6 ms·

Consider this: - Squarespace doesn't support SSL (other than on their ecommerce checkout pages) [1] - Weebly only allows it on their $25/mo business plan [2]

Consider this: - Squarespace doesn't support SSL (other than on their ecommerce checkout pages) [1] - Weebly only allows it on their $25/mo business plan [2] - Wordpress.com doesn't support SSL for sites with custom domains [3] - If you've never experienced the process of requesting, purchasing, and then installing an SSL certificate using a hosting control panel like Plesk or cPanel, let me tell you–it's a nightmare. All that to say, this is an interesting development that will leave a large % of small business websites with a red mark in their browser. [1] https://support.squarespace.com/hc/en-us/articles/205815898-Does-Squarespace-support-SSL-access- https://support.squarespace.com/hc/en-us/articles/205815898-... [2] http://www.weebly.com/pricing http://www.weebly.com/pricing [3] https://en.forums.wordpress.com/topic/support-for-https-for-custom-domain https://en.forums.wordpress.com/topic/support-for-https-for-...

cpeterso 11y ago
DreamHost now supports Let's Encrypt through their admin panel. The only instructions, however, are a community-maintained wiki page that is already outdated, referring to panel menus that no longer exist. I successfully obtained my certificate, but it was not easy.
- tobtoh 11y ago
  Based on your comment, I went over to see if I could obtain a certificate. It took all of 5 seconds for me to do - it's all automated via the admin panel now. Just tick the box to make your site secure. Looks like DH has resolved any initial issues they had.
BinaryIdiot 11y ago
Yeah I'm all for SSL shaming but my personal site with SquareSpace is about to look like shit for me since I'm a web developer. I mean as a web developer it's not going to look good if your portfolio is shown with a security warning. I wonder if SquareSpace is going to finally fix their shit or if I'm going to have to move elsewhere which is going to be a pain (I went with SquareSpace because I didn't want to be assed with dealing with much of anything for a personal site).
- dkonofalski 11y ago
  No offense intended with this, but, as a web developer, what the heck are you doing creating your site on SquareSpace? Shouldn't you...I dunno...develop your own web site?
  - deleted 11y ago
    [deleted]
  - girvo 11y ago
    No offense intended, but as a web developer, why the heck would I waste my time coding things from scratch, setting up tooling, deployment infrastructure and managing yet another server when I could use a service that does all of that for me? For certain contexts it is far superior. Right tool for the right job, and all that.
  - bphogan 11y ago
    Because they don't get paid to build their own stuff. They get paid to do work for clients. A variation on the "shoemaker has no shoes."
    - vacri 11y ago
      With that argument, there should be no marketing departments.
      - bphogan 11y ago
        ...no, the marketing department's job is to market the company and keep it in the public eye. Perhaps you're thinking of an advertising agency. And I've observed they have the same problem. If a web developer was large enough to have its own marketing department it could maintain its own site. In any event, I'm busy developing apps for clients all day - I don't get paid to work on my own stuff so it has lower priority.
  - BinaryIdiot 11y ago
    I would much rather spend my time creating cool shit to share on GitHub and my site rather than maintain and pay bandwidth, CPU usage, etc bills just so I have a very basic blog and portfolio. Any web developer can write their own blog and website so who cares about that?
icebraining 11y ago
Then maybe those platforms will finally implement it. In any case, there's an alternative: putting Cloudflare in front of the site. In fact, Google shows me a guide to do so when I search for "squarespace ssl". Of course, that's hardly as secure as end-to-end HTTPS, but still, I trust the path between CF and SquareSpace much more than between the user's browser and SquareSpace.
- lambau 11y ago
  Please do not put Cloudflare in front of your site. It makes it impossible for tor and VPN users to view your site since they have to solve an impossible captcha to even see the static content.
  - mintplant 11y ago
    It's possible to turn off security in the CloudFlare control panel. I think the bigger issue is that CloudFlare has become a single point of interception for MITM'ing huge portions of web traffic.
    - ryanlol 11y ago
      I'm not sure, but I think CloudFlare will still hit Tor users with (unsolvable) captchas even with the lowest security settings. But yeah, this NSA slide is extremely relevant to cloudflare: http://cdn01.androidauthority.net/wp-content/uploads/2014/06/SSL-Added-and-Removed-Here.jpg http://cdn01.androidauthority.net/wp-content/uploads/2014/06...
      - lambau 11y ago
        > I think CloudFlare will still hit Tor users with (unsolvable) captchas even with the lowest security settings. That is correct. I have not been able to get passed a Cloudflare captcha over tor for any website.
- ryanlol 11y ago
  But putting CloudFlare in front of your site makes mass surveillance even easier than it would be for plaintext traffic without CloudFlare.
mediumdeviation 11y ago
I've managed to get Let's Encrypt working on a shared hosting environment using letsencrypt-nosudo in less than half an hour from the time I started cloning the repo to finally pasting the cert into cPanel. And every step in that process except the final one of installing the cert using cPanel can be automated.
zackboe 11y ago
Plesk built a Let's Encrypt extension: https://devblog.plesk.com/2015/12/lets-encrypt-plesk/ https://devblog.plesk.com/2015/12/lets-encrypt-plesk/
gospelwut 11y ago
The --webroot module for LetsEncrypt is as easy as pointing to /var/www.

cpeterso 11y ago

DreamHost now supports Let's Encrypt through their admin panel. The only instructions, however, are a community-maintained wiki page that is already outdated, referring to panel menus that no longer exist. I successfully obtained my certificate, but it was not easy.

tobtoh 11y ago
Based on your comment, I went over to see if I could obtain a certificate. It took all of 5 seconds for me to do - it's all automated via the admin panel now. Just tick the box to make your site secure. Looks like DH has resolved any initial issues they had.

BinaryIdiot 11y ago

Yeah I'm all for SSL shaming but my personal site with SquareSpace is about to look like shit for me since I'm a web developer. I mean as a web developer it's not going to look good if your portfolio is shown with a security warning. I wonder if SquareSpace is going to finally fix their shit or if I'm going to have to move elsewhere which is going to be a pain (I went with SquareSpace because I didn't want to be assed with dealing with much of anything for a personal site).

dkonofalski 11y ago
No offense intended with this, but, as a web developer, what the heck are you doing creating your site on SquareSpace? Shouldn't you...I dunno...develop your own web site?
- deleted 11y ago
  [deleted]
- girvo 11y ago
  No offense intended, but as a web developer, why the heck would I waste my time coding things from scratch, setting up tooling, deployment infrastructure and managing yet another server when I could use a service that does all of that for me? For certain contexts it is far superior. Right tool for the right job, and all that.
- bphogan 11y ago
  Because they don't get paid to build their own stuff. They get paid to do work for clients. A variation on the "shoemaker has no shoes."
  - vacri 11y ago
    With that argument, there should be no marketing departments.
    - bphogan 11y ago
      ...no, the marketing department's job is to market the company and keep it in the public eye. Perhaps you're thinking of an advertising agency. And I've observed they have the same problem. If a web developer was large enough to have its own marketing department it could maintain its own site. In any event, I'm busy developing apps for clients all day - I don't get paid to work on my own stuff so it has lower priority.
- BinaryIdiot 11y ago
  I would much rather spend my time creating cool shit to share on GitHub and my site rather than maintain and pay bandwidth, CPU usage, etc bills just so I have a very basic blog and portfolio. Any web developer can write their own blog and website so who cares about that?

icebraining 11y ago

Then maybe those platforms will finally implement it. In any case, there's an alternative: putting Cloudflare in front of the site. In fact, Google shows me a guide to do so when I search for "squarespace ssl". Of course, that's hardly as secure as end-to-end HTTPS, but still, I trust the path between CF and SquareSpace much more than between the user's browser and SquareSpace.

lambau 11y ago
Please do not put Cloudflare in front of your site. It makes it impossible for tor and VPN users to view your site since they have to solve an impossible captcha to even see the static content.
- mintplant 11y ago
  It's possible to turn off security in the CloudFlare control panel. I think the bigger issue is that CloudFlare has become a single point of interception for MITM'ing huge portions of web traffic.
  - ryanlol 11y ago
    I'm not sure, but I think CloudFlare will still hit Tor users with (unsolvable) captchas even with the lowest security settings. But yeah, this NSA slide is extremely relevant to cloudflare: http://cdn01.androidauthority.net/wp-content/uploads/2014/06/SSL-Added-and-Removed-Here.jpg http://cdn01.androidauthority.net/wp-content/uploads/2014/06...
    - lambau 11y ago
      > I think CloudFlare will still hit Tor users with (unsolvable) captchas even with the lowest security settings. That is correct. I have not been able to get passed a Cloudflare captcha over tor for any website.
ryanlol 11y ago
But putting CloudFlare in front of your site makes mass surveillance even easier than it would be for plaintext traffic without CloudFlare.

mediumdeviation 11y ago

I've managed to get Let's Encrypt working on a shared hosting environment using letsencrypt-nosudo in less than half an hour from the time I started cloning the repo to finally pasting the cert into cPanel. And every step in that process except the final one of installing the cert using cPanel can be automated.

zackboe 11y ago

Plesk built a Let's Encrypt extension: https://devblog.plesk.com/2015/12/lets-encrypt-plesk/ https://devblog.plesk.com/2015/12/lets-encrypt-plesk/

gospelwut 11y ago

The --webroot module for LetsEncrypt is as easy as pointing to /var/www.