Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing Free and Automated SSL Certs

blog.heroku.com

Post reply on HN
Print view View original

61–70 of 79 posts

Re: Announcing Free and Automated SSL Certs

#61

Post by LukeShu »

Jach wrote: post #57
IgorPartola wrote: post #47

Earlier quoted context omitted.

Yes it does. Stop spreading this misinformation because it is dangerous. Everything should be encrypted. I don't want people knowing that I'm reading your blog or what on it I am reading.

Now who's spreading misinformation? HTTPS doesn't protect the fact you're reading a blog (the IP of the server will be observed, and typically the server name through the cert itself) and while one can't prove which URLs of the server you visited one can infer based on the amount of traffic sent.

Beyond just the cert itself, the client will typically announce in plaintext the hostname it is seeking to talk to, as part of SNI.

Re: Announcing Free and Automated SSL Certs

#62

Post by JoshTriplett »

JoshTriplett wrote: post #39
user5994461 wrote: post #38

Earlier quoted context omitted.

> If your company does hosting - your company should provide TLS certs via Let's Encrypt automatically. Correction: As part of the paid plan. Why give for free sometimes you can charge money for.

If you have a free plan at all, then the only reason TLS should not be a paid feature would be if you intentionally want to position the free plan as "don't take this seriously because you can't build anything production-quality on it".

> If you have a free plan at all, then the only reason TLS should not be a paid feature would be if you intentionally want to position the free plan as "don't take this seriously because you can't build anything production-quality on it".

I only just now noticed a rather serious typo there, making that sentence confusing. Should have said "the only reason TLS should be a paid feature", which fits with the rest of the sentence.

Re: Announcing Free and Automated SSL Certs

#64

Post by hamandcheese »

nsgi wrote: post #56
JoshTriplett wrote: post #39

Earlier quoted context omitted.

If you have a free plan at all, then the only reason TLS should not be a paid feature would be if you intentionally want to position the free plan as "don't take this seriously because you can't build anything production-quality on it".

There are ways of doing that without sacrificing security. Making TLS a paid-only feature makes no more sense than making CSRF protection a paid-only feature.

On Heroku, TLS is enabled if you use the *.herokuapp.com domain, even on free plans.

So really they are charging you if you need a custom domain and security (i.e. Something most businesses do need and most hobbies don't).

Seems a like a reasonable and fair way to segment their market to me.

Re: Announcing Free and Automated SSL Certs

#67

Post by RKearney »

Nadya wrote: post #19
homerguy69 wrote: post #7

Sweet, this is basically want Lets Encrypt wanted, make the market go towards this free SSL model.

Companies who aren't in the business of selling TLS [0] certs themselves have little excuse to not offer free TLS via Let's Encrypt. It's an advantage over any competitors who haven't set that process up. If your company does hosting - your company should provide TLS certs via Let's Encrypt automatically . [0] Can we start dropping the SSL part now? Generally SSL v2/v3 is disabled so it is all over TLS anyway.

> Can we start dropping the SSL part now? Generally SSL v2/v3 is disabled so it is all over TLS anyway.

It's the same certificate though. So can we start calling them X.509 certs which is more proper than SSL or TLS cert?

Re: Announcing Free and Automated SSL Certs

#68

Post by kaishiro »

jldugger wrote: post #66
jldugger wrote: post #33

Earlier quoted context omitted.

Does it need wildcard?

It's a serious question, if you have unlimited and automated SSL certificates, what is the purpose of wildcards?

Gave you an upvote. I understood where you were going with that (clearly others did not).

Re: Announcing Free and Automated SSL Certs

#69

Post by kaishiro »

Karunamon wrote: post #22
kevindong wrote: post #21

Earlier quoted context omitted.

They are offering SSL free to all free dynos under the .herokuapp.com" rel="nofollow">https:// .herokuapp.com domain. If they offered free SSL for custom domains too, what's the incentive to upgrade to a paid dyno for applications that don't require a large amount of resources? To be fair to Heroku, they have the right to make a profit. As is, it's amazing that they offer a fully free tier. If you don't like their po…

If they offered free SSL for custom domains too, what's the incentive to upgrade to a paid dyno for applications that don't require a large amount of resources? This is exactly my point. The fact that companies are still bucketing "SSL" into "things we can charge extra for" rather than "things that should be the absolute minimum we provide" is irresponsible. Plaintext on the public internet needs to go away in whole.

I don't want to just jump all over you like some people are doing, because I think you make somewhat of a valid point (to be honest, I don't think I'm knowledgeable enough to have an opinion there). However, it's my understanding that you can SSL any app by default using their wildcard for free. As a private business, is it really so wrong for them to restrict the free, automated LE certs to just paid apps? If so, why?

Just in case it's not clear, these aren't rhetorical questions - genuinely interested in your answers.

Re: Announcing Free and Automated SSL Certs

#70

Post by tutanchamun »

Clex wrote: post #23

This is great news, thanks Heroku. This feature sticks well to their "code, we do the rest" philosophy. I hope the other PaaS will follow.

Yeah, I hope openshift online will support it when they launch the next version (when ever that will happen... some roadmap would be nice :O).
Post reply on HN