5 ms·

Wouldn't Let's Encrypt offset any significant benefit of this change? Is it somehow difficult or counterproductive for these sites to add a certificate?

by csulok 10y ago

dangrossman 10y ago
Getting more sites to use Let's Encrypt, or Cloudflare, or to buy a certificate is the intended benefit of the change. Google is gradually restricting these APIs to encrypted origins in order to encourage sites to use encryption, not because they don't want the APIs used.
- tschuy 10y ago
  > to encourage sites to use encryption And because having your fine location cross the wire unencrypted is a terrible idea :)
- tard 10y ago
  > or Cloudflare https://www.cloudflare.com/ssl/#cloudflare-ssl-options https://www.cloudflare.com/ssl/#cloudflare-ssl-options cloudflare's "flexible ssl" option encrypts the connection between their datacenter and the user, but not the one between the datacenter and the actual web server i guess it's better than nothing if your host doesn't support ssl but the false sense of security could be harmful
TazeTSchnitzel 10y ago
That assumes such sites' operators care about HTTPS.
untog 10y ago
It is counterproductive, as many ad networks are not fully HTTPS-compliant yet. So you'll literally lose money by switching to HTTPS. It's why many big media sites still haven't done it yet.
- Klathmon 10y ago
  It's a chicken-and-egg problem, but it's starting to improve. Honestly if google really wanted to push this, they would do something to penalize http only ads. That would really pressure advertisers to upgrade or lose.
  - AnkhMorporkian 10y ago
    Chrome 51 changelog: * Images served over unencrypted connections will have 50% of their pixels randomly scrambled.
  - cpeterso 10y ago
    Why don't ad networks care about HTTPS? It would increase the number of potential sites that can show their ads, make it more difficult for ISPs to block their ads, and allow browsers to load their ads over HTTP/2.
    - bbrazil 10y ago
      HTTPS requires additional round trips, so slows things down and tends to reduce revenue by a non-trivial amount.
      - cpeterso 10y ago
        If slow ads were a problem, why are ad networks so damn slow? I frequently see ads taking 10–20 seconds to load on major news sites. Serving fast ads would mean more viewing time, yet that doesn't seem to be a priority for anyone.
      - madeofpalk 10y ago
        Really? We added HTTPS to a number of ad-ridden sites and found no noticeable impact to end user page load times, page views or ad revenue.
      - Klathmon 10y ago
        "On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10 KB of memory per connection and less than 2% of network overhead. Many people believe that SSL/TLS takes a lot of CPU time and we hope the preceding numbers will help to dispel that." https://istlsfastyet.com/ https://istlsfastyet.com/
enobrev 10y ago
Coincidentally, I'm working on a travel app and had to spend some time automating let's encrypt on our servers because of the update. In the end, I came out as a huge fan of LE.

Wouldn't Let's Encrypt offset any significant benefit of this change? Is it somehow difficult or counterproductive for these sites to add a certificate?

by csulok 10y ago

Wouldn't Let's Encrypt offset any significant benefit of this change? Is it somehow difficult or counterproductive for these sites to add a certificate?

dangrossman 10y ago

Getting more sites to use Let's Encrypt, or Cloudflare, or to buy a certificate is the intended benefit of the change. Google is gradually restricting these APIs to encrypted origins in order to encourage sites to use encryption, not because they don't want the APIs used.

tschuy 10y ago
> to encourage sites to use encryption And because having your fine location cross the wire unencrypted is a terrible idea :)
tard 10y ago
> or Cloudflare https://www.cloudflare.com/ssl/#cloudflare-ssl-options https://www.cloudflare.com/ssl/#cloudflare-ssl-options cloudflare's "flexible ssl" option encrypts the connection between their datacenter and the user, but not the one between the datacenter and the actual web server i guess it's better than nothing if your host doesn't support ssl but the false sense of security could be harmful

TazeTSchnitzel 10y ago

That assumes such sites' operators care about HTTPS.

untog 10y ago

It is counterproductive, as many ad networks are not fully HTTPS-compliant yet. So you'll literally lose money by switching to HTTPS. It's why many big media sites still haven't done it yet.

Klathmon 10y ago
It's a chicken-and-egg problem, but it's starting to improve. Honestly if google really wanted to push this, they would do something to penalize http only ads. That would really pressure advertisers to upgrade or lose.
- AnkhMorporkian 10y ago
  Chrome 51 changelog: * Images served over unencrypted connections will have 50% of their pixels randomly scrambled.
- cpeterso 10y ago
  Why don't ad networks care about HTTPS? It would increase the number of potential sites that can show their ads, make it more difficult for ISPs to block their ads, and allow browsers to load their ads over HTTP/2.
  - bbrazil 10y ago
    HTTPS requires additional round trips, so slows things down and tends to reduce revenue by a non-trivial amount.
    - cpeterso 10y ago
      If slow ads were a problem, why are ad networks so damn slow? I frequently see ads taking 10–20 seconds to load on major news sites. Serving fast ads would mean more viewing time, yet that doesn't seem to be a priority for anyone.
    - madeofpalk 10y ago
      Really? We added HTTPS to a number of ad-ridden sites and found no noticeable impact to end user page load times, page views or ad revenue.
    - Klathmon 10y ago
      "On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10 KB of memory per connection and less than 2% of network overhead. Many people believe that SSL/TLS takes a lot of CPU time and we hope the preceding numbers will help to dispel that." https://istlsfastyet.com/ https://istlsfastyet.com/

enobrev 10y ago

Coincidentally, I'm working on a travel app and had to spend some time automating let's encrypt on our servers because of the update. In the end, I came out as a huge fan of LE.