5 ms·

Terrible news. So much work for so many people to update so many old websites that will see absolutely zero benefit from serving content via ssl. I have an ol

Terrible news. So much work for so many people to update so many old websites that will see absolutely zero benefit from serving content via ssl. I have an old travel blogging site with a few hundred thousand posts in read only mode. Thinking about how much work it was to upgrade my other sites to https, chase down and work around every http request in the code base, purchase and install certs for silly things like cloudfront that you wouldn't think would suck away two days of your life. I'll probably just let the site die in July. It doesn't make money, so it's going to be a tough decision whether to dump thousands of dollars of otherwise billable time into upgrading it to accommodate google's silly whim.

Jonnax 9y ago
Why not just spin up a HAproxy container and so SSL termination on it? Let's Encrypt also do free certificates. There's no reason to pay for one.
- swvjeff 9y ago
  A lot of these older sites are probably on old servers that LE doesn't support, making it a little less than trivial.
  - EADGBE 9y ago
    This! When I was on a cheap shared and hosted solution the idea of LE was waaayyy above me. But, I moved over everything to AWS, for the same amount of money (OK, ~$0.60 more than what I was paying before - relatively nothing), and it became a piece of cake. That initial time commitment to the move, though, will never be recouped. I do however look at it as a career-expanding experience (fairly confident in how AWS works for projects/companies), so I got that going for it.
nickw444 9y ago
You could always consider a free service like Cloudflare which can sit in front of your site and serve the site via SSL to your customers. Yes, it's still unencrypted between CF and your site, however it would resolve the poor "insecure" UX. As a bonus, CF also has functionality that can re-write http uri's to https.
- jasonkester 9y ago
  The initial SSL connection isn't the hard part. If you do what you describe, the site will load minus all of its imagery and scripts, since those will be linked from a CDN as http://img.whatever.com/ http://img.whatever.com/ or whatever. Anything linked with a full URL, nomatter how deep in your codebase will surface at some point in the future and throw up a scary warning for your users. And you get to find homes for those 3rd party scripts hosted on http only domains. And in my case I'll probably get to rewrite a Google Maps integration because that will have taken the opportunity to deprecate something important. There really is a ton of work to pull this off. For every site on the internet more than a few years old. And again, for zero benefit whatsoever except to clear the scary warning that Google plans on introducing.
  - andrewaylett 9y ago
    Cloudflare has a new feature wherein they can use HTTPS Everywhere's translation list to rewrite http references to use https where possible. It's almost certainly not perfect, but for many people it should at least reduce the amount of effort required. It's explicitly intended for the deep-within-your-codebase/CMS case you mention.
  - bfred_it 9y ago
    Zero benefit, except the benefits described in the first paragraph of every HTTPS article. Anyone can inject content and scripts into your HTTP pages. Migrating isn't always easy, but it can always be done.
    - jasonkester 9y ago
      Anyone can inject content and scripts into your HTTP pages. Anyone? So, you for instance? I'll take you up on that. Here's a dangerously exposed HTTP page. Inject a malicious script into it for us: http://www.blogabond.com/CommentView.aspx?CommentID=177 http://www.blogabond.com/CommentView.aspx?CommentID=177 My understanding is that you'd need to be sitting between me and that webserver somewhere. If my ISP injects something into that page that changes it so that it no longer shows a dumb travel story from 15 years ago, I think the proper solution would be to change ISPs. The webpage itself is fine.
rimliu 9y ago
How did you come up with "thousands of dolars"? It should take half a day at most and zero additional cost. OTOH, site will continue to work even if you do not do anything, it will just be marked as not secure.
- jasonkester 9y ago
  If one strongly held that position, one could make a killing selling fixed-price contracts to audit and fix all SSL issues for any website running on any stack, regardless of age. $1,000, fixed price, guaranteed no Google Chrome warnings or your money back. Personally, that would not be a business I'd take on. Would you? If so, I (and a lot of other people) have some consulting work for you.
ancarda 9y ago
It makes me a bit sad to hear you are distressed from this news. Would you like some help setting up SSL? We could go over Certbot & Let's Encrypt, as well as provide some advice on things like HSTS, Mixed Content, etc... My email address is in my profile. I'm happy to help you however I can. I may not be able to make any code-level changes, but there may not be much work that needs to be done. Edit: I just saw your comment https://news.ycombinator.com/item?id=16338576 https://news.ycombinator.com/item?id=16338576 -- I understand there's potentially a lot of one-time work, but it could be done very gradually, and with this announcement, I think CDNs and widget makers would adopt SSL as well. Once the site does support SSL, you can make SSL-related upgrades (like disabling old ciphers or protocol versions) without much disruption.
- staticelf 9y ago
  Let's encrypt doesn't really work for all hosting solutions. So a lot of sites still have to purchase an expensive cert.
  - ancarda 9y ago
    Could you help me understand scenarios where Let's Encrypt and CloudFlare SSL won't suffice? They have, e.g. added wildcard support now, so that's another angle covered.
    - staticelf 9y ago
      I have sites on Azure and I could add CloudFlare SSL, but it's some work to make that happen and I will have to do it now for all my static sites that absolutely do not need TLS (no forms, no cookies, no javascript). Or else I have to pay for a cert, a cert is still like $10-$20 per year, per site so that is a lot of money if you have a lot of static sites compared to what the site costs to host (which is near-to-nothing). And for other shared hosting solutions I'm not really sure if it's possible to implement CloudFlare SSL (I have never implemented it so I'm not really sure what's required)? Why I don't want Cloudflare is because that is adding a third party just because google said I must or I will get punished for it.

Jonnax 9y ago

Why not just spin up a HAproxy container and so SSL termination on it? Let's Encrypt also do free certificates. There's no reason to pay for one.

swvjeff 9y ago
A lot of these older sites are probably on old servers that LE doesn't support, making it a little less than trivial.
- EADGBE 9y ago
  This! When I was on a cheap shared and hosted solution the idea of LE was waaayyy above me. But, I moved over everything to AWS, for the same amount of money (OK, ~$0.60 more than what I was paying before - relatively nothing), and it became a piece of cake. That initial time commitment to the move, though, will never be recouped. I do however look at it as a career-expanding experience (fairly confident in how AWS works for projects/companies), so I got that going for it.

nickw444 9y ago

You could always consider a free service like Cloudflare which can sit in front of your site and serve the site via SSL to your customers. Yes, it's still unencrypted between CF and your site, however it would resolve the poor "insecure" UX. As a bonus, CF also has functionality that can re-write http uri's to https.

jasonkester 9y ago
The initial SSL connection isn't the hard part. If you do what you describe, the site will load minus all of its imagery and scripts, since those will be linked from a CDN as http://img.whatever.com/ http://img.whatever.com/ or whatever. Anything linked with a full URL, nomatter how deep in your codebase will surface at some point in the future and throw up a scary warning for your users. And you get to find homes for those 3rd party scripts hosted on http only domains. And in my case I'll probably get to rewrite a Google Maps integration because that will have taken the opportunity to deprecate something important. There really is a ton of work to pull this off. For every site on the internet more than a few years old. And again, for zero benefit whatsoever except to clear the scary warning that Google plans on introducing.
- andrewaylett 9y ago
  Cloudflare has a new feature wherein they can use HTTPS Everywhere's translation list to rewrite http references to use https where possible. It's almost certainly not perfect, but for many people it should at least reduce the amount of effort required. It's explicitly intended for the deep-within-your-codebase/CMS case you mention.
- bfred_it 9y ago
  Zero benefit, except the benefits described in the first paragraph of every HTTPS article. Anyone can inject content and scripts into your HTTP pages. Migrating isn't always easy, but it can always be done.
  - jasonkester 9y ago
    Anyone can inject content and scripts into your HTTP pages. Anyone? So, you for instance? I'll take you up on that. Here's a dangerously exposed HTTP page. Inject a malicious script into it for us: http://www.blogabond.com/CommentView.aspx?CommentID=177 http://www.blogabond.com/CommentView.aspx?CommentID=177 My understanding is that you'd need to be sitting between me and that webserver somewhere. If my ISP injects something into that page that changes it so that it no longer shows a dumb travel story from 15 years ago, I think the proper solution would be to change ISPs. The webpage itself is fine.

rimliu 9y ago

How did you come up with "thousands of dolars"? It should take half a day at most and zero additional cost. OTOH, site will continue to work even if you do not do anything, it will just be marked as not secure.

jasonkester 9y ago
If one strongly held that position, one could make a killing selling fixed-price contracts to audit and fix all SSL issues for any website running on any stack, regardless of age. $1,000, fixed price, guaranteed no Google Chrome warnings or your money back. Personally, that would not be a business I'd take on. Would you? If so, I (and a lot of other people) have some consulting work for you.

ancarda 9y ago

It makes me a bit sad to hear you are distressed from this news. Would you like some help setting up SSL? We could go over Certbot & Let's Encrypt, as well as provide some advice on things like HSTS, Mixed Content, etc... My email address is in my profile. I'm happy to help you however I can. I may not be able to make any code-level changes, but there may not be much work that needs to be done. Edit: I just saw your comment https://news.ycombinator.com/item?id=16338576 https://news.ycombinator.com/item?id=16338576 -- I understand there's potentially a lot of one-time work, but it could be done very gradually, and with this announcement, I think CDNs and widget makers would adopt SSL as well. Once the site does support SSL, you can make SSL-related upgrades (like disabling old ciphers or protocol versions) without much disruption.

staticelf 9y ago
Let's encrypt doesn't really work for all hosting solutions. So a lot of sites still have to purchase an expensive cert.
- ancarda 9y ago
  Could you help me understand scenarios where Let's Encrypt and CloudFlare SSL won't suffice? They have, e.g. added wildcard support now, so that's another angle covered.
  - staticelf 9y ago
    I have sites on Azure and I could add CloudFlare SSL, but it's some work to make that happen and I will have to do it now for all my static sites that absolutely do not need TLS (no forms, no cookies, no javascript). Or else I have to pay for a cert, a cert is still like $10-$20 per year, per site so that is a lot of money if you have a lot of static sites compared to what the site costs to host (which is near-to-nothing). And for other shared hosting solutions I'm not really sure if it's possible to implement CloudFlare SSL (I have never implemented it so I'm not really sure what's required)? Why I don't want Cloudflare is because that is adding a third party just because google said I must or I will get punished for it.