5 ms·

If the only thing you host is a small blog without ads on a server that you have complete control over and spun up last month or something, sure it's 5 minutes.

If the only thing you host is a small blog without ads on a server that you have complete control over and spun up last month or something, sure it's 5 minutes. In the real world, for many commercial operations, and especially for legacy code, there can be significant hurdles. For example, it took the NY Times 2 years to move to HTTPS, significantly more than 5 minutes, and they haven't even migrated 100% yet. https://www.thesslstore.com/blog/new-york-times-moves-website-https/ https://www.thesslstore.com/blog/new-york-times-moves-websit... Troy Hunt, a security expert, wrote about this topic a year and a half ago, and explained why, at the time he wrote it, his site wasnt HTTPS. http://www.troyhunt.com/were-struggling-to-get-traction-with/amp/ http://www.troyhunt.com/were-struggling-to-get-traction-with... (this was before let's Encryt) >unless you’re reading this in the future, you’re reading it on my blog over an insecure connection. That wasn’t such a big deal in 2009 when I started it, but it is now and there’s nothing I can do about it without investing some serious effort and dollars. I run on Google’s Blogger service which ironically given their earlier mentioned push to SSL, does not support it. Whilst Google doesn’t give me a means of directly serving content over SSL, I could always follow my own advice and wrap CloudFlare’s free service around it, but that won’t work unless I update the source of every single image I’ve ever added to almost 400 existing blog posts… and there’s no find and replace feature. This is the joy of SaaS – it’s super easy to manage and good at what it’s specifically designed to do, but try and step outside of that and, well, you’re screwed. Another real world example, that I've encountered - your software is an intraweb site running on your customer's server and you have to play by their rules and policies on what your customers can put on their servers and when. And it's on exactly nobody's priority list.

iancarroll 10y ago
It can indeed take some time to switch over, but why would you intentionally suppress a correct warning in the meantime? There is no good reason to mislead users here.
- nommm-nommm 10y ago
  Because, here in the real world, my paycheck depends on keeping my customers happy.
  - jrockway 10y ago
    How happy will your customers be when they find out that you're just pulling the wool over their eyes instead of doing your job?
    - nommm-nommm 10y ago
      Did you read what I wrote? I do my job but there's only so much I can do if the owners of the servers who are serving my software tell me "before we can change this server's configuration we need approval from another office, it will be a few months until they can get back to us." (This is a hypothetical situation, for me, because I eventually got all my customers on HTTPS back around 2012 or so. There was some push back and it did take a long time and we had to be very persistent with some customers... But it was well worth it!) We are talking about the world of corporate IT and pointy haired bosses. I don't implement a social network, or email, I don't accept payments - I make intraweb sites that non-technical corporate paperpushers use to do their job. They are only interested in getting their work done; they are happy when they can get their work done without scary warnings they don't understand. If my software is giving them errors they are going to believe that it's my software that's the problem, and that doesn't look good for us. And we have to field support calls and explain ourselves. ...Or we could put a quick and dirty stopgate in to avoid something that makes us look bad and we can't do anything about.
      - foota 10y ago
        Man, that fourth paragraph is a work of art.
notatoad 10y ago
If you have 3rd party ads on your login page, you're doing something very, very wrong and you deserve to have all kinds of warnings flashing up.
Piskvorrr 10y ago
Aaand...the very same security expert wrote this last week: https://www.troyhunt.com/https-adoption-has-reached-the-tipping-point/ https://www.troyhunt.com/https-adoption-has-reached-the-tipp... TL;DR: HTTPS is now workable and affordable.

iancarroll 10y ago

It can indeed take some time to switch over, but why would you intentionally suppress a correct warning in the meantime? There is no good reason to mislead users here.

nommm-nommm 10y ago
Because, here in the real world, my paycheck depends on keeping my customers happy.
- jrockway 10y ago
  How happy will your customers be when they find out that you're just pulling the wool over their eyes instead of doing your job?
  - nommm-nommm 10y ago
    Did you read what I wrote? I do my job but there's only so much I can do if the owners of the servers who are serving my software tell me "before we can change this server's configuration we need approval from another office, it will be a few months until they can get back to us." (This is a hypothetical situation, for me, because I eventually got all my customers on HTTPS back around 2012 or so. There was some push back and it did take a long time and we had to be very persistent with some customers... But it was well worth it!) We are talking about the world of corporate IT and pointy haired bosses. I don't implement a social network, or email, I don't accept payments - I make intraweb sites that non-technical corporate paperpushers use to do their job. They are only interested in getting their work done; they are happy when they can get their work done without scary warnings they don't understand. If my software is giving them errors they are going to believe that it's my software that's the problem, and that doesn't look good for us. And we have to field support calls and explain ourselves. ...Or we could put a quick and dirty stopgate in to avoid something that makes us look bad and we can't do anything about.
    - foota 10y ago
      Man, that fourth paragraph is a work of art.

notatoad 10y ago

If you have 3rd party ads on your login page, you're doing something very, very wrong and you deserve to have all kinds of warnings flashing up.

Piskvorrr 10y ago

Aaand...the very same security expert wrote this last week: https://www.troyhunt.com/https-adoption-has-reached-the-tipping-point/ https://www.troyhunt.com/https-adoption-has-reached-the-tipp... TL;DR: HTTPS is now workable and affordable.