Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS for GitHub Pages

github.com

Post reply on HN
Print view View original

91–100 of 102 posts

Re: HTTPS for GitHub Pages

#91

Post by manigandham »

MichaelGG wrote: post #89
2bitencryption wrote: post #87

Earlier quoted context omitted.

https://www.benburwell.com/posts/configuring-cloudflare-univ...

That article doesn't address what I said at all. That's showing how to disable encryption on the backend (CF to Github) by selecting "Flexible". Looking at CF's help again and having used them a bit, there seems to be no way at all to enable full encryption (user-CF-github) with CF's non-enterprise offerings. This is because the request from CF to Github is still requested with your domain name (TLS and host header).…

You're right that the host header wouldn't match but Cloudflare has an option to enable SSL to origin without checking for completely validated certificate. They call this Full rather than Strict: https://www.cloudflare.com/a/static/images/ssl/ssl.png

So you can still get an encrypted connection without a verified certificate.

Re: HTTPS for GitHub Pages

#92

Post by HappyTypist »

lucaspiller wrote: post #77
philtar wrote: post #50

Earlier quoted context omitted.

I consider your pricing to be completely out of touch with reality.

What sort of price would you consider good for static site hosting? GitHub provide theirs for free as it's a loss-leader, where as this is ther main business.

$4 a month (billed monthly) for 5 GB storage.

Gotta be cheaper than digital ocean.

Re: HTTPS for GitHub Pages

#93

Post by libeclipse »

rev_bird wrote: post #62
avyfain wrote: post #33

Earlier quoted context omitted.

"HTTPS is not supported for GitHub Pages using custom domains"[1] which is annoying. [1]: https://help.github.com/articles/securing-your-github-pages-...

Custom domains would be huge for me, but I totally understand. How would they ever manage to do it? They'd either need a zillion separate entries, or the broadest wildcard cert ever.

Or they could let users specify their own certs.

Re: HTTPS for GitHub Pages

#94

Post by aorth »

From the announcement (because I was confused):

You have been able to request Pages sites over HTTPS for some time, but we refrained from officially supporting it because the traffic from our CDN to our servers wasn't encrypted until now.

Re: HTTPS for GitHub Pages

#95

Post by MichaelGG »

manigandham wrote: post #91
MichaelGG wrote: post #89

Earlier quoted context omitted.

That article doesn't address what I said at all. That's showing how to disable encryption on the backend (CF to Github) by selecting "Flexible". Looking at CF's help again and having used them a bit, there seems to be no way at all to enable full encryption (user-CF-github) with CF's non-enterprise offerings. This is because the request from CF to Github is still requested with your domain name (TLS and host header).…

You're right that the host header wouldn't match but Cloudflare has an option to enable SSL to origin without checking for completely validated certificate. They call this Full rather than Strict: https://www.cloudflare.com/a/static/images/ssl/ssl.png So you can still get an encrypted connection without a verified certificate.

>encrypted connection without a verified certificate

Encryption doesn't work very well without authentication. In most cases any attacker with access to the medium has read+write. And without auth, you only need to, say, change DNS to insert yourself.

Opportunistic encryption is really just a last-line defence against dragnet type surveillance. Which is good, but it's hardly having end-to-end.

Re: HTTPS for GitHub Pages

#96

Post by MichaelGG »

narrowrail wrote: post #83
mryan wrote: post #82

Earlier quoted context omitted.

You raise an interesting point. The prices seem too high for some commenters. They are presumably capable of doing this themselves on a DO box so they do not think it is valuable enough to justify that price. However, one of the features of their highest price ($39/month) plan is that you can use 100 custom domains. If you have 100 domains hosted on Route 53 you will be paying over $50/month for domains, at which poi…

Netlify never misses an opportunity to self-promote in these SSG related threads, but AWS S3/Cloudfront/route53 is so cheap and simple for the audience that would even understand the point of Netlify, it's difficult to understand their target market. Netlify is priced like Squarespace, Wix, Weebly, etc. which are quite a bit simpler.

The fact that I can click on their homepage and drag-n-drop a site folder and have it just work is pretty damn slick. $39 is nothing if you don't have to deal with stuff. The absolute cheapest guys I work with are at least $50/hr. So if it saves an hour here and there it's worth it. And more likely, you'll spend 3-4 figures in time if there's any sort of hiccup in your AWS setup.

I don't think people are thinking how nice it is to have someone take care of stuff for you, totally. If there's any sort of issue, one email, and you're done. And people aren't thinking how tiny $39 is.

Again, I've never heard of Netlify before, but the product sounds great. HN is just messed up on pricing because they're looking at AWS costs instead of customer value.

I think HN also devalues their own time: I've been running webservers since the 90s, so I know it's "easy" to do, yet it's one more thing to have to think about. Although I suppose some might enjoy it.

Re: HTTPS for GitHub Pages

#97

Post by nsgi »

rev_bird wrote: post #62
avyfain wrote: post #33

Earlier quoted context omitted.

"HTTPS is not supported for GitHub Pages using custom domains"[1] which is annoying. [1]: https://help.github.com/articles/securing-your-github-pages-...

Custom domains would be huge for me, but I totally understand. How would they ever manage to do it? They'd either need a zillion separate entries, or the broadest wildcard cert ever.

Lots of certificates with 100 hostnames each is how CloudFlare does it.

Re: HTTPS for GitHub Pages

#98

Post by nsgi »

mlissner wrote: post #46
max_ wrote: post #26

Earlier quoted context omitted.

Currently, they don't have plans. just use cloudflare.

That doesn't actually create a properly encrypted connection. It only encrypts between the user and the site (at CloudFlare), not between the site and Github. Without that last hop being encrypted, you have to weigh whether this is an improvement or not.

You can now actually use CloudFlare to issue a custom certificate for your origin server that it will accept (CloudFlare Origin CA), but of course GitHub pages won't support installing it.

Re: HTTPS for GitHub Pages

#99

Post by reacweb »

HappyTypist wrote: post #92
lucaspiller wrote: post #77

Earlier quoted context omitted.

What sort of price would you consider good for static site hosting? GitHub provide theirs for free as it's a loss-leader, where as this is ther main business.

$4 a month (billed monthly) for 5 GB storage. Gotta be cheaper than digital ocean.

I love my hosting (https://www.scaleway.com/pricing/#pricing_baremetal): 3.6 € for 50 GB and total freedom.

Re: HTTPS for GitHub Pages

#100

Post by philtar »

lucaspiller wrote: post #77
philtar wrote: post #50

Earlier quoted context omitted.

I consider your pricing to be completely out of touch with reality.

What sort of price would you consider good for static site hosting? GitHub provide theirs for free as it's a loss-leader, where as this is ther main business.

Something not based on made up metrics like domain names. I'm actually using up space, bandwidth and CI time. Charge me on that.
Post reply on HN