Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Switching Your Site to HTTPS on a Shoestring Budget

css-tricks.com

Post reply on HN
Print view View original

1–10 of 63 posts

Re: Switching Your Site to HTTPS on a Shoestring Budget

#2

Post by dijit »

Get SSL from using a thirdparty MITM?

Not only do they control your DNS they also control all traffic going to your site, also the connection between you and them is not encrypted.

I figured this would be a tutorial for letsencrypt. Cloudflare certainly is an option but it's not one I would recommend for -most- people unless I know why they're opting for SSL. If it's static content then sure- but I don't support cloudflare for dynamic content. I'm responsible for things like passwords and I can't keep that responsibility if I actually choose to MITM my own site with an external company.

Trust doesn't enter into it. I don't trust myself with your password so why would I trust anyone else?

Re: Switching Your Site to HTTPS on a Shoestring Budget

#4

Post by cknight »

dijit wrote: post #2

Get SSL from using a thirdparty MITM? Not only do they control your DNS they also control all traffic going to your site, also the connection between you and them is not encrypted. I figured this would be a tutorial for letsencrypt. Cloudflare certainly is an option but it's not one I would recommend for -most- people unless I know why they're opting for SSL. If it's static content then sure- but I don't support clou…

> also the connection between you and them is not encrypted.

The tutorial uses the Full encryption option, which does encrypt the data between your origin server and Cloudflare. You might be thinking of their flexible SSL option?

[EDIT] I might add that for anyone not using GitHub Pages as per the tutorial, they'll need additional steps to get Full SSL working with Cloudflare. It's not effortless.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#8

Post by moneytalks »

bluetooth wrote: post #3

Cloudflare is a valid suggestion, albeit (IMO) inferior to letsencrypt in many cases. Surprised to not see it mentioned here, given that it also costs nothing, for arguably more security.

Not to mention that Cloudflare has no tolerance for mocking murdered female protestors.

One little article and they kill your site with no warning.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#9

Post by icebraining »

dijit wrote: post #2

Get SSL from using a thirdparty MITM? Not only do they control your DNS they also control all traffic going to your site, also the connection between you and them is not encrypted. I figured this would be a tutorial for letsencrypt. Cloudflare certainly is an option but it's not one I would recommend for -most- people unless I know why they're opting for SSL. If it's static content then sure- but I don't support clou…

Playing Devil's advocate: when you run your site on any provider, except maybe colo'ing, you're also giving them access to that data, as they could peek into the system's memory . Using Cloudflare is just adding a second provider.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#10

Post by dom0 »

bluetooth wrote: post #3

Cloudflare is a valid suggestion, albeit (IMO) inferior to letsencrypt in many cases. Surprised to not see it mentioned here, given that it also costs nothing, for arguably more security.

LE doesn't work here. As the fine article points out, GitHub Pages does not support TLS on custom domains. With CF, this works.

For the sort of thing that you'd host on GHP, this is totally fine in my opinion. In fact, because CF is a pretty good CDN it likely accelerates page load times considerably for Non-Americans.

(I wish it'd be possible to do something similar for readthedocs, which only has one origin and it's located in North America, but alas this doesn't really work).

Post reply on HN