Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Still Why No HTTPS?

troyhunt.com

Post reply on HN
Print view View original

51–60 of 345 posts

Re: Still Why No HTTPS?

#51

Post by dependenttypes »

namibj wrote: post #48
Sukera wrote: post #33

Earlier quoted context omitted.

Do you have a source on that? Quite a few people seem to disagree: https://istlsfastyet.com/

Oh, yeah, for good clients it's totally fine. But e.g. a machine I'll try an http benchmark on in a couple hours (2 cires; 4780 BogoMIPS each) only managed 4177 ops/s using the fastest-available curve X25519 with openssl speed ecdh gatling -V -n -p 80 -u nobody I know this is somewhat extreme, but on a cpu that was about 30% faster I got 40k rps for small files using the kernel's loopback, which is where the cpu spen…

This should happen only during the handshake though.

Re: Still Why No HTTPS?

#52

Post by hrktb »

thenewnewguy wrote: post #36
onion-soup wrote: post #11

Earlier quoted context omitted.

While I appreciate the efforts of certbot to make it as user-friendly as possible I still find this state of things unforgivable. I don't know where it went wrong so that today a developer must spend time learning and tweaking a low-level encryption tools. I'm just saying https will never be 100% unless it becomes a baked-in feature of any hosting.

Developers don't need to, unless they're the ones hosting your website. In which case, yes, I expect them to be able to configure web hosting software.

This is sadly not the case yet in many not so edge cases.

For instance Heroku still doesn't provide straightforward support for wildcard domains under SSL: https://devcenter.heroku.com/articles/understanding-ssl-on-h...

There is myriad of other cases, basically every time you diverge a bit from the 80% path, you're in for a treat and will deal with all the intricacies of SSL management.

Re: Still Why No HTTPS?

#53

Post by dx034 »

jwr wrote: post #26
onion-soup wrote: post #6

Earlier quoted context omitted.

Nope, it is not straight-forward and still a confusing process.

It is relatively straightforward if you have a single site hosted on a well-supported operating system and web server. It suddenly becomes really, really complicated if you have multiple servers, multiple domains, nginx configurations that the tool does not expect (but insists on rewriting).

The rewrite is optional, it's also fairly trivial to let certbot create certificates and adapt nginx afterwards.

Re: Still Why No HTTPS?

#54

Post by Ayesh »

namibj wrote: post #27

There is one "good" reason against https: handshakes take enormous amounts of CPU, relatively speaking. It's quite easy tp DoS server by skipping the expensive part on your end. You can load a core with 10~30Mbit@2k rps if your not even optimized. Whereas the same server could tank 40k rps HTTP requests.

This is an argument I hear often, but I have yet to see an effective L7 DoS with the TLS handshake being the bottleneck. It's almost always the application code that gives up, rather than the CPU spikes due to TLS.

I have a 1 vCPU 2GB server that terminates TLS with dual Prime256v1/curve25519 + RSA 2048 setup with a 10 minute keepalive time, running AES 128, 256 (CPU has AES-NI), and CHACHA20-POLY1305 comfortably handling several millions of requests a day and CPU load hovering 10-20%.

The amount of ECC handshakes are surprisingly high, and CHACHA works wonders too with user agents today.

Given the threats from passive attacks today, this is a cost that must be paid. It just looks quite affordable with modern protocols.

Re: Still Why No HTTPS?

#55

Post by bcaa7f3a8bbc »

k33l0r wrote: post #10
wojciechpolak wrote: post #2

"gnu.org" is on the list marked as a Chinese website...

There are some other confusing ones as well. nature.com is marked as Chinese, as are nginx.org and ntp.org. example.com is Indian in the list as is the now defunct dmoz.org. I don't understand the methodology behind the country assignments at all…

I noticed it as well. I first thought it was a result of using CDN services or recycled IP addresses, but gnu.org doesn't use a CDN, and its IPv4 and IPv6 are both served by Hurricane Electric, which never did any business in mainland China.

Must be a bug.

Re: Still Why No HTTPS?

#56

Post by MrStonedOne »

uasm wrote: post #32
MrStonedOne wrote: post #24

Earlier quoted context omitted.

I am on alexa 1m (50k even). I do not have a load balancer, I do not have multiple servers for redundancy. This isn't even a static site, most of our page views are the wiki, the server running all of this has 8 cores and 4 are constantly maxxed out by a non-website related process. Most websites now and days are over engineered.

> "I am on alexa 1m (50k even). I do not have a load balancer, I do not have multiple servers for redundancy. This isn't even a static site, most of our page views are the wiki, the server running all of this has 8 cores and 4 are constantly maxxed out by a non-website related process. Most websites now and days are over engineered." That's awesome! Mind sharing some more details? (hosting plan/CDN/etc). Or even the…

Rented dedicated server running a 9900k. Windows hypervisor runs vms. database vm, website vm, and 3 game server vms running on this machine. each game server vm is running 2 instances of the game server, but only 1 ever has high pop.

https://tgstation13.org

Most of our traffic goes to our wiki: we are the most active open source video game on github. Most ss13 servers run their own codebase, forked from ours, but will still frequently point their players to our wiki rather then set one up on their own.

A Cloudflare caching layer was added back in march when we got a 4x spike in web traffic from a youtuber talking about the game.

Re: Still Why No HTTPS?

#57

Post by lorenzhs »

signed0 wrote: post #19
k33l0r wrote: post #10

Earlier quoted context omitted.

There are some other confusing ones as well. nature.com is marked as Chinese, as are nginx.org and ntp.org. example.com is Indian in the list as is the now defunct dmoz.org. I don't understand the methodology behind the country assignments at all…

Weirdly nature.com seems to actually redirect to https, as does zara.com, lenovo.com, genuis.com, and senate.gov. Is this list stale, or did no one spot-check this?

Same with w3.org, which is fifth on the list, and ebay-kleinanzeigen.de. Seems like quite a few entries are off.

Re: Still Why No HTTPS?

#58

Post by squiggleblaz »

signed0 wrote: post #19
k33l0r wrote: post #10

Earlier quoted context omitted.

There are some other confusing ones as well. nature.com is marked as Chinese, as are nginx.org and ntp.org. example.com is Indian in the list as is the now defunct dmoz.org. I don't understand the methodology behind the country assignments at all…

Weirdly nature.com seems to actually redirect to https, as does zara.com, lenovo.com, genuis.com, and senate.gov. Is this list stale, or did no one spot-check this?

Yes, senate.gov in particular:

% curl -I senate.gov HTTP/1.1 301 Moved Permanently Server: AkamaiGHost Content-Length: 0 Location: http://www.senate.gov/ Date: Tue, 17 Dec 2019 10:37:04 GMT Connection: keep-alive

% curl -I www.senate.gov HTTP/1.1 301 Moved Permanently Server: Apache Location: https://www.senate.gov/ Content-Length: 231 Content-Type: text/html; charset=iso-8859-1 Date: Tue, 17 Dec 2019 10:37:08 GMT Connection: keep-alive

It seems to meet the requirement for exclusion from the list. Data updated 16 Dec 2019, so I don't think it's stale.

I've also checked from Australian and a European connection, so I don't think it's a regional thing. The other genuis.com doesn't work for me, the other sites redirect and set a cookie.

Re: Still Why No HTTPS?

#59

Post by dx034 »

cesarb wrote: post #46
WilliamEdward wrote: post #4

Some websites adamantly insist they did not need HTTPS because they are purely static. https://www.troyhunt.com/heres-why-your-static-website-needs... The same website to my surprise has an article on why this is faulty reasoning.

Though I'm on the "encrypt all the things!" camp, let me play devil's advocate for a moment. If I set up a purely static HTTP-only site in 1998, it would still work with today's browsers, more than 20 years later. If I set up a purely static HTTPS-only site in 1998, and didn't follow the upgrade treadmill, it would have stopped working for modern browsers some time ago.

It would still work, just create a warning. For a page that hasn't been updated since 1998 that's ok imo. On the other hand, it needs to be hosted somewhere. Either a vps (which also needs updating) or a web hosting package (which tend to provide auto-renewing certificates). Just because the code is static doesn't mean nothing about the website has changed for 20 years.

Re: Still Why No HTTPS?

#60

Post by grecy »

WilliamEdward wrote: post #42
grecy wrote: post #40

Earlier quoted context omitted.

> i cannot stand is people who can do it, but refuse to out of laziness (Raises guilty hand) I run a couple of sites on my hosted server that are still http. They both sit behind a varnish setup and to be honest I just have not found the time to get it done. Usually when I mess with my configurations I lose a week to troubleshooting stupid stuff and I just can't bring myself to do it.

Hey at least you aren't running a fortune 500 with millions of users (You aren't right?)

haha, right. They're really just hobby projects, almost entirely read-only.
Post reply on HN