5 ms·

You won't have confidence that your visitors see the content you serve as you intend because it can be modified in transit. Your visitors will be broadcasting a

by jaas 9y ago

You won't have confidence that your visitors see the content you serve as you intend because it can be modified in transit. Your visitors will be broadcasting at least the exact address of the pages they read on your blog, and are vulnerable to anything that gets injected into your traffic in transit (e.g. malicious script). Every website should use HTTPS. It's the right thing to do. It's not hard to do these days.

reustle 9y ago
> Every website should use HTTPS. It's the right thing to do. It's not hard to do these days. Unless you use simple tools like GitHub pages. I have a bunch of tiny JS heavy static projects on Pages that I can't easily add HTTPS to.
- ehnto 9y ago
  That doesn't really change the parent comment. Just because it's harder sometimes doesn't mean it shouldn't be done. A current project of mine has some usability issues because it accepts external API requests but I won't allow non HTTPS. It would give me great pleasure to accept all possible APIs, but it's just not right to open users to that risk.
- clfougner 9y ago
  Route your page through Cloudflare (or presumably any other CDN) and you can get HTTPS set up on your Github Pages hosted static site quite trivially.
- clfougner 9y ago
  Route your page through Cloudflare (or presumably any other CDN) and you can get HTTPS set up on your Github Pages hosted static site quite trivially.
- MBlume 9y ago
  I'm probably misreading you somehow -- if your site is hosted by Github isn't it already HTTPS?
  - Santosh83 9y ago
    It is, unless you want to use a custom domain with it. With the latter case your only choice to retain some semblance of HTTPS is to put it behind a CDN, but that still breaks end-to-end HTTPS. The problem really has to solved at Github's end, by allowing users to upload their own certs.
    - teraflop 9y ago
      Wait, how is serving your content through Github's servers using your own certificate any more secure than letting GitHub or CloudFlare provide the cert?
      - IanCal 9y ago
        It's arguably more secure than letting cloudflare do it (adding a new party doesn't make the chain more secure) but it doesn't have to be more secure than using githubs cert. It's just that you can't use githubs cert with your own custom domain.
    - agrajag 9y ago
      You can set your own cert on the CDN though, and have the CDN request origin objects over https from the github domain. Since the CDN is the endpoint for your domain, you'll still be presenting a custom domain to your users.
      - icebraining 9y ago
        Which CDNs support that kind of domain translation?
- busterarm 9y ago
  For $5 month you could through up what is likely to be an adequate nginx proxy on Lightsail or similar and serve letsencrypt certs for all of your projects/domains. It's not really that hard. Set up auto-renew, make sure the box is up to date and properly firewalled. You won't really have to think much about it.
- jopsen 9y ago
  Github pages has https, see: https://github.com/blog/2186-https-for-github-pages https://github.com/blog/2186-https-for-github-pages There are legacy setups like S3 with custom domains, probably github pages with custom domain. But in both cases there is no reason not to be using cloudfront or cloudflare.
  - nothrabannosir 9y ago
    Tumblr with custom domain doesn't allow cloud flare. No way to enable https. I understand that's not technically "your problem", but since you mentioned it, just thought I'd let you know :) It's unfortunate, because tumblr really is a great blog hosting software and service, if you don't use the social aspects of it.
    - jopsen 9y ago
      You could plausibly use cloudfront, I don't know what tumblr's policies are. But these aren't technical limitations! I don't know why Tumblr retricts you from using cloudflare, presumably because they want to control your content. My two cents, don't use a free hosting service. S3+cloudfront is dirt cheap and will do the trick.
  - anilgulecha 9y ago
    I am hopeful github/tumblr and other static hosting services will add in letsenrypt setup once browsers start showing these as "not secure". There will be a dip in user engagement otherwise, as the main article points out.
  - kiliankoe 9y ago
    I'm using gh pages for my site, on a custom domain. I really don't want to use cloudflare or similar services for personal reasons. Afaict there's not really any other option though :/ I'd love it if GitHub were able to provide me with a LetsEncrypt cert. I've written to them about this before, but they said there was nothing planned yet.
    - lucideer 9y ago
- rzzzt 9y ago
  Those should work as well: https://help.github.com/articles/securing-your-github-pages-site-with-https/ https://help.github.com/articles/securing-your-github-pages-...
djsumdog 9y ago
Exactly. I remember viewing my website over a mobile connection in the UK and getting an ISP banner at the top of the page! Injected right into my HTML!

by jaas 9y ago

reustle 9y ago

> Every website should use HTTPS. It's the right thing to do. It's not hard to do these days. Unless you use simple tools like GitHub pages. I have a bunch of tiny JS heavy static projects on Pages that I can't easily add HTTPS to.

ehnto 9y ago
That doesn't really change the parent comment. Just because it's harder sometimes doesn't mean it shouldn't be done. A current project of mine has some usability issues because it accepts external API requests but I won't allow non HTTPS. It would give me great pleasure to accept all possible APIs, but it's just not right to open users to that risk.
clfougner 9y ago
Route your page through Cloudflare (or presumably any other CDN) and you can get HTTPS set up on your Github Pages hosted static site quite trivially.
clfougner 9y ago
Route your page through Cloudflare (or presumably any other CDN) and you can get HTTPS set up on your Github Pages hosted static site quite trivially.
MBlume 9y ago
I'm probably misreading you somehow -- if your site is hosted by Github isn't it already HTTPS?
- Santosh83 9y ago
  It is, unless you want to use a custom domain with it. With the latter case your only choice to retain some semblance of HTTPS is to put it behind a CDN, but that still breaks end-to-end HTTPS. The problem really has to solved at Github's end, by allowing users to upload their own certs.
  - teraflop 9y ago
    Wait, how is serving your content through Github's servers using your own certificate any more secure than letting GitHub or CloudFlare provide the cert?
    - IanCal 9y ago
      It's arguably more secure than letting cloudflare do it (adding a new party doesn't make the chain more secure) but it doesn't have to be more secure than using githubs cert. It's just that you can't use githubs cert with your own custom domain.
  - agrajag 9y ago
    You can set your own cert on the CDN though, and have the CDN request origin objects over https from the github domain. Since the CDN is the endpoint for your domain, you'll still be presenting a custom domain to your users.
    - icebraining 9y ago
      Which CDNs support that kind of domain translation?
busterarm 9y ago
For $5 month you could through up what is likely to be an adequate nginx proxy on Lightsail or similar and serve letsencrypt certs for all of your projects/domains. It's not really that hard. Set up auto-renew, make sure the box is up to date and properly firewalled. You won't really have to think much about it.
jopsen 9y ago
Github pages has https, see: https://github.com/blog/2186-https-for-github-pages https://github.com/blog/2186-https-for-github-pages There are legacy setups like S3 with custom domains, probably github pages with custom domain. But in both cases there is no reason not to be using cloudfront or cloudflare.
- nothrabannosir 9y ago
  Tumblr with custom domain doesn't allow cloud flare. No way to enable https. I understand that's not technically "your problem", but since you mentioned it, just thought I'd let you know :) It's unfortunate, because tumblr really is a great blog hosting software and service, if you don't use the social aspects of it.
  - jopsen 9y ago
    You could plausibly use cloudfront, I don't know what tumblr's policies are. But these aren't technical limitations! I don't know why Tumblr retricts you from using cloudflare, presumably because they want to control your content. My two cents, don't use a free hosting service. S3+cloudfront is dirt cheap and will do the trick.
- anilgulecha 9y ago
  I am hopeful github/tumblr and other static hosting services will add in letsenrypt setup once browsers start showing these as "not secure". There will be a dip in user engagement otherwise, as the main article points out.
- kiliankoe 9y ago
  I'm using gh pages for my site, on a custom domain. I really don't want to use cloudflare or similar services for personal reasons. Afaict there's not really any other option though :/ I'd love it if GitHub were able to provide me with a LetsEncrypt cert. I've written to them about this before, but they said there was nothing planned yet.
  - lucideer 9y ago
rzzzt 9y ago
Those should work as well: https://help.github.com/articles/securing-your-github-pages-site-with-https/ https://help.github.com/articles/securing-your-github-pages-...

djsumdog 9y ago

Exactly. I remember viewing my website over a mobile connection in the UK and getting an ISP banner at the top of the page! Injected right into my HTML!