Sadly yeah. This is the draft of the email I'm going to send to the project updates mailing list:
Hello there,
I'm sad to say that I have decided to completely stop working on the
pki.io project. I haven't actively worked on it for about a year and don't see this changing any time soon.
The project was started because as a sysadmin I had the need to easily manage and deploy TLS certificates in a secure way. I think the usability and security models of
pki.io are still unique and powerful, but this project was started before Let's Encrypt and Netflix's Lemur were announced, so there are probably better alternatives out there now.
On a positive note, writing an open source security tool meant needing to threat model it in a modern, developer-centric way. Thus
pki.io gave birth to ThreatSpec.org which aims to make continuous threat modelling through code a reality. I'll definitely continue to work on ThreatSpec because it addresses a more general problem and I think that code-driven continuous threat modelling is a natural evolution of security shifting left.
If you'd like to help out with ThreatSpec, have thoughts or suggestions, please email me at
fra...@threatspec.org.
So, what's the future for
pki.io? Well, I'll leave the source code on GitHub. If you'd like to adopt the project in some way, drop me an email. Also, feel free to email me if you have any questions about
pki.io.
Thanks to everyone for your thoughts, feedback, code and support.
Cheers,
Fraser