5 ms·
In addition to things like Let's Encrypt, in more enterprise-y settings, I would also give credit to the slowly dying belief that SSL/TLS is too taxing on serve
by atonse 10y ago
In addition to things like Let's Encrypt, in more enterprise-y settings, I would also give credit to the slowly dying belief that SSL/TLS is too taxing on servers, and the ability to outsource your SSL/TLS termination to an extremely cheap cloud load balancer as well.
- jeremiep 10y agoHTTPS is also faster on the wire because intermediaries can't inspect the payload so they just forward it. Its ironic that with Spring, NHibernate and all the other bloated enterprise libs or thread-per-request models they still worry about SSL performance.
- themartorana 10y agoYes, all this. Although it drives me nuts that people consider SSL to be a deterrent to load times when the average page is as bloated as it is... But yeah, LetsEncrypt made SSL free, and for us, AWS's free auto-renewing certificates were the thing that made it easy to not have to worry about certificates anymore and to use them gratuitously. Edit: looking forward to all the Dreamhosts of the world making LetsEncrypt-based SSL standard on even their cheapest plans.
- sliverstorm 10y agoAgreed, the main reason most pages are slow these days is because they are slow- blaming it on SSL is pure scapegoating
- orionstein 10y agoAWS is what I use personally, and their certificate service is a breeze to use. Couple that with the ability to attach the certificate directly to the load balancer (one of the best features of the LB, in my mind), or to a Cloudfront distribution, and it's amazingly simple to have everything running with SSL.
- mrb 10y agoWe should also give credit to HTTP/2 (available only through HTTPS). People want the performance increase of HTTP/2 so they are forced to deploy HTTPS.
- merb 10y agoit's not only available through https. browser only allow http/2 over TLS thats something different. there is a insecure http/2 version just no browser implements it.
- pfg 10y agoI think that's pretty much the exact definition of "available" in this context. If it just exists in a RFC somewhere, I wouldn't call it "available".
- vertex-four 10y agoI really doubt that - support for HTTP/2 is generally still in its infancy, and web servers supporting it haven't made it into LTS releases of most distros yet.
- gnur 10y agoOn a talk from Daniel Stenberg earlier this year he told that over 60% of the clients already support HTTP/2. So there is a real incentive to start supporting it as it nearly always is faster and costs less connections for the server.
- rictic 10y agoEyeballing the stats at http://caniuse.com/#search=http2 http://caniuse.com/#search=http2 I think it's more like 85% of clients support it.
- nileshtrivedi 10y agoI installed HTTP/2 indicator extension for my browser and I am very surprised to see how many sites are already using HTTP/2. It's easily close to a third of the sites I use frequently.
- clevernickname 10y ago"Outsourcing TLS termination" is intentionally MitMing your users. Not really something to be happy about.
- johncolanduoni 10y agoIf you're outsourcing your TLS termination to the same people who are running your servers, you've barely made it easier for them to MITM your users. They could easily grab the private key off your server and do it anyway.
- clevernickname 10y agoThat's a big if. I was thinking about services like Cloudflare that terminate SSL close to the user, then tunnel the traffic to your servers. It cuts down on handshake latency and allows for secure distribution of cacheable content easily, but in return you are essentially handing your plaintext over to Cloudflare.