Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing Free and Automated SSL Certs

blog.heroku.com

Post reply on HN
Print view View original

21–30 of 79 posts

Re: Announcing Free and Automated SSL Certs

#21

Post by kevindong »

Karunamon wrote: post #4

Free SSL.. for all paid dynos. Apparently, if you're developing an application, you are expected to be okay with having your stuff MITMed. Yes, this is me being excessively negative. Not having SSL-by-default in 2017 is excessively stupid. The certs are free, the system fully automated from both sides. Why hold back? There is no excuse for not having it system wide. Unencrypted HTTP needs to start being treated as th…

They are offering SSL free to all free dynos under the .herokuapp.com" rel="nofollow">https://.herokuapp.com domain. If they offered free SSL for custom domains too, what's the incentive to upgrade to a paid dyno for applications that don't require a large amount of resources?

To be fair to Heroku, they have the right to make a profit. As is, it's amazing that they offer a fully free tier. If you don't like their policies, you are free to not use their services.

Re: Announcing Free and Automated SSL Certs

#22

Post by Karunamon »

kevindong wrote: post #21
Karunamon wrote: post #4

Free SSL.. for all paid dynos. Apparently, if you're developing an application, you are expected to be okay with having your stuff MITMed. Yes, this is me being excessively negative. Not having SSL-by-default in 2017 is excessively stupid. The certs are free, the system fully automated from both sides. Why hold back? There is no excuse for not having it system wide. Unencrypted HTTP needs to start being treated as th…

They are offering SSL free to all free dynos under the .herokuapp.com" rel="nofollow">https:// .herokuapp.com domain. If they offered free SSL for custom domains too, what's the incentive to upgrade to a paid dyno for applications that don't require a large amount of resources? To be fair to Heroku, they have the right to make a profit. As is, it's amazing that they offer a fully free tier. If you don't like their po…

If they offered free SSL for custom domains too, what's the incentive to upgrade to a paid dyno for applications that don't require a large amount of resources?

This is exactly my point. The fact that companies are still bucketing "SSL" into "things we can charge extra for" rather than "things that should be the absolute minimum we provide" is irresponsible.

Plaintext on the public internet needs to go away in whole.

Re: Announcing Free and Automated SSL Certs

#25

Post by mattzito »

Karunamon wrote: post #18
michaelper22 wrote: post #5

Earlier quoted context omitted.

Free dynos with a ____.herokuapp.com domain have SSL enabled by default, at no cost (under their wildcard certificate?). Seems the only missing case is when using a custom domain with a free dyno.

It's an obvious missing case, and one that they are clearly conscious of given the constant insertion of the word "paid" in front of "dyno" throughout this announcement post. The mentality of holding out SSL as a paid addon needs to end. It needed to end years ago. It had no excuse to not end the moment LetsEncrypt went live.

Implementing support for LetsEncrypt SSL does have a cost associated with it, particularly at scale. I think restricting the feature to paid users is totally reasonable, particularly since it's still vastly cheaper than getting a traditional SSL certificate.

Re: Announcing Free and Automated SSL Certs

#26

Post by mattzito »

Karunamon wrote: post #14
mynameisvlad wrote: post #12

Earlier quoted context omitted.

You can always get the certificate yourself and then upload it to Heroku. You own the custom domain, so you can use dns-01 instead of http-01 verification. Or, as others mentioned, the default endpoint is SSL-enabled.

That's just the problem, though. The level of labor for Heroku enabling for everyone is negligible, and holding out on basic security as a paid addon in 2017 is just plain reprehensible. HTTPS should be the bare minimum for all connections in 2017, with HTTP fallback if requested. That should be the paid add-on. I really don't see how this is such an unreasonable sentiment that it deserves maximum downvotes.

> The level of labor for Heroku enabling for everyone is negligible

This is simply not true. Implementing LE support for more than a handful of domains is a significant amount of work, particularly when you don't control the domains in question.

Re: Announcing Free and Automated SSL Certs

#27

Post by kevindong »

Karunamon wrote: post #22
kevindong wrote: post #21

Earlier quoted context omitted.

They are offering SSL free to all free dynos under the .herokuapp.com" rel="nofollow">https:// .herokuapp.com domain. If they offered free SSL for custom domains too, what's the incentive to upgrade to a paid dyno for applications that don't require a large amount of resources? To be fair to Heroku, they have the right to make a profit. As is, it's amazing that they offer a fully free tier. If you don't like their po…

If they offered free SSL for custom domains too, what's the incentive to upgrade to a paid dyno for applications that don't require a large amount of resources? This is exactly my point. The fact that companies are still bucketing "SSL" into "things we can charge extra for" rather than "things that should be the absolute minimum we provide" is irresponsible. Plaintext on the public internet needs to go away in whole.

You do have a point. In fact, philosophically, you are correct. You are correct in the same way that the National Association of the Deaf was correct in filing a complain against UC Berkeley to make all of their publicly accessible course materials accessible (Berkeley, rather than captioning all of their materials, instead decided to take down all of their materials) [0].

But here's the thing: they are providing SSL for free for non-custom domains. Everything you can do with a custom domain can be done on the .herokuapp.com subdomain. You are intentionally choosing to use a custom domain. They define that as a feature worth charging for. No one is saying you must MITM your own application using something like Cloudflare. No one is saying you must use a custom domain. No one is saying you can't use the .herokuapp.com subdomain.

Heroku is not a non-profit/government organization. They are not under the obligation to advance the public good. In fact, as a publicly traded company (as a subsidiary of Salesforce), they're actually obligated to maximize revenues and profits.

[0]: https://www.washingtonpost.com/local/education/why-uc-berkel...

Re: Announcing Free and Automated SSL Certs

#28

Post by Karunamon »

mattzito wrote: post #26
Karunamon wrote: post #14

Earlier quoted context omitted.

That's just the problem, though. The level of labor for Heroku enabling for everyone is negligible, and holding out on basic security as a paid addon in 2017 is just plain reprehensible. HTTPS should be the bare minimum for all connections in 2017, with HTTP fallback if requested. That should be the paid add-on. I really don't see how this is such an unreasonable sentiment that it deserves maximum downvotes.

> The level of labor for Heroku enabling for everyone is negligible This is simply not true. Implementing LE support for more than a handful of domains is a significant amount of work, particularly when you don't control the domains in question.

Not when you control the endpoint that the domain will be pointed at, as Heroku does. LE verification via file consists of files shoved in the web root at /.well-known.

Given that they already have the infrastructure in place and have just arbitrarily turned it off, these complaints of scale ring quite hollow. The storage and data transfer involved is tiny.

Re: Announcing Free and Automated SSL Certs

#29

Post by Karunamon »

mattzito wrote: post #25
Karunamon wrote: post #18

Earlier quoted context omitted.

It's an obvious missing case, and one that they are clearly conscious of given the constant insertion of the word "paid" in front of "dyno" throughout this announcement post. The mentality of holding out SSL as a paid addon needs to end. It needed to end years ago. It had no excuse to not end the moment LetsEncrypt went live.

Implementing support for LetsEncrypt SSL does have a cost associated with it, particularly at scale. I think restricting the feature to paid users is totally reasonable, particularly since it's still vastly cheaper than getting a traditional SSL certificate.

And what exactly would that cost be? Can it even be quantified?

We're speaking of a 4x yearly ACME request of a few kilobytes going to and from the LE servers. It certainly isn't bandwidth.

The engineering work was already done, and doesn't change based on the number of instances that are making the cert request. It certainly isn't labor.

It certainly isn't storage. Certs are 2-4 kilobytes. Even if we assume Heroku has 5M active dynos and each one has its own unique cert, that's only 20 gigabytes worth of certs, which is miniscule.

So where's the cost coming from? Answer: It isn't. This is just tier differentiation, not cost recovery.

Re: Announcing Free and Automated SSL Certs

#30

Post by Karunamon »

kevindong wrote: post #27
Karunamon wrote: post #22

Earlier quoted context omitted.

If they offered free SSL for custom domains too, what's the incentive to upgrade to a paid dyno for applications that don't require a large amount of resources? This is exactly my point. The fact that companies are still bucketing "SSL" into "things we can charge extra for" rather than "things that should be the absolute minimum we provide" is irresponsible. Plaintext on the public internet needs to go away in whole.

You do have a point. In fact, philosophically, you are correct. You are correct in the same way that the National Association of the Deaf was correct in filing a complain against UC Berkeley to make all of their publicly accessible course materials accessible (Berkeley, rather than captioning all of their materials, instead decided to take down all of their materials) [0]. But here's the thing: they are providing SSL…

And we end on the "maximize shareholder value" argument, the be-all end-all cop-out non-argument when a company is behaving harmfully.

You're correct, of course, and given the general libertarian mindset of HN, this is not a logically unreasonable stance to take. I don't even have a snarky "you'll be sorry in the future"-type parting shot to make because this is a niche of a niche we're talking about here.

I will just strike Heroku from the list of companies I will ever support and suggest my company and colleagues do the same. The same way I struck Startcom from that list after Heartbleed.

Hopefully, I change a few minds. Really all I can do.

Post reply on HN