6 ms·

What this is, is another accidental slide down the slope towards centralisation of the web. Yes, it's easy for a techie to add a letsencrypt cert, but browsing

What this is, is another accidental slide down the slope towards centralisation of the web. Yes, it's easy for a techie to add a letsencrypt cert, but browsing with https-by-default I still hit a lot of sites that lack https - mostly the sort that run with practically zero maintenance for a non-technical business or community. Browsers are going to show scary warnings for these (indistinguishable to the average user from any other warning), and then stop loading them altogether, and the sites will die only to be reborn (if at all) on facebook.

lucideer 10y ago
The problem there though is not in allowing non-techies to easily install certs, but rather in incentivising cheap hosting companies to provide it by default, with zero configuration. Many companies are already doing this, but they're still in a minority. Making HTTPS "the norm" is hopefully the road to making this an expected feature from those hosts.
CharlesW 10y ago
> What this is, is another accidental slide down the slope towards centralisation of the web. Sorry, can you explain? (Not playing "gotcha", I really don't understand.)
- euyyn 10y ago
  He means "a small number of websites by big players" vs "a big number of websites by modest people".
brennen 10y ago
I'm broadly in favor of HTTPS-everywhere, but this does seem likely to happen in a number of cases. Then again, I'm not sure it will be all that impactful in a situation where everybody's already leaving the open web for Facebook anyway...
Filligree 10y ago
That's still an improvement. Security is important, and I would prefer to not see sites which are insecure by default, even if it means losing some small minority of sites. Going forwards I expect we'll see more webservers with Let's Encrypt-by-default, so it's a limited-time problem; it shouldn't affect many people after the initial shakeout. On NixOS, enabling LE is no harder than putting "services.nginx.virtualHosts.<hostname>.enableACME = true" in my configuration file.
hathawsh 10y ago
I don't think so. Thanks to Let's Encrypt, I expect that configuring HTTPS will soon be about as simple as "apt-get install apache". Hosting providers will make it a checkbox (that will soon be on by default.) We're making it easier for individual site owners to provide privacy for their visitors, leading to more decentralization.

lucideer 10y ago

The problem there though is not in allowing non-techies to easily install certs, but rather in incentivising cheap hosting companies to provide it by default, with zero configuration. Many companies are already doing this, but they're still in a minority. Making HTTPS "the norm" is hopefully the road to making this an expected feature from those hosts.

CharlesW 10y ago

> What this is, is another accidental slide down the slope towards centralisation of the web. Sorry, can you explain? (Not playing "gotcha", I really don't understand.)

euyyn 10y ago
He means "a small number of websites by big players" vs "a big number of websites by modest people".

brennen 10y ago

I'm broadly in favor of HTTPS-everywhere, but this does seem likely to happen in a number of cases. Then again, I'm not sure it will be all that impactful in a situation where everybody's already leaving the open web for Facebook anyway...

Filligree 10y ago

That's still an improvement. Security is important, and I would prefer to not see sites which are insecure by default, even if it means losing some small minority of sites. Going forwards I expect we'll see more webservers with Let's Encrypt-by-default, so it's a limited-time problem; it shouldn't affect many people after the initial shakeout. On NixOS, enabling LE is no harder than putting "services.nginx.virtualHosts.<hostname>.enableACME = true" in my configuration file.

hathawsh 10y ago

I don't think so. Thanks to Let's Encrypt, I expect that configuring HTTPS will soon be about as simple as "apt-get install apache". Hosting providers will make it a checkbox (that will soon be on by default.) We're making it easier for individual site owners to provide privacy for their visitors, leading to more decentralization.