Https hurts users far away from the server • Hacker News Board

Re: Https hurts users far away from the server

#21

Post by mrkurt » Fri, Mar 10, 2017, 2:56 PM UTC

snug wrote: post #20

riobard wrote: post #9

Earlier quoted context omitted.

Here's why: Many ISPs hijack HTTP connections and inject ads and tracking JS into the page. If you don't use HTTPS, your page is screwed. The Internet is not a safe place. We should aim for HTTPS EVERYWHERE.

> Many ISPs I think that's a bit sensationalist.

It's not, it happens at a ton of coffee shops, on airplanes, etc, etc. Probably not ISPs you buy home internet from, but there are a lot.

Re: Https hurts users far away from the server

#22

Post by STRML » Fri, Mar 10, 2017, 2:57 PM UTC

snug wrote: post #20

riobard wrote: post #9

Earlier quoted context omitted.

Here's why: Many ISPs hijack HTTP connections and inject ads and tracking JS into the page. If you don't use HTTPS, your page is screwed. The Internet is not a safe place. We should aim for HTTPS EVERYWHERE.

> Many ISPs I think that's a bit sensationalist.

Verizon, Comcast, and Rogers have done it, that we know of. In North America that's a very large proportion of traffic.

Re: Https hurts users far away from the server

#23

Post by kijin » Fri, Mar 10, 2017, 2:57 PM UTC

alvil wrote: post #3

There is also another problem on how much and how often is Googlebot indexing your site because your site speed is one of the factors of so called Google index budget. My users are in Germany so my VPS is also in Germany to be fast for local user (~130ms for http reply), but for US Googlebot is my site slow (~420ms for http reply). So you are penalized also for this.

Isn't this somewhat compensated for by the extra credit Google gives you for using SSL?

I would also assume that Google is smart enough to take the physical location of your server into account when calculating how much penalty to apply in which searches. Sites that load fast in Germany should have higher ranks in searches from Germany.

Re: Https hurts users far away from the server

#24

Post by andreareina » Fri, Mar 10, 2017, 2:58 PM UTC

One round trip over the course of the time that the user is using the same OS/browser installation isn't much.

The Cloudflare Railgun is an interesting solution, and one that could be implemented in the context of an SPA over a websockets connection. Or conceivably some other consumer of an API.

Re: Https hurts users far away from the server

#25

Post by andrewaylett » Fri, Mar 10, 2017, 2:58 PM UTC

chatmasta wrote: post #5

What's wrong with the cloudflare free plan? You can host a static site on github pages with a custom domain and use the free cloudflare SSL cert.

Without Railgun, there's no guarantee that the CloudFlare nodes will have an open socket to your origin server, so your visitors may still have to pay the cost of the round-trip.

Re: Https hurts users far away from the server

#26

Post by libeclipse » Fri, Mar 10, 2017, 2:59 PM UTC

eganist wrote: post #7

Kiro wrote: post #4

I don't understand why I need to use https on a static marketing webpage. No login stuff, no JavaScript, nothing. Just straight up HTML and CSS. Right now I need to pay about $150 every year for something that's only used to satisfy Google PageRank (I can't use LetsEncrypt with my hosting provider). Why?

Keeping it extremely high level: Among other reasons, not encrypting traffic gives an opportunity for bad actors to replace content in transit to your end users when your end users are on compromised connections, such as rogue "free" wifi networks in airports or coffee shops, or even legitimate networks which have in some way been compromised, e.g. the ISPs of the world who decide to inject other content e.g. their o…

Using netlify with ghpages is extremely fast because of their CDN, A+ on ssl labs, and free.

Re: Https hurts users far away from the server

#27

Post by KabuseCha » Fri, Mar 10, 2017, 2:59 PM UTC

alvil wrote: post #3

There is also another problem on how much and how often is Googlebot indexing your site because your site speed is one of the factors of so called Google index budget. My users are in Germany so my VPS is also in Germany to be fast for local user (~130ms for http reply), but for US Googlebot is my site slow (~420ms for http reply). So you are penalized also for this.

Hi - I know some tools report a slow site in this case, but these reports are not accurate - don't believe them! Google is not that stupid ! :D

I am currently working as a dev in an SEO-Agency (in Austria), and we never believed this hypothesis - so we tested this once with a bunch of our sites:

When moving sites with a German speaking audience to a VPS in America, your rankings at google.de/google.at will decrease (slightly - the effect is not that big) - the other way around your rankings will improve (slightly).

However - even if your rankings would improve when moving to America I would recommend keeping your sites hosted in Europe: The increase in rankings will not offset the decrease in user satisfaction and therefore the decline in your conversion rates.

Re: Https hurts users far away from the server

#28

Post by hannob » Fri, Mar 10, 2017, 3:01 PM UTC

There are a couple of other things you can do with existing TLS technology that can improve your latency, e.g. using OCSP stapling, use modern crypto so browsers may use TLS false start, avoid too many ciphers or unnecessary certs in the chain to make the handshake smaller.

It's a bit older, but here's some info, much of it is still valid: https://istlsfastyet.com/

Re: Https hurts users far away from the server

#29

Post by afandian » Fri, Mar 10, 2017, 3:01 PM UTC

snug wrote: post #20

riobard wrote: post #9

Earlier quoted context omitted.

Here's why: Many ISPs hijack HTTP connections and inject ads and tracking JS into the page. If you don't use HTTPS, your page is screwed. The Internet is not a safe place. We should aim for HTTPS EVERYWHERE.

> Many ISPs I think that's a bit sensationalist.

Vodafone in the UK did this to me.

Re: Https hurts users far away from the server

#30

Post by mrkurt » Fri, Mar 10, 2017, 3:03 PM UTC

Kiro wrote: post #4

I don't understand why I need to use https on a static marketing webpage. No login stuff, no JavaScript, nothing. Just straight up HTML and CSS. Right now I need to pay about $150 every year for something that's only used to satisfy Google PageRank (I can't use LetsEncrypt with my hosting provider). Why?

Most of the answers you're getting aren't all that big of deal for your site. You still might want https though.

You should think about https for sites like yours the way you think about vaccines. SSL everywhere makes everyone safer, even though it doesn't have a tremendous impact on your own site.

Also, shameless plug, if you want really easy SSL you can use our new startup: https://fly.io. I'm not sure what country you're in, but we have a bunch of servers all over to help make it fast. :)