4 ms·

Github pages has https, see: https://github.com/blog/2186-https-for-github-pages https://github.com/blog/2186-https-for-github-pages There are legacy setups li

by jopsen 9y ago

Github pages has https, see: https://github.com/blog/2186-https-for-github-pages https://github.com/blog/2186-https-for-github-pages There are legacy setups like S3 with custom domains, probably github pages with custom domain. But in both cases there is no reason not to be using cloudfront or cloudflare.

nothrabannosir 9y ago
Tumblr with custom domain doesn't allow cloud flare. No way to enable https. I understand that's not technically "your problem", but since you mentioned it, just thought I'd let you know :) It's unfortunate, because tumblr really is a great blog hosting software and service, if you don't use the social aspects of it.
- jopsen 9y ago
  You could plausibly use cloudfront, I don't know what tumblr's policies are. But these aren't technical limitations! I don't know why Tumblr retricts you from using cloudflare, presumably because they want to control your content. My two cents, don't use a free hosting service. S3+cloudfront is dirt cheap and will do the trick.
anilgulecha 9y ago
I am hopeful github/tumblr and other static hosting services will add in letsenrypt setup once browsers start showing these as "not secure". There will be a dip in user engagement otherwise, as the main article points out.
kiliankoe 9y ago
I'm using gh pages for my site, on a custom domain. I really don't want to use cloudflare or similar services for personal reasons. Afaict there's not really any other option though :/ I'd love it if GitHub were able to provide me with a LetsEncrypt cert. I've written to them about this before, but they said there was nothing planned yet.
- lucideer 9y ago
  FWIW, I use Gitlab Pages for the same, and they allow you to provide your own cert (be it LetsEncrypt or otherwise). This has become a good bit easier to administer since LE added support for DNS verification, bit you're right, it would be cool to see these providers adding in built LE automated certs.
  - kiliankoe 9y ago
    That's pretty cool and interesting, thanks for the tip! :)
  - james-skemp 9y ago
    I've been doing the same. Unfortunately, it seems that if I want to update my cert I have to remove the domain and then add it back in. Are you aware of a workaround? Otherwise, I agree with the ease now that LE supports DNS verification. I just wish we could edit existing domains in Gitlab.
    - bikebilly 9y ago
      It's a good point, I just opened an issue about that, feel free to add more context on it: https://gitlab.com/gitlab-org/gitlab-ce/issues/35022 https://gitlab.com/gitlab-org/gitlab-ce/issues/35022
  - bikebilly 9y ago
    Thanks for the feedback, there is actually an issue regarding this topic: https://gitlab.com/gitlab-org/gitlab-ce/issues/28996 https://gitlab.com/gitlab-org/gitlab-ce/issues/28996. Feel free to contribute to it!
archagon 9y ago
That is only a facade of security, since you have to assume trustworthy behavior on the part of Cloudfront and Cloudflare. I'd rather deal with the very occasional “why not secure?” e-mail rather than pretend my site is actually secure. (I only serve static pages, not forms.)
- jopsen 9y ago
  Yes and no, if the github pages is served from S3 or other resource inside AWS network, then cloudfront would be safe. And regardless of that it offers privacy for your users. Beyond privacy it also vastly improve security too, since users are most likely to have malware and ads injected by an infected wifi router. It also increases complexity of an attacker that has control of the local machine, since they'll now have to install a custom root certificate. Nothing is perfectly safe, all we can do is raise the bar.

by jopsen 9y ago

nothrabannosir 9y ago

Tumblr with custom domain doesn't allow cloud flare. No way to enable https. I understand that's not technically "your problem", but since you mentioned it, just thought I'd let you know :) It's unfortunate, because tumblr really is a great blog hosting software and service, if you don't use the social aspects of it.

jopsen 9y ago
You could plausibly use cloudfront, I don't know what tumblr's policies are. But these aren't technical limitations! I don't know why Tumblr retricts you from using cloudflare, presumably because they want to control your content. My two cents, don't use a free hosting service. S3+cloudfront is dirt cheap and will do the trick.

anilgulecha 9y ago

I am hopeful github/tumblr and other static hosting services will add in letsenrypt setup once browsers start showing these as "not secure". There will be a dip in user engagement otherwise, as the main article points out.

kiliankoe 9y ago

I'm using gh pages for my site, on a custom domain. I really don't want to use cloudflare or similar services for personal reasons. Afaict there's not really any other option though :/ I'd love it if GitHub were able to provide me with a LetsEncrypt cert. I've written to them about this before, but they said there was nothing planned yet.

lucideer 9y ago
FWIW, I use Gitlab Pages for the same, and they allow you to provide your own cert (be it LetsEncrypt or otherwise). This has become a good bit easier to administer since LE added support for DNS verification, bit you're right, it would be cool to see these providers adding in built LE automated certs.
- kiliankoe 9y ago
  That's pretty cool and interesting, thanks for the tip! :)
- james-skemp 9y ago
  I've been doing the same. Unfortunately, it seems that if I want to update my cert I have to remove the domain and then add it back in. Are you aware of a workaround? Otherwise, I agree with the ease now that LE supports DNS verification. I just wish we could edit existing domains in Gitlab.
  - bikebilly 9y ago
    It's a good point, I just opened an issue about that, feel free to add more context on it: https://gitlab.com/gitlab-org/gitlab-ce/issues/35022 https://gitlab.com/gitlab-org/gitlab-ce/issues/35022
- bikebilly 9y ago
  Thanks for the feedback, there is actually an issue regarding this topic: https://gitlab.com/gitlab-org/gitlab-ce/issues/28996 https://gitlab.com/gitlab-org/gitlab-ce/issues/28996. Feel free to contribute to it!

archagon 9y ago

That is only a facade of security, since you have to assume trustworthy behavior on the part of Cloudfront and Cloudflare. I'd rather deal with the very occasional “why not secure?” e-mail rather than pretend my site is actually secure. (I only serve static pages, not forms.)

jopsen 9y ago
Yes and no, if the github pages is served from S3 or other resource inside AWS network, then cloudfront would be safe. And regardless of that it offers privacy for your users. Beyond privacy it also vastly improve security too, since users are most likely to have malware and ads injected by an infected wifi router. It also increases complexity of an attacker that has control of the local machine, since they'll now have to install a custom root certificate. Nothing is perfectly safe, all we can do is raise the bar.