Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing Free and Automated SSL Certs

blog.heroku.com

Post reply on HN
Print view View original

51–60 of 79 posts

Re: Announcing Free and Automated SSL Certs

#51

Post by packetized »

Karunamon wrote: post #44
packetized wrote: post #36

Earlier quoted context omitted.

Saying that "that's only 20 gigabytes worth of certs" is roughly equivalent to saying "this database is only 1.8TB - that's miniscule, 2TB drives are only $70!". There's a whole lot more moving parts, especially at scale (developing a system to manage 5M certs? Pretty sure that's a whiteboard interview question somewhere).

Please read this conversation with the context in mind rather than replying to the one statement. When you're referring to costs as a category, as that statement was, the "moving parts" aren't factored into storage costs.

I have, and I believe that you're being extraordinarily reductionist about the true costs involved in developing and operating services like certificate management at scale.

Re: Announcing Free and Automated SSL Certs

#52

Post by packetized »

Karunamon wrote: post #42
mattzito wrote: post #35

Earlier quoted context omitted.

Oh my - so, it's actually a lot more complicated than that. Let me run it through for you: - You have to build enough of a retry algorithm so that you start renewing well in advance of the expiration date. - You then have to build the mechanism for warning customers that there was an issue renewing for one of a variety of reasons - You then have to deal with situations where LE has issues, which happens fairly often…

I didn't say that it was easy. I enumerated three things that it can't be. Given that Heroku is already generating certs on the fly for the (randomly named) dynos, offering that is even more engineering work than just sending a cert request for a custom domain, the numbers of which will be significantly smaller. [DISREGARD THIS - no they're not. Those are all on a single wildcard] My whole gist here is that every con…

They aren't generating certs on the fly for randomly named dynos:

  -bash-4.1$ curl -vkLs https://wind-river-5693.herokuapp.com 2>&1 | grep certificate
  * Server certificate: *.herokuapp.com
  * Server certificate: DigiCert SHA2 High Assurance Server CA
  * Server certificate: DigiCert High Assurance EV Root CA
  -bash-4.1$

Re: Announcing Free and Automated SSL Certs

#53

Post by Karunamon »

packetized wrote: post #52
Karunamon wrote: post #42

Earlier quoted context omitted.

I didn't say that it was easy. I enumerated three things that it can't be. Given that Heroku is already generating certs on the fly for the (randomly named) dynos, offering that is even more engineering work than just sending a cert request for a custom domain, the numbers of which will be significantly smaller. [DISREGARD THIS - no they're not. Those are all on a single wildcard] My whole gist here is that every con…

They aren't generating certs on the fly for randomly named dynos: -bash-4.1$ curl -vkLs https://wind-river-5693.herokuapp.com 2>&1 | grep certificate * Server certificate: *.herokuapp.com * Server certificate: DigiCert SHA2 High Assurance Server CA * Server certificate: DigiCert High Assurance EV Root CA -bash-4.1$

Foo! Okay, I thought they were doing LE certs for every dyno's name. One wildcard makes a lot more sense.

Re: Announcing Free and Automated SSL Certs

#55

Post by Godel_unicode »

icebraining wrote: post #43
user5994461 wrote: post #40

Earlier quoted context omitted.

That makes sense for a hosting service. A lot of them works that way. Hosting a static free blog doesn't need TLS.

Considering the amount of crap ISPs have been known to inject into websites, I disagree. TLS isn't just for encryption, it also provides data integrity.

This is the correct answer. Use this reasoning.

Re: Announcing Free and Automated SSL Certs

#56

Post by nsgi »

JoshTriplett wrote: post #39
user5994461 wrote: post #38

Earlier quoted context omitted.

> If your company does hosting - your company should provide TLS certs via Let's Encrypt automatically. Correction: As part of the paid plan. Why give for free sometimes you can charge money for.

If you have a free plan at all, then the only reason TLS should not be a paid feature would be if you intentionally want to position the free plan as "don't take this seriously because you can't build anything production-quality on it".

There are ways of doing that without sacrificing security. Making TLS a paid-only feature makes no more sense than making CSRF protection a paid-only feature.

Re: Announcing Free and Automated SSL Certs

#57

Post by Jach »

IgorPartola wrote: post #47
user5994461 wrote: post #40

Earlier quoted context omitted.

That makes sense for a hosting service. A lot of them works that way. Hosting a static free blog doesn't need TLS.

Yes it does. Stop spreading this misinformation because it is dangerous. Everything should be encrypted. I don't want people knowing that I'm reading your blog or what on it I am reading.

Now who's spreading misinformation? HTTPS doesn't protect the fact you're reading a blog (the IP of the server will be observed, and typically the server name through the cert itself) and while one can't prove which URLs of the server you visited one can infer based on the amount of traffic sent.

Re: Announcing Free and Automated SSL Certs

#59

Post by samb1729 »

Jach wrote: post #57
IgorPartola wrote: post #47

Earlier quoted context omitted.

Yes it does. Stop spreading this misinformation because it is dangerous. Everything should be encrypted. I don't want people knowing that I'm reading your blog or what on it I am reading.

Now who's spreading misinformation? HTTPS doesn't protect the fact you're reading a blog (the IP of the server will be observed, and typically the server name through the cert itself) and while one can't prove which URLs of the server you visited one can infer based on the amount of traffic sent.

There's a pretty significant difference between someone being able to tell, for example, that you visited medium.com, and that same someone being able to tell exactly which blog post you read because the whole request is unencrypted.

Re: Announcing Free and Automated SSL Certs

#60

Post by packetized »

Karunamon wrote: post #53
packetized wrote: post #52

Earlier quoted context omitted.

They aren't generating certs on the fly for randomly named dynos: -bash-4.1$ curl -vkLs https://wind-river-5693.herokuapp.com 2>&1 | grep certificate * Server certificate: *.herokuapp.com * Server certificate: DigiCert SHA2 High Assurance Server CA * Server certificate: DigiCert High Assurance EV Root CA -bash-4.1$

Foo! Okay, I thought they were doing LE certs for every dyno's name. One wildcard makes a lot more sense.

FTA:

  ACM handles all aspects of SSL/TLS certificates for _custom domains_;
  you no longer have to purchase certificates, or worry about their
  expiration or renewal.
Emphasis mine.
Post reply on HN