Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing Free and Automated SSL Certs

blog.heroku.com

Post reply on HN
Print view View original

41–50 of 79 posts

Re: Announcing Free and Automated SSL Certs

#41

Post by JoshTriplett »

user5994461 wrote: post #40
JoshTriplett wrote: post #39

Earlier quoted context omitted.

If you have a free plan at all, then the only reason TLS should not be a paid feature would be if you intentionally want to position the free plan as "don't take this seriously because you can't build anything production-quality on it".

That makes sense for a hosting service. A lot of them works that way. Hosting a static free blog doesn't need TLS.

> Hosting a static free blog doesn't need TLS.

Many kinds of static content need TLS, including protection from MITM and protection from eavesdroppers. Static doesn't mean "not sensitive". (Leaving aside the reasonable presumption today that all content is potentially sensitive.)

Re: Announcing Free and Automated SSL Certs

#42

Post by Karunamon »

mattzito wrote: post #35
Karunamon wrote: post #29

Earlier quoted context omitted.

And what exactly would that cost be? Can it even be quantified? We're speaking of a 4x yearly ACME request of a few kilobytes going to and from the LE servers. It certainly isn't bandwidth. The engineering work was already done, and doesn't change based on the number of instances that are making the cert request. It certainly isn't labor. It certainly isn't storage. Certs are 2-4 kilobytes. Even if we assume Heroku h…

Oh my - so, it's actually a lot more complicated than that. Let me run it through for you: - You have to build enough of a retry algorithm so that you start renewing well in advance of the expiration date. - You then have to build the mechanism for warning customers that there was an issue renewing for one of a variety of reasons - You then have to deal with situations where LE has issues, which happens fairly often…

I didn't say that it was easy. I enumerated three things that it can't be.

Given that Heroku is already generating certs on the fly for the (randomly named) dynos, offering that is even more engineering work than just sending a cert request for a custom domain, the numbers of which will be significantly smaller. [DISREGARD THIS - no they're not. Those are all on a single wildcard]

My whole gist here is that every conceivable practical excuse I can think of for not extending that feature out to custom domains resolves as a nonissue, which only leaves feature differentiation to drive sales as the remaining option.

Which, as mentioned before, is a legitimate business tactic, but morally evil in the security climate of 201x+.

Re: Announcing Free and Automated SSL Certs

#43

Post by icebraining »

user5994461 wrote: post #40
JoshTriplett wrote: post #39

Earlier quoted context omitted.

If you have a free plan at all, then the only reason TLS should not be a paid feature would be if you intentionally want to position the free plan as "don't take this seriously because you can't build anything production-quality on it".

That makes sense for a hosting service. A lot of them works that way. Hosting a static free blog doesn't need TLS.

Considering the amount of crap ISPs have been known to inject into websites, I disagree. TLS isn't just for encryption, it also provides data integrity.

Re: Announcing Free and Automated SSL Certs

#44

Post by Karunamon »

packetized wrote: post #36
Karunamon wrote: post #29

Earlier quoted context omitted.

And what exactly would that cost be? Can it even be quantified? We're speaking of a 4x yearly ACME request of a few kilobytes going to and from the LE servers. It certainly isn't bandwidth. The engineering work was already done, and doesn't change based on the number of instances that are making the cert request. It certainly isn't labor. It certainly isn't storage. Certs are 2-4 kilobytes. Even if we assume Heroku h…

Saying that "that's only 20 gigabytes worth of certs" is roughly equivalent to saying "this database is only 1.8TB - that's miniscule, 2TB drives are only $70!". There's a whole lot more moving parts, especially at scale (developing a system to manage 5M certs? Pretty sure that's a whiteboard interview question somewhere).

Please read this conversation with the context in mind rather than replying to the one statement. When you're referring to costs as a category, as that statement was, the "moving parts" aren't factored into storage costs.

Re: Announcing Free and Automated SSL Certs

#45

Post by gergles »

mattzito wrote: post #35
Karunamon wrote: post #29

Earlier quoted context omitted.

And what exactly would that cost be? Can it even be quantified? We're speaking of a 4x yearly ACME request of a few kilobytes going to and from the LE servers. It certainly isn't bandwidth. The engineering work was already done, and doesn't change based on the number of instances that are making the cert request. It certainly isn't labor. It certainly isn't storage. Certs are 2-4 kilobytes. Even if we assume Heroku h…

Oh my - so, it's actually a lot more complicated than that. Let me run it through for you: - You have to build enough of a retry algorithm so that you start renewing well in advance of the expiration date. - You then have to build the mechanism for warning customers that there was an issue renewing for one of a variety of reasons - You then have to deal with situations where LE has issues, which happens fairly often…

But this is all engineering work that needs to be done for the system at all. None of these things have incremental costs that justify hiding encryption behind a paywall.

Re: Announcing Free and Automated SSL Certs

#46

Post by icebraining »

kevindong wrote: post #27
Karunamon wrote: post #22

Earlier quoted context omitted.

If they offered free SSL for custom domains too, what's the incentive to upgrade to a paid dyno for applications that don't require a large amount of resources? This is exactly my point. The fact that companies are still bucketing "SSL" into "things we can charge extra for" rather than "things that should be the absolute minimum we provide" is irresponsible. Plaintext on the public internet needs to go away in whole.

You do have a point. In fact, philosophically, you are correct. You are correct in the same way that the National Association of the Deaf was correct in filing a complain against UC Berkeley to make all of their publicly accessible course materials accessible (Berkeley, rather than captioning all of their materials, instead decided to take down all of their materials) [0]. But here's the thing: they are providing SSL…

Heroku is not a non-profit/government organization. They are not under the obligation to advance the public good.

No. And people are under no obligation to not criticize them for not doing so. That's the thing with obligations: they are the bare minimum one must do, but hardly a guide for what one should do.

In fact, as a publicly traded company (as a subsidiary of Salesforce), they're actually obligated to maximize revenues and profits.

In my opinion, even if it was true, people should avoid mentioning it out of sheer embarrassment for the mockery it makes of a presumably advanced society. But it's not even true!

https://corpgov.law.harvard.edu/2012/06/26/the-shareholder-v...

Re: Announcing Free and Automated SSL Certs

#47

Post by IgorPartola »

user5994461 wrote: post #40
JoshTriplett wrote: post #39

Earlier quoted context omitted.

If you have a free plan at all, then the only reason TLS should not be a paid feature would be if you intentionally want to position the free plan as "don't take this seriously because you can't build anything production-quality on it".

That makes sense for a hosting service. A lot of them works that way. Hosting a static free blog doesn't need TLS.

Yes it does. Stop spreading this misinformation because it is dangerous. Everything should be encrypted. I don't want people knowing that I'm reading your blog or what on it I am reading.

Re: Announcing Free and Automated SSL Certs

#48

Post by Nadya »

user5994461 wrote: post #38
Nadya wrote: post #19

Earlier quoted context omitted.

Companies who aren't in the business of selling TLS [0] certs themselves have little excuse to not offer free TLS via Let's Encrypt. It's an advantage over any competitors who haven't set that process up. If your company does hosting - your company should provide TLS certs via Let's Encrypt automatically . [0] Can we start dropping the SSL part now? Generally SSL v2/v3 is disabled so it is all over TLS anyway.

> If your company does hosting - your company should provide TLS certs via Let's Encrypt automatically. Correction: As part of the paid plan. Why give for free sometimes you can charge money for.

Because your competitors will do so and the paid plan should be to paying for bandwidth or storage space, not TLS. Now you just lost your lunch to competitors who aren't trying to nickle and dime their customers.

>Hosting a static free blog doesn't need TLS.

Completely wrong, although others explained why already.

Re: Announcing Free and Automated SSL Certs

#50

Post by [deleted] »

Karunamon wrote: post #30
kevindong wrote: post #27

Earlier quoted context omitted.

You do have a point. In fact, philosophically, you are correct. You are correct in the same way that the National Association of the Deaf was correct in filing a complain against UC Berkeley to make all of their publicly accessible course materials accessible (Berkeley, rather than captioning all of their materials, instead decided to take down all of their materials) [0]. But here's the thing: they are providing SSL…

And we end on the "maximize shareholder value" argument, the be-all end-all cop-out non-argument when a company is behaving harmfully. You're correct, of course, and given the general libertarian mindset of HN, this is not a logically unreasonable stance to take. I don't even have a snarky "you'll be sorry in the future"-type parting shot to make because this is a niche of a niche we're talking about here. I will jus…

[deleted]
Post reply on HN