4 ms·
I don't know why sites don't just use HTTPS for everydamnedthing. It's 2016. SSL is not that computationally expensive and it's just easier to develop an entire
by mosburger 11y ago
I don't know why sites don't just use HTTPS for everydamnedthing. It's 2016. SSL is not that computationally expensive and it's just easier to develop an entire site that way anyway (rather than making some pages secure and other non-secure). Just redirect everything to https and forget about it.
- vog 11y agoAlso, SNI is available since IE 7, so the times where you need an extra IPv4 address for every SSL domain are almost over. (Or, are there any websites still trying to support IE 6 or 5.5, apart from large online shops?)
- deleted 11y ago[deleted]
- codazoda 11y agoI work on a site with a long history. I recently created a benchmark and found that I could make around 500 synchronous HTTP requests to our infrastructure per second (essentially localhost calls). If I switch my benchmark to HTTPS I can only make about 5. That's a big difference. I'm a developer, not a hardware guy, so I don't know what causes the slowdown for us. I assume it's the actual setup and teardown of the HTTPS connection. That is a fairly significant difference when I want to use API's via HTTP/HTTPS and I need to make a lot of calls quickly. My point is that HTTPS still seems to be 100x more computationally expensive than HTTP.
- M2Ys4U 11y agoI agree with you, however the bureaucracy at some companies is insane. In order for me to get a TLS certificate where I work I have to create a CSR, fill in a word document, attach those to a Jira ticket, the operations team will then hand those over to a contractor who talks to our chosen CA. Up to 10 working days(!) later I get an OV certificate back. How I wish we were allowed to use Lets Encrypt.