5 ms·

It makes me a bit sad to hear you are distressed from this news. Would you like some help setting up SSL? We could go over Certbot & Let's Encrypt, as well as p

It makes me a bit sad to hear you are distressed from this news. Would you like some help setting up SSL? We could go over Certbot & Let's Encrypt, as well as provide some advice on things like HSTS, Mixed Content, etc... My email address is in my profile. I'm happy to help you however I can. I may not be able to make any code-level changes, but there may not be much work that needs to be done. Edit: I just saw your comment https://news.ycombinator.com/item?id=16338576 https://news.ycombinator.com/item?id=16338576 -- I understand there's potentially a lot of one-time work, but it could be done very gradually, and with this announcement, I think CDNs and widget makers would adopt SSL as well. Once the site does support SSL, you can make SSL-related upgrades (like disabling old ciphers or protocol versions) without much disruption.

staticelf 9y ago
Let's encrypt doesn't really work for all hosting solutions. So a lot of sites still have to purchase an expensive cert.
- ancarda 9y ago
  Could you help me understand scenarios where Let's Encrypt and CloudFlare SSL won't suffice? They have, e.g. added wildcard support now, so that's another angle covered.
  - staticelf 9y ago
    I have sites on Azure and I could add CloudFlare SSL, but it's some work to make that happen and I will have to do it now for all my static sites that absolutely do not need TLS (no forms, no cookies, no javascript). Or else I have to pay for a cert, a cert is still like $10-$20 per year, per site so that is a lot of money if you have a lot of static sites compared to what the site costs to host (which is near-to-nothing). And for other shared hosting solutions I'm not really sure if it's possible to implement CloudFlare SSL (I have never implemented it so I'm not really sure what's required)? Why I don't want Cloudflare is because that is adding a third party just because google said I must or I will get punished for it.
    - ancarda 9y ago
      Hopefully Azure will implement some solution to provide SSL for free. I suspect with this announcement, free SSL may get more attention on hosting providers. There's already several tickets open on the Azure feedback website: https://feedback.azure.com/forums/170024-additional-services/suggestions/16957756-add-integration-with-let-s-encrypt https://feedback.azure.com/forums/170024-additional-services... -- this problem may go away mostly by itself if it continues to get easier every year. Google isn't making you do anything, merely notifying users that the connection to your website is not secure.
      - staticelf 9y ago
        Yes it may, but it can still take a lot of time before it's one click. These tickets have existed since Let's Encrypt was released. Well they are indirect forcing me through their domination over the web, which I don't like.

staticelf 9y ago

Let's encrypt doesn't really work for all hosting solutions. So a lot of sites still have to purchase an expensive cert.

ancarda 9y ago
Could you help me understand scenarios where Let's Encrypt and CloudFlare SSL won't suffice? They have, e.g. added wildcard support now, so that's another angle covered.
- staticelf 9y ago
  I have sites on Azure and I could add CloudFlare SSL, but it's some work to make that happen and I will have to do it now for all my static sites that absolutely do not need TLS (no forms, no cookies, no javascript). Or else I have to pay for a cert, a cert is still like $10-$20 per year, per site so that is a lot of money if you have a lot of static sites compared to what the site costs to host (which is near-to-nothing). And for other shared hosting solutions I'm not really sure if it's possible to implement CloudFlare SSL (I have never implemented it so I'm not really sure what's required)? Why I don't want Cloudflare is because that is adding a third party just because google said I must or I will get punished for it.
  - ancarda 9y ago
    Hopefully Azure will implement some solution to provide SSL for free. I suspect with this announcement, free SSL may get more attention on hosting providers. There's already several tickets open on the Azure feedback website: https://feedback.azure.com/forums/170024-additional-services/suggestions/16957756-add-integration-with-let-s-encrypt https://feedback.azure.com/forums/170024-additional-services... -- this problem may go away mostly by itself if it continues to get easier every year. Google isn't making you do anything, merely notifying users that the connection to your website is not secure.
    - staticelf 9y ago
      Yes it may, but it can still take a lot of time before it's one click. These tickets have existed since Let's Encrypt was released. Well they are indirect forcing me through their domination over the web, which I don't like.