Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Still Why No HTTPS?

troyhunt.com

Post reply on HN
Print view View original

11–20 of 345 posts

Re: Still Why No HTTPS?

#11

Post by onion-soup »

chungy wrote: post #9
onion-soup wrote: post #6

Earlier quoted context omitted.

Nope, it is not straight-forward and still a confusing process.

Instructions are here: https://certbot.eff.org/ I don't know how it could possibly be any simpler.

While I appreciate the efforts of certbot to make it as user-friendly as possible I still find this state of things unforgivable. I don't know where it went wrong so that today a developer must spend time learning and tweaking a low-level encryption tools. I'm just saying https will never be 100% unless it becomes a baked-in feature of any hosting.

Re: Still Why No HTTPS?

#12

Post by elcomet »

chungy wrote: post #9
onion-soup wrote: post #6

Earlier quoted context omitted.

Nope, it is not straight-forward and still a confusing process.

Instructions are here: https://certbot.eff.org/ I don't know how it could possibly be any simpler.

It is simple for a one-server website. When you're on Alexa 1M, you certainly have a load balancer, multiple servers for redundancy, etc. It makes things not straightforward, and you certainly don't want to use the default certbot which overwrites your config.

Re: Still Why No HTTPS?

#13

Post by cm2187 »

Is it still the case that when you think you connect in https to a website, only the segment to cloudflare is encrypted and the segment cloudflare to the web server might not be?

Re: Still Why No HTTPS?

#14

Post by arkitaip »

onion-soup wrote: post #6
veb wrote: post #5

I don't get it. With Lets Encrypt, it's like one or two lines to get everything set up. I'm guessing people aren't as lucky as I am to be running on newer machines and such. I mean it even edits your nginx files to redirect http to https if you agree. It's not hard.

Nope, it is not straight-forward and still a confusing process.

So true. Even on hosting that fully supports let's encrypt thru an web based admin like cpanel or directadmin, the process can be confusing and error prone.

Re: Still Why No HTTPS?

#15

Post by cm2187 »

onion-soup wrote: post #11
chungy wrote: post #9

Earlier quoted context omitted.

Instructions are here: https://certbot.eff.org/ I don't know how it could possibly be any simpler.

While I appreciate the efforts of certbot to make it as user-friendly as possible I still find this state of things unforgivable. I don't know where it went wrong so that today a developer must spend time learning and tweaking a low-level encryption tools. I'm just saying https will never be 100% unless it becomes a baked-in feature of any hosting.

Starting with baking ACMEv2 in the major webservers (apache, IIS, etc).

Re: Still Why No HTTPS?

#16

Post by thenewnewguy »

cm2187 wrote: post #13

Is it still the case that when you think you connect in https to a website, only the segment to cloudflare is encrypted and the segment cloudflare to the web server might not be?

Depends on the website's Cloudflare configuration. Cloudflare supports both methods - CF to website can be HTTP or HTTPS.

Re: Still Why No HTTPS?

#17

Post by onion-soup »

WilliamEdward wrote: post #8
veb wrote: post #5

I don't get it. With Lets Encrypt, it's like one or two lines to get everything set up. I'm guessing people aren't as lucky as I am to be running on newer machines and such. I mean it even edits your nginx files to redirect http to https if you agree. It's not hard.

I'm fine with people who think it's too hard... What i cannot stand is people who can do it, but refuse to out of laziness. Or because they want their content to be insecure on purpose. This applies mostly to big orgs, so indie devs can have some leeway if it's too hard to implement.

Assuming you are talking about software developers, you can't expent people do extra work out of virtue. They will do it only if there is an economic incentive. Setting up a transport layer security is not in software developer's interest or competence.

Re: Still Why No HTTPS?

#18

Post by regecks »

onion-soup wrote: post #11
chungy wrote: post #9

Earlier quoted context omitted.

Instructions are here: https://certbot.eff.org/ I don't know how it could possibly be any simpler.

While I appreciate the efforts of certbot to make it as user-friendly as possible I still find this state of things unforgivable. I don't know where it went wrong so that today a developer must spend time learning and tweaking a low-level encryption tools. I'm just saying https will never be 100% unless it becomes a baked-in feature of any hosting.

Certbot, and most other standalone ACME clients, are just stop-gaps.

The end game is first-party support for automatic HTTPS in all web (and other) servers. It is happening (e.g. mod_md), it's just going to take time. For example, to get it packaged for all distributions.

For shared hosting, if you ignore the few providers at the top who are either CAs (e.g. GoDaddy) or are in contracts with CAs (e.g. Namecheap), the overwhelming majority of them are already providing free and automatic SSL for all hosted domains.

Re: Still Why No HTTPS?

#19

Post by signed0 »

k33l0r wrote: post #10
wojciechpolak wrote: post #2

"gnu.org" is on the list marked as a Chinese website...

There are some other confusing ones as well. nature.com is marked as Chinese, as are nginx.org and ntp.org. example.com is Indian in the list as is the now defunct dmoz.org. I don't understand the methodology behind the country assignments at all…

Weirdly nature.com seems to actually redirect to https, as does zara.com, lenovo.com, genuis.com, and senate.gov. Is this list stale, or did no one spot-check this?

Re: Still Why No HTTPS?

#20

Post by WilliamEdward »

onion-soup wrote: post #17
WilliamEdward wrote: post #8

Earlier quoted context omitted.

I'm fine with people who think it's too hard... What i cannot stand is people who can do it, but refuse to out of laziness. Or because they want their content to be insecure on purpose. This applies mostly to big orgs, so indie devs can have some leeway if it's too hard to implement.

Assuming you are talking about software developers, you can't expent people do extra work out of virtue. They will do it only if there is an economic incentive. Setting up a transport layer security is not in software developer's interest or competence.

This is about managers and executives who call the shots on implementing these features. It is not your responsibility as a software dev working for a big company to implement something they do not pay you for.
Post reply on HN