3 ms·

It is still expensive and cumbersome to implement HTTPS. Everybody seems to be neglecting the small websites deployed by hand, which are probably 99% of all the

by fiatjaf 10y ago

It is still expensive and cumbersome to implement HTTPS. Everybody seems to be neglecting the small websites deployed by hand, which are probably 99% of all the internet websites.

untog 10y ago
I would counter that small web sites deployed by hand are a lot less than 99% of all internet sites, because hand-deployed sites tend to go to down and never come back up.
the_duke 10y ago
Cumbersome? For most non-professionals running a small site, absolutely. That's where hosting providers need to step up to make it as easy as possible. Expensive? How? Thanks to Let's encrypt and others, certificates are now free.
- Jaruzel 10y ago
  Free is not the same as 'automatic' - until the process of obtaining a certificate and installing it on all the popular web hosting platforms is invisible to the site-owner then there will always be a barrier to implementation.
  - technion 10y ago
    cPanel, which runs most of the cheap web hosting platforms, now includes a Lets Encrypt plugin. In the coming update, it will be a plugin enabled by default.
- LunaSea 10y ago
  I'm sorry but I wouldn't call certificates with a lifetime of 90 days practical and I'm a developer. Let's Encrypt is still far from being convenient and usable for small companies or individuals that don't want to manage infrastructures and administration like writing a cron job that refreshes your certificate.
  - clarry 10y ago
    Yes that one liner takes so much effort to write [EDIT: copy from one of the bazillion articles that have already done it for you]. That's why we can't have security. It takes too much effort.
    - Jaruzel 10y ago
      For fun, next time you are on public transport, or sitting in an airport lounge, stand up and ask loudly 'Does anyone know what cron is?" The lack of raised hands, should answer for you why LetsEncrypt is not ready for mainstream use. Until Cert renewal is baked into all the hosting apps/platforms - HTTPs will never be ubiquitous.
      - inimino 10y ago
        Most of those people don't host their own websites, either.
        fiatjaf 10y ago
        But there are some who do. Not that they host it with their own computers, but they rent some space online and host it there.
  - cm3 10y ago
    uMatrix offers a feature to randomly pick a UA every 5 minutes from a set of known UAs. This works, although GMail might complain about the UA being too old. Reloading GMail resolves that. EDIT: Replied to the wrong parent, please ignore in this context.
    - sp332 10y ago
      I'm pretty sure you replied to the wrong comment. Or I'm more lost than I thought... EDIT: You can't delete comments with replies anymore. It's very annoying.
thejosh 10y ago
Most of those smaller sites are deployed using cPanel, and most cPanel providers have/will have a LetsEncrypt plugin to make automated HTTPS setup easy.
- fiatjaf 10y ago
  Ok, so we are good for all websites written in PHP (?)
josefresco 10y ago
I build a lot of "small sites" and you're correct - implementing SSL for them on a typical shared host is not drop dead easy (also not free). I also host with WPEngine, a more progressive WordPress only host - which has made SSL implementation extremely simple. They're an example of a modern approach to web hosting. It's the low cost, shared (LAMP) hosting providers that need to implement it into their sales process and make switching existing non-encrypted sites smooth. Unfortunately, I don't see them moving to "free SSL for everyone!" anytime soon as it's a revenue generator for most.
- tomschlick 10y ago
  You could also use something like Laravel Forge to spin up a LEMP server which has lets encrypt support built in. https://forge.laravel.com https://forge.laravel.com (it's not exclusive to just laravel apps)

by fiatjaf 10y ago

It is still expensive and cumbersome to implement HTTPS. Everybody seems to be neglecting the small websites deployed by hand, which are probably 99% of all the internet websites.

untog 10y ago

I would counter that small web sites deployed by hand are a lot less than 99% of all internet sites, because hand-deployed sites tend to go to down and never come back up.

the_duke 10y ago

Cumbersome? For most non-professionals running a small site, absolutely. That's where hosting providers need to step up to make it as easy as possible. Expensive? How? Thanks to Let's encrypt and others, certificates are now free.

Jaruzel 10y ago
Free is not the same as 'automatic' - until the process of obtaining a certificate and installing it on all the popular web hosting platforms is invisible to the site-owner then there will always be a barrier to implementation.
- technion 10y ago
  cPanel, which runs most of the cheap web hosting platforms, now includes a Lets Encrypt plugin. In the coming update, it will be a plugin enabled by default.
LunaSea 10y ago
I'm sorry but I wouldn't call certificates with a lifetime of 90 days practical and I'm a developer. Let's Encrypt is still far from being convenient and usable for small companies or individuals that don't want to manage infrastructures and administration like writing a cron job that refreshes your certificate.
- clarry 10y ago
  Yes that one liner takes so much effort to write [EDIT: copy from one of the bazillion articles that have already done it for you]. That's why we can't have security. It takes too much effort.
  - Jaruzel 10y ago
    For fun, next time you are on public transport, or sitting in an airport lounge, stand up and ask loudly 'Does anyone know what cron is?" The lack of raised hands, should answer for you why LetsEncrypt is not ready for mainstream use. Until Cert renewal is baked into all the hosting apps/platforms - HTTPs will never be ubiquitous.
    - inimino 10y ago
      Most of those people don't host their own websites, either.
      - fiatjaf 10y ago
        But there are some who do. Not that they host it with their own computers, but they rent some space online and host it there.
- cm3 10y ago
  uMatrix offers a feature to randomly pick a UA every 5 minutes from a set of known UAs. This works, although GMail might complain about the UA being too old. Reloading GMail resolves that. EDIT: Replied to the wrong parent, please ignore in this context.
  - sp332 10y ago
    I'm pretty sure you replied to the wrong comment. Or I'm more lost than I thought... EDIT: You can't delete comments with replies anymore. It's very annoying.

thejosh 10y ago

Most of those smaller sites are deployed using cPanel, and most cPanel providers have/will have a LetsEncrypt plugin to make automated HTTPS setup easy.

fiatjaf 10y ago
Ok, so we are good for all websites written in PHP (?)

josefresco 10y ago

I build a lot of "small sites" and you're correct - implementing SSL for them on a typical shared host is not drop dead easy (also not free). I also host with WPEngine, a more progressive WordPress only host - which has made SSL implementation extremely simple. They're an example of a modern approach to web hosting. It's the low cost, shared (LAMP) hosting providers that need to implement it into their sales process and make switching existing non-encrypted sites smooth. Unfortunately, I don't see them moving to "free SSL for everyone!" anytime soon as it's a revenue generator for most.

tomschlick 10y ago
You could also use something like Laravel Forge to spin up a LEMP server which has lets encrypt support built in. https://forge.laravel.com https://forge.laravel.com (it's not exclusive to just laravel apps)