7 ms·
Required maintenance for a simple, static http site: none. Required maintenance for a simple, static https site: configure let’s encrypt and keep the cron job
by m_eiman 9y ago
Required maintenance for a simple, static http site: none.
Required maintenance for a simple, static https site: configure let’s encrypt and keep the cron job running.
Big difference? Not for some, but it sure is something that offers very little value for very many site owners. Even the top 100 sites are only at 80% https by default, and they do it for a living!
- AstralStorm 9y agoA server is not a site.
- JankySolutions 9y agoRequired maintenance for a simple, static https site: Install certbot, press enter a few times, forget about it. "keep a cron job running" sounds like it you're running the cron job by hand. >Even the top 100 sites are only at 80% https by default, and they do it for a living! That's entirely separate from your "simple, static site" example and yes, rolling any sort of large change out to a big site is a big deal, and if there isn't business motivation to do it it likely wont happen. Google is providing everyone a business motivation by threatening to point out to users that insecure sites are insecure.
- dfabulich 9y ago> "keep a cron job running" sounds like it you're running the cron job by hand. Cron jobs fail sometimes. You have to monitor them, investigate why they failed, fix the issue, and rerun them. Web servers fail, too, but with shared hosting, it's mostly not your problem. And shared hosting providers are still trying to charge an arm and a leg to manage SSL certs for you (because it's a nice high-margin business for them).
- tokenizerrr 9y ago1. You don't have to monitor your cronjobs. They'll send you an email when they produce output. 2. Let's Encrypt will send you an email if your certificate is going to expire in a month. This will normally never happen, since it is continuously renewed.
- TeMPOraL 9y ago> 1. You don't have to monitor your cronjobs. They'll send you an email when they produce output. You now have to configure e-mail on your small server to actually work (and not get immediately eaten by spam filters of your personal e-mail provider).
- jacobparker 9y agoThe email doesn't come from your server, it comes from Lets Encrypt. https://letsencrypt.org/docs/expiration-emails/ https://letsencrypt.org/docs/expiration-emails/
- TeMPOraL 9y agoAh, ok. I read "they" as "cron jobs".
- kelnos 9y agoWhy are you arguing against basic server administration if you're, y'know, a server admin?
- skrebbel 9y agoThere's plenty shared hosting provider that just have a free let's encrypt powered "https" toggle. Eg tools like cPanel have built in support for it now.
- ams6110 9y agoRight -- so the security of a "Let's Encrypt" certificate is very minimal. It prevents MITM shenanigans and that's about it.
- CydeWeys 9y agoAnd spying/surveillance/analytics/snooping. That's not minimal. And you get all those benefits from checking a checkbox in cPanel and the rest is handled automatically? Who could be against that?!
- JankySolutions 9y agoWhat other shenanigans are you concerned about? MITM and sniffing are basically what https/tls are designed to prevent.
- anchpop 9y agoThere's shenanigans like "grnail.com" pretending to be "gmail.com" which bigger and much more expensive certs prevent against. But the benefit of https that doesn't prevent against this is still very high
- detaro 9y agoIf you truly have a simple, static site, the required maintenance should most of the time be exactly the same: pay your hosting provider, nowadays they should be providing HTTPS.
- josteink 9y agoAnd if you host your own?
- detaro 9y agoThen yes, you pay the maintenance overhead for doing so. I do it too, since I want to mess with these things and run things I can't easily run on shared hosting and if I'm taking care of a server and HTTPS for it anyways adding another site isn't much effort, but for just a static site it's overkill most of the time and kind of "your own fault" if you make it harder on you than it is. That said, using certbot made it so painless I just started doing it at some point for everything I run and I only once had a small hiccup configuring a renewal-hook.
- ridiculous_fish 9y agoYet setting up HTTPS on s3 is still non-trivial, and an additional ongoing expense.
- deleted 9y ago[deleted]
- CydeWeys 9y agoAdding fire sprinklers to new construction is an additional expense, yet it's still required as a safety measure. This argument from cost doesn't seem like a compelling one to me. It's not money being thrown away, it's delivering real added security.
- tialaramex 9y agoThe English government (well, they're the British government, but they don't get to set building rules for the bits of Britain that aren't England) didn't think fire sprinklers were necessary in big tower blocks and schools. Too many regulations you know, it hurts the economy. Then not just one but two huge tower blocks in London burned down. So how about that, suddenly maybe tower blocks _did_ need sprinklers after all. Shame about all the dead people.
- Klathmon 9y ago>it sure is something that offers very little value for very many site owners. Because it's not meant to offer value for a site owner, it's meant to offer value to the user. When I type a password on your website, I'm the one that has the most to lose there. When I type my credit card or other personal information into a site, I'm the one that will need to spend time and money getting control of my information if it was stolen. When I am browsing the web and ads are being injected into the HTTP request, or my ISP is dragnet datamining, or a compromised router is injecting malware into every page, I'm the one that loses, not you. The argument that an insecure website is easier to maintain than a secure website is like saying "a car without airbags is easier to work on". The extreme vast majority don't care about how easy it is to maintain the site, they care about their privacy and security. And your counterpoint is needing to download and run some open-source software once a month (or automate the process and never touch it again). A few years ago that would have been a much larger list, but developers were listening to the complaints, and realized that the only way to a fully secure web was to make this process easier, so they did! It's easier than ever to enable HTTPS on every website, and in the vast majority of cases it's a net improvement for users.
- drdeca 9y agoWell, ok, but what about the websites that don't have ads or logins or other personal information?
- UncleMeat 9y agoIntegrity. HTTPS prevents scripts from being inserted into a page, which is still a problem even for static content that includes no forms.
- Klathmon 9y agoI think you misunderstand. An ad-free website served over HTTP can (and does) have ads injected into it by someone along the way. And not just ads, but malware as well. And privacy of information going from your browser to the internet is only half of the equation. What about privacy about what you are viewing? I don't want every single router between my computer and the server knowing the full contents of the pages I'm choosing to view, or building advertising profiles on my habits, or even knowing what device type, browser, OS, and more I'm using.
- _asummers 9y agoIf you have a simple static site, you can have Google's Firebase hosting thing do the HTTPS for you, without management, for free. Netlify[1] is another one I see recommended around here decently often which has the same service. [0] https://firebase.google.com/docs/hosting/ https://firebase.google.com/docs/hosting/ [1] https://www.netlify.com/docs/ssl/ https://www.netlify.com/docs/ssl/
- josteink 9y agoSo the solution to Google having too much power, is using and depending on Google for more things? Really?
- ukoki 9y agoor use cloudflare https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/
- kalleboo 9y agoAmazon also issue/autorenew free certs for AWS customers (so you can set–and-forget an HTTPS site on CloudFront) https://aws.amazon.com/certificate-manager/ https://aws.amazon.com/certificate-manager/
- ef4 9y agoIf you are running your own webserver even a static simple site has required maintenance. You need to keep the server and OS patched. So adding a letsencrypt cron job is not any worse than configuring something like Debian's unattended-upgrades. But I don't think most site owners should be doing even that much. They should just pay for static hosting, which is cheap and ensures somebody else will keep the server, os, and cert all safe.
- Retric 9y agoYou don't actually need to keep web servers serving static content patched. Simply close all other ports, run a minimal web server, and it's a tiny attack surface. Some of these have made it 20+ years with zero maintenance.
- 1wheel 9y agoI added https to my static site last year and it has been a huge waste of time. ubuntu + nginx worked fine for years without much maintenance, but I've spent so much time reconfiguring things when something breaks (and it is really clear when something a renewal fails... thanks HSTS). Things that used to be simple, like putting setting up a subdomain (need to get a new cert and reconfigure the cron job now) or pointing at a websocket (can't point directly at node since that's not secure, needs to pass through nginx now) consistently take hours to do now. I mostly do data analysis and front end work; mucking around in nginx config files is something I would have been happy never experiencing. It sucks that it's harder to host your own website now. https://pastebin.com/N2sbvULA https://pastebin.com/N2sbvULA
- kelnos 9y agoI have nginx fronting around 15 different (very low traffic) websites (most static, a few python), all of which have Let's Encrypt certs. The required additions to the nginx conf were minimal and easy. Adding a new subdomain is trivial. Fetching the initial certificate from Let's Encrypt is a short, easy command line. And "sudo certbot renew; sudo /etc/init.d/nginx reload" in a cron job keeps the certs up to date (the "renew" command is smart enough to go through the list of certs you have and renew them all). It's really hard to imagine it getting much easier.
- rabidrat 9y agoHow do I run that cronjob on a simple, static site? I very deliberately create static sites and store them on e.g. s3 to be served without any effort on my part. I do not want to have to run a 24/7 server just for a monthly cronjob!
- lopmotr 9y agoA small static site I operate recently got HTTPS with zero action on my part. My hosting provider just did it of their own initiative and notified me that it was now done. I suppose they're going to do whatever ongoing maintenance it requires.
- api_or_ipa 9y agoIt's absolutely trivial to use CloudFlare to give your site https.
- fulafel 9y agoYou should check on your "no maintenance needed" servers once in a while, you might find surprising applications running on them now! It's better to use a content-hosting service, and as a bonus you don't have to keep cron jobs running in order to get TLS.
- ldng 9y agoDoing something over doing nothing is always a big difference. And a potential for failure and all sort of issues.