8 ms·

Honestly, why would you do any of those things, now that installing a certificate takes 5 minutes and is free, with Let's Encrypt? I know that you're just expl

Honestly, why would you do any of those things, now that installing a certificate takes 5 minutes and is free, with Let's Encrypt? I know that you're just exploring solutions because it's interesting, but all those things take longer than Let's Encrypt.

PretzelFisch 10y ago
Because that is just not true in many cases. And let's encrypt is a big hassle if you can't automate the cert replacement.
sgk284 10y ago
Have you ever been on a team at a large company? Tons of bureaucracy. You're correct that Let's Encrypt is the path of least resistance in a shop where you control everything. In many large companies the path of least resistance is tweaking whatever is in your immediate control (e.g. the text inputs / javascript you're writing).
michaelmior 10y ago
> takes 5 minutes This is entirely dependent on how your site is hosted. For some shared hosting platforms, it may not be possible at all.
- disiplus 10y ago
  also u have to do the request over port 443, and the alternative dns validation is not supported in in the official client. so its 5 min only in ideal case.
ocdtrekkie 10y ago
Let's Encrypt is great, but completely useless for... Actually every single website I host. No wildcard certs, the rapid rotation that requires software to renew it regularly, etc. The cost of implementing HTTPS for dozens of sites with no sensitive data is simply not worth it. When companies like Google and Mozilla decided how to handle HTTPS, they decided based on their needs and their perception of everyone else's needs, like banks and major corporations. This led, IMHO, to a complete failure to recognize a lot of other uses for the Internet, and so their solutions fail to adequately account for them.
- Karunamon 10y ago
  HTTPS is for the user's benefit, not the site owner's (barring legislation, of course). Also, HTTPS prevents hijacking, not just sniffing, of content by a MITM. That includes malware injection. This has been coming for quite a long time. The time for excuses is over. If you think the safety of your users is "simply not worth it", well, I'd like to know what your websites are so I can block them at my firewall. I'm not saying this to be a dick, I'm saying this because this is an attitude of callous disregard on display, and it's downright odious given the modern security climate. LE is not that hard to use, and I seriously question whether you can't make an API call once every 90 days per subdomain. The requirements have never been lower.
  - jaas 10y ago
    HTTPS is very much for the site owner's benefit as well. If your site is not HTTPS then you can't be sure that your users are seeing what you intend them to see. Ads, malicious script, whatever, can be injected or replace your content.
  - deleted 10y ago
    [deleted]
- nommm-nommm 10y ago
  HTTPS is to ensure privacy and integrity for the end user not for the benefit of Google and banks.
- icebraining 10y ago
  If there's not sensitive data, then there's no password field (passwords are by definition sensitive), and Chrome won't show a warning. So what's the problem?
  - ocdtrekkie 10y ago
    Passwords are NOT by definition sensitive, and this is the sort of absolutist nonsense that I'm complaining about. Passwords are only as sensitive as the data they access.
nommm-nommm 10y ago
If the only thing you host is a small blog without ads on a server that you have complete control over and spun up last month or something, sure it's 5 minutes. In the real world, for many commercial operations, and especially for legacy code, there can be significant hurdles. For example, it took the NY Times 2 years to move to HTTPS, significantly more than 5 minutes, and they haven't even migrated 100% yet. https://www.thesslstore.com/blog/new-york-times-moves-website-https/ https://www.thesslstore.com/blog/new-york-times-moves-websit... Troy Hunt, a security expert, wrote about this topic a year and a half ago, and explained why, at the time he wrote it, his site wasnt HTTPS. http://www.troyhunt.com/were-struggling-to-get-traction-with/amp/ http://www.troyhunt.com/were-struggling-to-get-traction-with... (this was before let's Encryt) >unless you’re reading this in the future, you’re reading it on my blog over an insecure connection. That wasn’t such a big deal in 2009 when I started it, but it is now and there’s nothing I can do about it without investing some serious effort and dollars. I run on Google’s Blogger service which ironically given their earlier mentioned push to SSL, does not support it. Whilst Google doesn’t give me a means of directly serving content over SSL, I could always follow my own advice and wrap CloudFlare’s free service around it, but that won’t work unless I update the source of every single image I’ve ever added to almost 400 existing blog posts… and there’s no find and replace feature. This is the joy of SaaS – it’s super easy to manage and good at what it’s specifically designed to do, but try and step outside of that and, well, you’re screwed. Another real world example, that I've encountered - your software is an intraweb site running on your customer's server and you have to play by their rules and policies on what your customers can put on their servers and when. And it's on exactly nobody's priority list.
- iancarroll 10y ago
  It can indeed take some time to switch over, but why would you intentionally suppress a correct warning in the meantime? There is no good reason to mislead users here.
  - nommm-nommm 10y ago
    Because, here in the real world, my paycheck depends on keeping my customers happy.
barnacs 10y ago
It may take way more than 5 minutes. My experience with let's encrypt so far: - the name of their tool was changed form "letsencrypt" to "certbot", breaking my cronjob - for daemons that try to access the cert/key as non-privileged users, additional fiddling with permissions is necessary, which may even be overwritten on cert update if done incorrectly - when the certs are renewed, daemons need to reload them. This means that ideally, you need to detect when a renewal actually happens (as opposed to an attempt), keep an up-to-date list of all daemons that use the certs and possibly completely restart them, dropping all existing connections (some daemons just don't support a live reload) I'm not saying these problems are unsolvable, but may take way more than 5 minutes and I, for one, opted to renew my startcom certificate for another 3 years instead.
- stanleydrew 10y ago
  > I, for one, opted to renew my startcom certificate for another 3 years instead. Wait really? When did you do this? I thought all certs signed by their root after sometime in October or November are all considered invalid due to their shenanigans with WoSign. Not so? https://news.ycombinator.com/item?id=12787029 https://news.ycombinator.com/item?id=12787029
  - barnacs 10y ago
    10/18/2016 > Distrust certificates with a notBefore date after October 21, 2016 Just in time!
- nkkollaw 10y ago
  I just followed the instructions on their website, and it took me less than 5 minutes, including setting up the cronjob. The cronjob correctly renewed the certificate at least once on multiple servers, with no issues whatsoever. I was also warned that the certificates were expiring via email, which I thought was awesome. Your mileage might vary.
megablast 10y ago
Bullshit. Not if you have shared hosting. Or 1000 over different situations that you clearly have not thought about.
- agildehaus 10y ago
  So shared hosts will have to move to making HTTPS simple to implement for their users. Sorry, but progress must be made in this area. And if not, it's no big deal, users will just be informed that the page is not secure, which is true. Don't like the message? Work to secure your damn website.
discreditable 10y ago
> now that installing a certificate takes 5 minutes and is free, with Let's Encrypt? It's only easy if you're using a Linux webserver. In IIS land it's a pain.

PretzelFisch 10y ago

Because that is just not true in many cases. And let's encrypt is a big hassle if you can't automate the cert replacement.

sgk284 10y ago

Have you ever been on a team at a large company? Tons of bureaucracy. You're correct that Let's Encrypt is the path of least resistance in a shop where you control everything. In many large companies the path of least resistance is tweaking whatever is in your immediate control (e.g. the text inputs / javascript you're writing).

michaelmior 10y ago

> takes 5 minutes This is entirely dependent on how your site is hosted. For some shared hosting platforms, it may not be possible at all.

disiplus 10y ago
also u have to do the request over port 443, and the alternative dns validation is not supported in in the official client. so its 5 min only in ideal case.

ocdtrekkie 10y ago

Let's Encrypt is great, but completely useless for... Actually every single website I host. No wildcard certs, the rapid rotation that requires software to renew it regularly, etc. The cost of implementing HTTPS for dozens of sites with no sensitive data is simply not worth it. When companies like Google and Mozilla decided how to handle HTTPS, they decided based on their needs and their perception of everyone else's needs, like banks and major corporations. This led, IMHO, to a complete failure to recognize a lot of other uses for the Internet, and so their solutions fail to adequately account for them.

Karunamon 10y ago
HTTPS is for the user's benefit, not the site owner's (barring legislation, of course). Also, HTTPS prevents hijacking, not just sniffing, of content by a MITM. That includes malware injection. This has been coming for quite a long time. The time for excuses is over. If you think the safety of your users is "simply not worth it", well, I'd like to know what your websites are so I can block them at my firewall. I'm not saying this to be a dick, I'm saying this because this is an attitude of callous disregard on display, and it's downright odious given the modern security climate. LE is not that hard to use, and I seriously question whether you can't make an API call once every 90 days per subdomain. The requirements have never been lower.
- jaas 10y ago
  HTTPS is very much for the site owner's benefit as well. If your site is not HTTPS then you can't be sure that your users are seeing what you intend them to see. Ads, malicious script, whatever, can be injected or replace your content.
- deleted 10y ago
  [deleted]
nommm-nommm 10y ago
HTTPS is to ensure privacy and integrity for the end user not for the benefit of Google and banks.
icebraining 10y ago
If there's not sensitive data, then there's no password field (passwords are by definition sensitive), and Chrome won't show a warning. So what's the problem?
- ocdtrekkie 10y ago
  Passwords are NOT by definition sensitive, and this is the sort of absolutist nonsense that I'm complaining about. Passwords are only as sensitive as the data they access.

nommm-nommm 10y ago

If the only thing you host is a small blog without ads on a server that you have complete control over and spun up last month or something, sure it's 5 minutes. In the real world, for many commercial operations, and especially for legacy code, there can be significant hurdles. For example, it took the NY Times 2 years to move to HTTPS, significantly more than 5 minutes, and they haven't even migrated 100% yet. https://www.thesslstore.com/blog/new-york-times-moves-website-https/ https://www.thesslstore.com/blog/new-york-times-moves-websit... Troy Hunt, a security expert, wrote about this topic a year and a half ago, and explained why, at the time he wrote it, his site wasnt HTTPS. http://www.troyhunt.com/were-struggling-to-get-traction-with/amp/ http://www.troyhunt.com/were-struggling-to-get-traction-with... (this was before let's Encryt) >unless you’re reading this in the future, you’re reading it on my blog over an insecure connection. That wasn’t such a big deal in 2009 when I started it, but it is now and there’s nothing I can do about it without investing some serious effort and dollars. I run on Google’s Blogger service which ironically given their earlier mentioned push to SSL, does not support it. Whilst Google doesn’t give me a means of directly serving content over SSL, I could always follow my own advice and wrap CloudFlare’s free service around it, but that won’t work unless I update the source of every single image I’ve ever added to almost 400 existing blog posts… and there’s no find and replace feature. This is the joy of SaaS – it’s super easy to manage and good at what it’s specifically designed to do, but try and step outside of that and, well, you’re screwed. Another real world example, that I've encountered - your software is an intraweb site running on your customer's server and you have to play by their rules and policies on what your customers can put on their servers and when. And it's on exactly nobody's priority list.

iancarroll 10y ago
It can indeed take some time to switch over, but why would you intentionally suppress a correct warning in the meantime? There is no good reason to mislead users here.
- nommm-nommm 10y ago
  Because, here in the real world, my paycheck depends on keeping my customers happy.

barnacs 10y ago

It may take way more than 5 minutes. My experience with let's encrypt so far: - the name of their tool was changed form "letsencrypt" to "certbot", breaking my cronjob - for daemons that try to access the cert/key as non-privileged users, additional fiddling with permissions is necessary, which may even be overwritten on cert update if done incorrectly - when the certs are renewed, daemons need to reload them. This means that ideally, you need to detect when a renewal actually happens (as opposed to an attempt), keep an up-to-date list of all daemons that use the certs and possibly completely restart them, dropping all existing connections (some daemons just don't support a live reload) I'm not saying these problems are unsolvable, but may take way more than 5 minutes and I, for one, opted to renew my startcom certificate for another 3 years instead.

stanleydrew 10y ago
> I, for one, opted to renew my startcom certificate for another 3 years instead. Wait really? When did you do this? I thought all certs signed by their root after sometime in October or November are all considered invalid due to their shenanigans with WoSign. Not so? https://news.ycombinator.com/item?id=12787029 https://news.ycombinator.com/item?id=12787029
- barnacs 10y ago
  10/18/2016 > Distrust certificates with a notBefore date after October 21, 2016 Just in time!
nkkollaw 10y ago
I just followed the instructions on their website, and it took me less than 5 minutes, including setting up the cronjob. The cronjob correctly renewed the certificate at least once on multiple servers, with no issues whatsoever. I was also warned that the certificates were expiring via email, which I thought was awesome. Your mileage might vary.

megablast 10y ago

Bullshit. Not if you have shared hosting. Or 1000 over different situations that you clearly have not thought about.

agildehaus 10y ago
So shared hosts will have to move to making HTTPS simple to implement for their users. Sorry, but progress must be made in this area. And if not, it's no big deal, users will just be informed that the page is not secure, which is true. Don't like the message? Work to secure your damn website.

discreditable 10y ago

> now that installing a certificate takes 5 minutes and is free, with Let's Encrypt? It's only easy if you're using a Linux webserver. In IIS land it's a pain.