6 ms·

Using something like Jekyll to create a static blog lets you put it on AWS S3. For all but the highest traffic sites the bandwidth cost is trivial and you total

Using something like Jekyll to create a static blog lets you put it on AWS S3. For all but the highest traffic sites the bandwidth cost is trivial and you totally remove all the issues with uptime and securing a server.

copperx 9y ago
Same applies to GitHub pages.
- francis-io 9y ago
  I originally tried github pages, but had issues with getting an SSL cert working with Cloudflare. I ended up using AWS Certificate Manager to add an auto updating cert to CloudFront.
  - copperx 9y ago
    Do you have a login? Or why would you need SSL on a static page?
    - gpmcadam 9y ago
      You can use HTTPS to secure many things, not only login details. Not least of all, the privacy of your users/readers. There's also integrity of your site, and many more future proof reasons. These days, there's no reason _not_ to use HTTPS, really. https://developers.google.com/web/fundamentals/security/encrypt-in-transit/why-https https://developers.google.com/web/fundamentals/security/encr...
      - DamonHD 9y ago
        Except for the difficulty of managing and keeping up to date with TLS (I'd have to upgrade my RPi's OS for example, to do it well), and the fact that it actually reduces performance for small simple sites with local readership, even with HTTP/2 for example. http://www.earth.org.uk/note-on-carbon-cost-of-CDN.html http://www.earth.org.uk/note-on-carbon-cost-of-CDN.html Edit: I note that I got downvoted, though no reply with reasons. I accept that it is currently widespread dogma/fashion that everything should be HTTPS, and there are some good reasons for it, but as someone that has worked in what might be called 'real' security in on-line finance for example, I fear that HTTPS-everywhere is as much security theatre or cargo cult as taking your belt off at the airport scanners...
        calcifer 9y ago
        The one thing that HTTPS provides on non-sensitive, or even non-interactive sites is privacy; it hides the request URI from prying eyes (ISP, government etc.) That's worth a lot to me.
        DamonHD 9y ago
        My sites are totally anodyne and not going to cause anyone any embarrassment; bank auditors tell me to relax a bit. The Chinese government was happy to grant me a site 'licence'. That's not worth a slow-to-load or even failing-to-load page.
        RodericDay 9y ago
        If all inoffensive sites ditched HTTPS, merely making an HTTPS request would justifiably arouse suspicion. It's important to make sure that inoffensive sites are behind the same barrier, to make that a poor signal.
        DamonHD 9y ago
        We have to hurt everyone to attempt to mask this weak signal?
        jjeaff 9y ago
        For most sites, the Google organic search penalty for not having https is reason enough.
        DamonHD 9y ago
        I have run side-by-side tests with the same site exposed both over http and https from a very performant CDN, and right now Google showed the http site on a simple search, not https, for example. I don't believe that any penalty is currently significant, nor likely to be soon. There's plenty of good historic sites which SEs don't want to exclude just because someone doesn't have the resources to rework them and keep them maintained with the latest TLS. (Note issues like embedded http resources that would all have to transitively converted to avoid warnings.)
    - mcguire 9y ago
      Because everything has to be SSL these days. Static content, open content, everything. Google, among others, say so.
    - francis-io 9y ago
      I believe Chrome, along with other browsers mark http sites as not secure, which is obviously undesirable.
      - copperx 9y ago
        Only when submitting forms.
- steventhedev 9y ago
  GHP means you're subject to github's downtime, which tends towards more frequent than s3 (outside us-east-1). Worse, you can't run HTTPS with GHP and a custom domain. You could use CloudFlare's flexible TLS, but it's unsecured from their system to your site, which has resulted in carrier level content being injected[0]. [0]: https://news.ycombinator.com/item?id=12091900 https://news.ycombinator.com/item?id=12091900
  - nickjj 9y ago
    That's what got me to host my Jekyll sites on my own too (lack of proper end-to-end SSL on a custom domain). Also, if you're not using S3 / CloudFront you can use Let's Encrypt to issue free SSL certificates on any cloud hosting provider. It's an awesome set up once you know how to get everything up and running. I even recently released a course[0] that explains how to do it step by step (setting up a custom domain, hosting multiple sites on 1 DigitalOcean server, A+ SSL ratings for both nginx and Apache, etc.). It takes less than 1 minute to deploy and protect any custom site (or web app), since the course comes with ready to go configs and scripts too. [0]: https://httpswithletsencrypt.com/ https://httpswithletsencrypt.com/
  - ship_it 9y ago
    You can run GHP over HTTPS through services like e.g. Cloudflare.
StreamBright 9y ago
This is exactly how we publish our content. We are currently experimenting with Gatsby as well. We will see how it turns out. https://github.com/gatsbyjs/gatsby https://github.com/gatsbyjs/gatsby

copperx 9y ago

Same applies to GitHub pages.

francis-io 9y ago
I originally tried github pages, but had issues with getting an SSL cert working with Cloudflare. I ended up using AWS Certificate Manager to add an auto updating cert to CloudFront.
- copperx 9y ago
  Do you have a login? Or why would you need SSL on a static page?
  - gpmcadam 9y ago
    You can use HTTPS to secure many things, not only login details. Not least of all, the privacy of your users/readers. There's also integrity of your site, and many more future proof reasons. These days, there's no reason _not_ to use HTTPS, really. https://developers.google.com/web/fundamentals/security/encrypt-in-transit/why-https https://developers.google.com/web/fundamentals/security/encr...
    - DamonHD 9y ago
      Except for the difficulty of managing and keeping up to date with TLS (I'd have to upgrade my RPi's OS for example, to do it well), and the fact that it actually reduces performance for small simple sites with local readership, even with HTTP/2 for example. http://www.earth.org.uk/note-on-carbon-cost-of-CDN.html http://www.earth.org.uk/note-on-carbon-cost-of-CDN.html Edit: I note that I got downvoted, though no reply with reasons. I accept that it is currently widespread dogma/fashion that everything should be HTTPS, and there are some good reasons for it, but as someone that has worked in what might be called 'real' security in on-line finance for example, I fear that HTTPS-everywhere is as much security theatre or cargo cult as taking your belt off at the airport scanners...
      - calcifer 9y ago
        The one thing that HTTPS provides on non-sensitive, or even non-interactive sites is privacy; it hides the request URI from prying eyes (ISP, government etc.) That's worth a lot to me.
        DamonHD 9y ago
        My sites are totally anodyne and not going to cause anyone any embarrassment; bank auditors tell me to relax a bit. The Chinese government was happy to grant me a site 'licence'. That's not worth a slow-to-load or even failing-to-load page.
        RodericDay 9y ago
        If all inoffensive sites ditched HTTPS, merely making an HTTPS request would justifiably arouse suspicion. It's important to make sure that inoffensive sites are behind the same barrier, to make that a poor signal.
        DamonHD 9y ago
        We have to hurt everyone to attempt to mask this weak signal?
      - jjeaff 9y ago
        For most sites, the Google organic search penalty for not having https is reason enough.
        DamonHD 9y ago
        I have run side-by-side tests with the same site exposed both over http and https from a very performant CDN, and right now Google showed the http site on a simple search, not https, for example. I don't believe that any penalty is currently significant, nor likely to be soon. There's plenty of good historic sites which SEs don't want to exclude just because someone doesn't have the resources to rework them and keep them maintained with the latest TLS. (Note issues like embedded http resources that would all have to transitively converted to avoid warnings.)
  - mcguire 9y ago
    Because everything has to be SSL these days. Static content, open content, everything. Google, among others, say so.
  - francis-io 9y ago
    I believe Chrome, along with other browsers mark http sites as not secure, which is obviously undesirable.
    - copperx 9y ago
      Only when submitting forms.
steventhedev 9y ago
GHP means you're subject to github's downtime, which tends towards more frequent than s3 (outside us-east-1). Worse, you can't run HTTPS with GHP and a custom domain. You could use CloudFlare's flexible TLS, but it's unsecured from their system to your site, which has resulted in carrier level content being injected[0]. [0]: https://news.ycombinator.com/item?id=12091900 https://news.ycombinator.com/item?id=12091900
- nickjj 9y ago
  That's what got me to host my Jekyll sites on my own too (lack of proper end-to-end SSL on a custom domain). Also, if you're not using S3 / CloudFront you can use Let's Encrypt to issue free SSL certificates on any cloud hosting provider. It's an awesome set up once you know how to get everything up and running. I even recently released a course[0] that explains how to do it step by step (setting up a custom domain, hosting multiple sites on 1 DigitalOcean server, A+ SSL ratings for both nginx and Apache, etc.). It takes less than 1 minute to deploy and protect any custom site (or web app), since the course comes with ready to go configs and scripts too. [0]: https://httpswithletsencrypt.com/ https://httpswithletsencrypt.com/
- ship_it 9y ago
  You can run GHP over HTTPS through services like e.g. Cloudflare.

StreamBright 9y ago

This is exactly how we publish our content. We are currently experimenting with Gatsby as well. We will see how it turns out. https://github.com/gatsbyjs/gatsby https://github.com/gatsbyjs/gatsby