Why isn't HTTPS everywhere yet?

Post by nailer » Tue, Jan 19, 2016, 11:34 PM UTC

majewsky wrote: post #112

Zarel wrote: post #37

In addition to ad revenue issue r1ch mentioned (a friend of mine told me HTTPS ads provided less than half the revenue HTTP ads provide), there are a few other things I've encountered while working on HTTPS support: - More ad network misbehavior: the last time I checked, a lot of HTTPS ads on AdSense would take up 100% CPU and lag the browser, because it would try to request an HTTP resource and fail in an infinite l…

Regarding the "Annoyance" bullet point, you might have a better time if you put an Apache or nginx in the front (on ports 80/443), have it serve the acme-challenges statically and proxy_pass everything else to Node running on a high port. TLS handling would then happen in the frontend server only. Regarding the "please use sudo" issue, it's very much possible to run the letsencrypt client as a non-root user if you se…

Post by zbuf » Wed, Jan 20, 2016, 1:05 AM UTC

glasz wrote: post #119

zbuf wrote: post #99

Earlier quoted context omitted.

I am interested in (a). Recently I heard from a trusted source who works for a popular CDN that some top levels CAs, who are trusted in my browser, are known to be issuing certificates for domains which they have no authority to be doing so, for the purpose of man-in-the-middle analysis by certain parties. But that there is a reluctance to pull these certificates because that would be like switching off portions of t…

just listen to security now [0]. it'll make your blood boil how, e.g., symantec fucks up over and over again. this industry is full of incompetent idiots. [0] https://twit.tv/shows/security-now (episode 532 is particularly revealing)

Post by lucaspiller » Thu, Jan 21, 2016, 9:08 AM UTC

cm2187 wrote: post #97

lucaspiller wrote: post #92

Earlier quoted context omitted.

Why is your employer forcing to use a severely outdated system? Do you often come across broken or very slow websites (I imagine the hardware is from the same era as the OS)?

Hardware is high end 2009 workstations. We as an organisation like to take our time. We wouldn't welcome a new joiner with a PC on his desk. Much more fun to see him struggling for weeks with our internal IT approval processes. We happily pay millions to Microsoft to get the privilege of using Windows Xp / 32 bit systems a little bit longer (I have now almost more RAM in my mobile phone than my workstation). In fact…

Post by bobfunk » Fri, Jan 22, 2016, 7:51 AM UTC

notfoss wrote: post #100

bobfunk wrote: post #33

We just launched support for free SSL on all our plans at https://www.netlify.com , doing what we can to help getting HTTPS everywhere. Won't help on mixed content or broken ad providers, but at least give people a place to put a project on a custom domain for free with HTTPS :)

What is the Full SSL feature offered by you? From what I understand it means supporting weaker ciphers apart from SSL and older TLS versions. Is that the case?

Post by lindx » Sat, Jan 23, 2016, 5:27 PM UTC

otterley wrote: post #114

lindx wrote: post #17

Earlier quoted context omitted.

With AES-NI, a single modern CPU core can encrypt 10 gigabits/second and do about 50,000 public key operations per second. Cryptography is not that expensive.

AES isn't the only algorithm used in TLS handshakes.