Deprecating Non-Secure HTTP • Hacker News Board

Re: Deprecating Non-Secure HTTP

#11

Post by pckspcks » Thu, Apr 30, 2015, 11:46 PM UTC

abhinai wrote: post #9

Hopefully they will also introduce a standard and free way to get SSL certificates. I do not like the idea of having to buy new certificates every year (and all the hassle that comes with installing the certificates) just to maintain a very basic website.

Nope. The goal is to make running a server only available to corporate entities. It reduce competition from folks like yourself.

Re: Deprecating Non-Secure HTTP

#12

Post by MBlume » Thu, Apr 30, 2015, 11:46 PM UTC

Question: if I'm prototyping a webapp on my machine -- one that will ultimately run behind apache or nginx or an amazon load balancer or something -- can I still prototype it in my browser with new features enabled without getting a valid https setup running on my localhost?

Re: Deprecating Non-Secure HTTP

#13

Post by teraflop » Thu, Apr 30, 2015, 11:47 PM UTC

NeutronBoy wrote: post #4

rossng wrote: post #2

This is a pretty bold move, but I like the intent behind it. Hopefully Mozilla can pull it off without causing any problems for normal users. Presumably it will all be synced with their plans to launch a free CA[1] in the near future. [1] https://letsencrypt.org/

One thing I've never been able to figure out from Let's Encrypt's website - will you be able to get a certificate, without hosting your own instance? Or will it be limited to servers you can actually install their program on? Also, I assume they'll get the root CA included by all major vendors/browsers?

You need to be able to prove ownership of a domain in order to get a certificate. CAs already require this; the "lets-encrypt" command line tool just implements a challenge-response protocol for doing it automatically. But you could implement the same protocol yourself, as long as your platform allows you to either serve the response from a well-known path at the desired domain, or add it as a TXT record in DNS.

Re: Deprecating Non-Secure HTTP

#14

Post by sergiotapia » Thu, Apr 30, 2015, 11:48 PM UTC

Why do we have to pay for an SSL certificate? Shouldn't it be free?

Re: Deprecating Non-Secure HTTP

#15

Post by JeremyBanks » Thu, Apr 30, 2015, 11:48 PM UTC

abhinai wrote: post #9

Hopefully they will also introduce a standard and free way to get SSL certificates. I do not like the idea of having to buy new certificates every year (and all the hassle that comes with installing the certificates) just to maintain a very basic website.

https://letsencrypt.org/

Re: Deprecating Non-Secure HTTP

#16

Post by JeremyBanks » Thu, Apr 30, 2015, 11:49 PM UTC

sergiotapia wrote: post #14

Why do we have to pay for an SSL certificate? Shouldn't it be free?

https://letsencrypt.org/

Re: Deprecating Non-Secure HTTP

#17

Post by natrius » Thu, Apr 30, 2015, 11:50 PM UTC

pckspcks wrote: post #11

abhinai wrote: post #9

Hopefully they will also introduce a standard and free way to get SSL certificates. I do not like the idea of having to buy new certificates every year (and all the hassle that comes with installing the certificates) just to maintain a very basic website.

Nope. The goal is to make running a server only available to corporate entities. It reduce competition from folks like yourself.

If the cost of an SSL certificate is a barrier for you to compete, you should probably do something else.

Re: Deprecating Non-Secure HTTP

#18

Post by toomuchtodo » Thu, Apr 30, 2015, 11:50 PM UTC

natrius wrote: post #17

pckspcks wrote: post #11

Earlier quoted context omitted.

Nope. The goal is to make running a server only available to corporate entities. It reduce competition from folks like yourself.

If the cost of an SSL certificate is a barrier for you to compete, you should probably do something else.

Can you still serve a static site from AWS' S3 with an SSL cert? Last time I checked, you can't unless you use Cloudfront in front of it.

Re: Deprecating Non-Secure HTTP

#19

Post by wowaname » Thu, Apr 30, 2015, 11:51 PM UTC

For Tor and I2P hidden services, HTTPS is redundant so I don't really see the point in punishing people for things like this. Loopback sites are an obvious exception to the "HTTPS is better" rule as well.

Re: Deprecating Non-Secure HTTP

#20

Post by JoshTriplett » Thu, Apr 30, 2015, 11:52 PM UTC

MBlume wrote: post #12

Question: if I'm prototyping a webapp on my machine -- one that will ultimately run behind apache or nginx or an amazon load balancer or something -- can I still prototype it in my browser with new features enabled without getting a valid https setup running on my localhost?

Yes; localhost specifically counts as secure.