fillipo has been working quite closely with people running existing ct logs to try and reduce the requirements for running a log, so I'd assume he has a fairly realistic handle on the requirements.

Do you have a reason to think his number is off?

replies(2): >>44497620 #>>44498502 #
1. ApeWithCompiler ◴[08 Jul 25 06:28 UTC] No.44497620[source]▶
> or an engineer looking to justify an overprovisioned homelab

In Germany 2 – 3 Gbps outbound is a milestone, even for enterprises. As a individual I am privileged to have 250Mbs down/50Mbs up.

So it`s at least off by what any individual in this country could imagine.

replies(2): >>44497934 #>>44503843 #
2. jeroenhd ◴[08 Jul 25 07:39 UTC] No.44497934[source]▶
You can rent 10gbps service from various VPS providers if you can't get the bandwidth at home. Your home ISP will probably have something to say about a continuous 2gbps upstream anyway, whether it's through data caps or fair use policy.

Still, even in Germany, with its particularly lacking internet infrastructure for the wealth the country possesses, M-net is slowly rolling out 5gbps internet.

3. nucleardog ◴[08 Jul 25 20:36 UTC] No.44503843[source]▶
Yeah the requirements aren't too steep here. I could easily host this in my "homelab" if I gave a friend a key to access my utility room if I were away / unavailable.

But 2-3Gbps of bandwidth makes this pretty inaccessible unless you're just offloading the bulk of this on to CloudFront/CloudFlare at which point... it seems to me we don't really have more people running logs in a very meaningful sense, just somebody paying Amazon a _lot_ of money. If I'm doing my math right this is something like 960TB/mo which is like a $7.2m/yr CloudFront bill. Even some lesser-known CDN providers we're still talking like $60k/yr.

Seems to me the bandwidth requirement means this is only going to work if you already have some unmetered connections laying around.

If anyone wants to pay the build out costs to put an unmetered 10Gbps line out to my house I'll happily donate some massively overprovisioned hardware, redundant power, etc!