Earlier quoted context omitted.
Less hassle? You have to renew it every a few months.
You're supposed to renew them automatically from a monthly cron job.
I don't really trust an automatic tool with my configuration files, to be honest...
Why isn't HTTPS everywhere yet?
101–110 of 130 posts
Re: Why isn't HTTPS everywhere yet?
#102Earlier quoted context omitted.
You're supposed to renew them automatically from a monthly cron job.
I don't really trust an automatic tool with my configuration files, to be honest...
The config files are only changed when it first installs the certificates. Renewals just replace the certificates in /etc/letsencrypt/.
Re: Why isn't HTTPS everywhere yet?
#103Re: Why isn't HTTPS everywhere yet?
#104Still no mention about ads. Using HTTPS means you have to load ads over HTTPS and a huge number of ad networks are not reachable over HTTPS and another large number of assets / tags are hard coded to fetch HTTP resources. For any ad supported website, HTTPS will cause a significant loss of ad revenue. Given how long it's taking the industry to transition away from Flash I'm not holding my breath about this being fixe…
Facebook (in addition to Google, as mentioned above) has already required all 3rd party ads to be served over https both on their core site and on all apps on their desktop platform.
Re: Why isn't HTTPS everywhere yet?
#105Earlier quoted context omitted.
The cipher list is effectively a big issue. When using the good old Sun Fortran compiler, I was used to have a -fast flag which would be smart to detect the hardware and be as fast as possible while respecting the IEEE maths (as far as I can remember). I would love a -secure flag to just use the most secure option of the current version of the software even at the cost of X years of backward compatibility at the tool…
Or they should package it in vestions. "TLS 1.3" would come with a standard list of ciphers and other parameters. All you would have to do is tell your system "Disable SSL3.0" "Enable TLS 1.3", etc. Right now it feels like trying to fly a B747.
That does happen! Enable TLS 1.2 only and you're in pretty good shape. TLS 1.3 will drop more bad stuff and add a bit more good stuff.
Re: Why isn't HTTPS everywhere yet?
#106Another big blocker is cost. For example, one of the biggest CDNs in the world (I'm looking at you, Akamai), charge dramatically more for delivering content over HTTPS. Let's say you're delivering video content at scale, the difference between HTTP and HTTPS delivery can be many millions of dollars a year. But why not use a different CDN, say Cloudfront which prices the same for HTTP and HTTPS?, well, simple, the sam…
MaxCDN serves us pretty well (a few TB/mo). It has been much much cheaper than Cloudfront ever was (mostly due to not charging by number of requests).
Re: Why isn't HTTPS everywhere yet?
#107Something that no one has seemed to mention: it doesn't work on shared hosting, it requires a static IP. For small sites, the additional cost of moving to a plan that supports SSL and has a static IP, this could be a big cost.
Your comment shows another problem: Myths stay around.
This problem was technically fixed 13 years ago, yet I still hear this claim on a regular basis. (Unfortunately it is still a problem if you have a large user basis with legacy clients, meaning mostly Windows XP and very old Androids. But for most people that shouldn't matter.)
Re: Why isn't HTTPS everywhere yet?
#108"Why isn't HTTPS everywhere yet?": Because it makes absolutely no sense for the vast majority of online content. Email in https ? Sure. Reading news sites in https ? Accessing RFC in https ? My favorite online recipe site in https ? A total waste of money and CPU. Oh, and sure, the problem has been "solved" for few geeks using the latest browsers accepting let's encrypt certificates. Sure.
> Because it makes absolutely no sense for the vast majority of online content. So you use postcards for most "the vast majority" of your snail (postal service) mail, right? Because envelopes [1] make "absolutely no sense"? Besides the security issues that have already been mentioned of someone modifying the content as a MITM - something which ISPs are already doing[2] - this is really just another version of the "If…
Actually, yes. The vast majority of snail mail I receive is open catalogs and other junk mail. Its content is entirely public.
Re: Why isn't HTTPS everywhere yet?
#109Something that no one has seemed to mention: it doesn't work on shared hosting, it requires a static IP. For small sites, the additional cost of moving to a plan that supports SSL and has a static IP, this could be a big cost.
I host "small sites" with a shared hosting provider. Those clients who require or desire it, don't really baulk at the SSL cert and dedicated IP cost. Typically it's around $100/year.
Re: Why isn't HTTPS everywhere yet?
#110Another big blocker is cost. For example, one of the biggest CDNs in the world (I'm looking at you, Akamai), charge dramatically more for delivering content over HTTPS. Let's say you're delivering video content at scale, the difference between HTTP and HTTPS delivery can be many millions of dollars a year. But why not use a different CDN, say Cloudfront which prices the same for HTTP and HTTPS?, well, simple, the sam…
This isn't helped by the subset of CDN providers who use the enterprise sales models where they try to bundle services and set pricing based on your perceived ability to pay. It's always possible to negotiate a better deal but everyone has to burn the time needed to do that independently and can't publicly share the results.