Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Still Why No HTTPS?

troyhunt.com

Post reply on HN
Print view View original

31–40 of 345 posts

Re: Still Why No HTTPS?

#31

Post by iudqnolq »

saagarjha wrote: post #25
iudqnolq wrote: post #22

Earlier quoted context omitted.

Our asshat twin n-gate has something to say about this > Horseshit. Users must keep themselves safe. Software can't ever do that for you. Users are on their own to ensure they use a quality web client, on a computer they're reasonably sure is well-maintained, over an internet connection that is not run by people who hate them. None of the packets I send out are unsafe, so my site does not need HTTPS. > None of those…

The website is actually quite useful: I notice that intersection between the threads discussed there and the ones I comment on is almost exactly the empty set. So it’s a great check to see whether I’m doing a good job ;)

I also read his work occasionally, and find it has some worth. I do, however, stand by my claim he's an asshat.

Re: Still Why No HTTPS?

#32

Post by uasm »

MrStonedOne wrote: post #24
elcomet wrote: post #12

Earlier quoted context omitted.

It is simple for a one-server website. When you're on Alexa 1M, you certainly have a load balancer, multiple servers for redundancy, etc. It makes things not straightforward, and you certainly don't want to use the default certbot which overwrites your config.

I am on alexa 1m (50k even). I do not have a load balancer, I do not have multiple servers for redundancy. This isn't even a static site, most of our page views are the wiki, the server running all of this has 8 cores and 4 are constantly maxxed out by a non-website related process. Most websites now and days are over engineered.

> "I am on alexa 1m (50k even). I do not have a load balancer, I do not have multiple servers for redundancy. This isn't even a static site, most of our page views are the wiki, the server running all of this has 8 cores and 4 are constantly maxxed out by a non-website related process.

Most websites now and days are over engineered."

That's awesome! Mind sharing some more details? (hosting plan/CDN/etc). Or even the URL?

Re: Still Why No HTTPS?

#33

Post by Sukera »

namibj wrote: post #27

There is one "good" reason against https: handshakes take enormous amounts of CPU, relatively speaking. It's quite easy tp DoS server by skipping the expensive part on your end. You can load a core with 10~30Mbit@2k rps if your not even optimized. Whereas the same server could tank 40k rps HTTP requests.

Do you have a source on that? Quite a few people seem to disagree: https://istlsfastyet.com/

Re: Still Why No HTTPS?

#34

Post by WilliamEdward »

saagarjha wrote: post #23
WilliamEdward wrote: post #8

Earlier quoted context omitted.

I'm fine with people who think it's too hard... What i cannot stand is people who can do it, but refuse to out of laziness. Or because they want their content to be insecure on purpose. This applies mostly to big orgs, so indie devs can have some leeway if it's too hard to implement.

I’m curious what your opinion is on people who don’t to make a point.

I mean, if you don't value your users privacy of course i'm not going to think you're a very swell person.

Again this really only applies to people in a comfortable position to do this and choose not to. The average developer is not my target here, it's the big guys.

Re: Still Why No HTTPS?

#35

Post by pcmonk »

iudqnolq wrote: post #22
WilliamEdward wrote: post #4

Some websites adamantly insist they did not need HTTPS because they are purely static. https://www.troyhunt.com/heres-why-your-static-website-needs... The same website to my surprise has an article on why this is faulty reasoning.

Our asshat twin n-gate has something to say about this > Horseshit. Users must keep themselves safe. Software can't ever do that for you. Users are on their own to ensure they use a quality web client, on a computer they're reasonably sure is well-maintained, over an internet connection that is not run by people who hate them. None of the packets I send out are unsafe, so my site does not need HTTPS. > None of those…

Can't read the article because the captcha won't load, but this reply doesn't make any sense. What can the browsers do without the cooperation of the server? You don't really need encryption to deal with that specific problem, but you do need signatures, which means you need a certificate anyway. It's quite a strange attitude toward the problem.

Re: Still Why No HTTPS?

#36

Post by thenewnewguy »

onion-soup wrote: post #11
chungy wrote: post #9

Earlier quoted context omitted.

Instructions are here: https://certbot.eff.org/ I don't know how it could possibly be any simpler.

While I appreciate the efforts of certbot to make it as user-friendly as possible I still find this state of things unforgivable. I don't know where it went wrong so that today a developer must spend time learning and tweaking a low-level encryption tools. I'm just saying https will never be 100% unless it becomes a baked-in feature of any hosting.

Developers don't need to, unless they're the ones hosting your website. In which case, yes, I expect them to be able to configure web hosting software.

Re: Still Why No HTTPS?

#37

Post by Jaruzel »

cm2187 wrote: post #15
onion-soup wrote: post #11

Earlier quoted context omitted.

While I appreciate the efforts of certbot to make it as user-friendly as possible I still find this state of things unforgivable. I don't know where it went wrong so that today a developer must spend time learning and tweaking a low-level encryption tools. I'm just saying https will never be 100% unless it becomes a baked-in feature of any hosting.

Starting with baking ACMEv2 in the major webservers (apache, IIS, etc).

If Microsoft baked in Auto-cert-install in to IIS that allowed you to cherry pick a provider, and/or just select their own free CA, that'd really solve the problem for Windows based web servers. In my experience CertBot/ACME type renewal doesn't work reliably for Windows/IIS.

Re: Still Why No HTTPS?

#38

Post by susam »

onion-soup wrote: post #7

Because it's always pain in the ass to set it up and then renew?

I have found that Let's Encrypt certbot makes it really simple to set up HTTPS and renew the certificate for simple websites. Examples for Nginx:

- Setup: https://github.com/susam/susam.in/blob/master/Makefile#L30-L...

- Renewal: https://github.com/susam/susam.in/blob/master/etc/crontab#L1

Re: Still Why No HTTPS?

#39

Post by Thorrez »

The article says googletagmanager.com has HSTS preloading. But it doesn't.

This is easily testable. I view the website in both Chrome and Firefox, and it's http, not https.

Sure googletagmanager.com is in the preload list, but it doesn't have "mode": "force-https". It just has certificate pinning, not HSTS.

Re: Still Why No HTTPS?

#40

Post by grecy »

WilliamEdward wrote: post #8
veb wrote: post #5

I don't get it. With Lets Encrypt, it's like one or two lines to get everything set up. I'm guessing people aren't as lucky as I am to be running on newer machines and such. I mean it even edits your nginx files to redirect http to https if you agree. It's not hard.

I'm fine with people who think it's too hard... What i cannot stand is people who can do it, but refuse to out of laziness. Or because they want their content to be insecure on purpose. This applies mostly to big orgs, so indie devs can have some leeway if it's too hard to implement.

> i cannot stand is people who can do it, but refuse to out of laziness

(Raises guilty hand)

I run a couple of sites on my hosted server that are still http. They both sit behind a varnish setup and to be honest I just have not found the time to get it done. Usually when I mess with my configurations I lose a week to troubleshooting stupid stuff and I just can't bring myself to do it.

Post reply on HN