6 ms·
I originally tried github pages, but had issues with getting an SSL cert working with Cloudflare. I ended up using AWS Certificate Manager to add an auto updati
by francis-io 9y ago
I originally tried github pages, but had issues with getting an SSL cert working with Cloudflare. I ended up using AWS Certificate Manager to add an auto updating cert to CloudFront.
- copperx 9y agoDo you have a login? Or why would you need SSL on a static page?
- gpmcadam 9y agoYou can use HTTPS to secure many things, not only login details. Not least of all, the privacy of your users/readers. There's also integrity of your site, and many more future proof reasons. These days, there's no reason _not_ to use HTTPS, really. https://developers.google.com/web/fundamentals/security/encrypt-in-transit/why-https https://developers.google.com/web/fundamentals/security/encr...
- DamonHD 9y agoExcept for the difficulty of managing and keeping up to date with TLS (I'd have to upgrade my RPi's OS for example, to do it well), and the fact that it actually reduces performance for small simple sites with local readership, even with HTTP/2 for example. http://www.earth.org.uk/note-on-carbon-cost-of-CDN.html http://www.earth.org.uk/note-on-carbon-cost-of-CDN.html Edit: I note that I got downvoted, though no reply with reasons. I accept that it is currently widespread dogma/fashion that everything should be HTTPS, and there are some good reasons for it, but as someone that has worked in what might be called 'real' security in on-line finance for example, I fear that HTTPS-everywhere is as much security theatre or cargo cult as taking your belt off at the airport scanners...
- calcifer 9y agoThe one thing that HTTPS provides on non-sensitive, or even non-interactive sites is privacy; it hides the request URI from prying eyes (ISP, government etc.) That's worth a lot to me.
- DamonHD 9y agoMy sites are totally anodyne and not going to cause anyone any embarrassment; bank auditors tell me to relax a bit. The Chinese government was happy to grant me a site 'licence'. That's not worth a slow-to-load or even failing-to-load page.
- RodericDay 9y agoIf all inoffensive sites ditched HTTPS, merely making an HTTPS request would justifiably arouse suspicion. It's important to make sure that inoffensive sites are behind the same barrier, to make that a poor signal.
- DamonHD 9y agoWe have to hurt everyone to attempt to mask this weak signal?
- jjeaff 9y agoFor most sites, the Google organic search penalty for not having https is reason enough.
- DamonHD 9y agoI have run side-by-side tests with the same site exposed both over http and https from a very performant CDN, and right now Google showed the http site on a simple search, not https, for example. I don't believe that any penalty is currently significant, nor likely to be soon. There's plenty of good historic sites which SEs don't want to exclude just because someone doesn't have the resources to rework them and keep them maintained with the latest TLS. (Note issues like embedded http resources that would all have to transitively converted to avoid warnings.)
- jjeaff 9y agoI don't think I would trust your data point of 1. Google has officially announced that it will factor in and many other sites with many data points have confirmed the effect. https://webmasters.googleblog.com/2014/08/https-as-ranking-signal.html?m=1 https://webmasters.googleblog.com/2014/08/https-as-ranking-s...
- mcguire 9y agoBecause everything has to be SSL these days. Static content, open content, everything. Google, among others, say so.
- francis-io 9y agoI believe Chrome, along with other browsers mark http sites as not secure, which is obviously undesirable.
- copperx 9y agoOnly when submitting forms.