5 ms·

HTTP has a zero ongoing cost, HTTPS has a non-zero ongoing cost.

edent 9y ago
Not for me. When I set up a new domain & hosting, I checked the box which said "Enable Lets Encrypt" and it was done instantly. I haven't had to manually renew it.
- Joeboy 9y ago
  That's nice for you, but that's not how it is for other people.
  - ryukafalz 9y ago
    The tooling around Let's Encrypt is designed to make it possible to do that. If you're not dead set on using a specific web server, there are web servers with Let's Encrypt support out of the box[0]. And if you're using Apache or Nginx, Certbot[1] can configure Let's Encrypt support for them automatically. It's not the "one-click install" you'd get with some other software, but it's pretty close. [0] https://caddyserver.com/ https://caddyserver.com/ [1] https://certbot.eff.org/ https://certbot.eff.org/
    - Joeboy 9y ago
      FWIW I just tried the automatic tooling. First observation is that my email (which was already using LE) still seems to be working, which is honestly surprising but I suppose I should be pleased. My website still seems to redirect a couple of times before ending up back at the unencrypted version. TBF, nothing's conspicuously broken so far so no immediate damage. I'll go back and try to sort it out when I have some more time / enthusiasm. Update: I got it working. I still maintain that it was largely pointless, not zero-effort, and puts the difficulty of running a webserver further into the domain of stuff that's only likely to be undertaken by professional / commercial entities, and that that's a bit of a pity. Update2: Shit, I broke some other stuff :-(
      - CiPHPerCoder 9y ago
        Switch to Caddy, then. It becomes mind-numbingly easy to setup. https://caddyserver.com/ https://caddyserver.com/
StavrosK 9y ago
Only if you value the security of your customers at $0.
- Joeboy 9y ago
  Isn't it reasonable for me to value the security of my customers at $0? Given that a) I don't have customers as such and b) My website is just a (very out of date) blog with some innocuous nerdy stuff on it.
  - mAritz 9y ago
    It's not just security, it is also privacy. But even if it was just security, it would be irresponsible to offer something (a blog) and knowingly compromise security for anyone who is interested.
    - Joeboy 9y ago
      How am I compromising anybody's privacy or security by hosting information about my defunct bare metal Raspberry Pi project? What is the threat model?
      - Cthulhu_ 9y ago
        Does it have an admin interface? Without encryption, your username / password are broadcast unencrypted; if intercepted by whoever, they can hijack your blog and post spam / spread malware / subtly inject some JS to mine some dank monero.
        Joeboy 9y ago
        Nope.
      - mAritz 9y ago
        The traffic can be intercepted and changed. If someone trusts you (say you gave them the link) but the content they are being served is not the content you intended to be shared, is that not a security issue? ISPs have been known to inject ads for example.
deadbunny 9y ago
> HTTP has a zero ongoing cost Only if you value your (and your users/readers) privacy at $0

Not for me. When I set up a new domain & hosting, I checked the box which said "Enable Lets Encrypt" and it was done instantly. I haven't had to manually renew it.

Joeboy 9y ago
That's nice for you, but that's not how it is for other people.
- ryukafalz 9y ago
  The tooling around Let's Encrypt is designed to make it possible to do that. If you're not dead set on using a specific web server, there are web servers with Let's Encrypt support out of the box[0]. And if you're using Apache or Nginx, Certbot[1] can configure Let's Encrypt support for them automatically. It's not the "one-click install" you'd get with some other software, but it's pretty close. [0] https://caddyserver.com/ https://caddyserver.com/ [1] https://certbot.eff.org/ https://certbot.eff.org/
  - Joeboy 9y ago
    FWIW I just tried the automatic tooling. First observation is that my email (which was already using LE) still seems to be working, which is honestly surprising but I suppose I should be pleased. My website still seems to redirect a couple of times before ending up back at the unencrypted version. TBF, nothing's conspicuously broken so far so no immediate damage. I'll go back and try to sort it out when I have some more time / enthusiasm. Update: I got it working. I still maintain that it was largely pointless, not zero-effort, and puts the difficulty of running a webserver further into the domain of stuff that's only likely to be undertaken by professional / commercial entities, and that that's a bit of a pity. Update2: Shit, I broke some other stuff :-(
    - CiPHPerCoder 9y ago
      Switch to Caddy, then. It becomes mind-numbingly easy to setup. https://caddyserver.com/ https://caddyserver.com/

StavrosK 9y ago

Only if you value the security of your customers at $0.

Joeboy 9y ago
Isn't it reasonable for me to value the security of my customers at $0? Given that a) I don't have customers as such and b) My website is just a (very out of date) blog with some innocuous nerdy stuff on it.
- mAritz 9y ago
  It's not just security, it is also privacy. But even if it was just security, it would be irresponsible to offer something (a blog) and knowingly compromise security for anyone who is interested.
  - Joeboy 9y ago
    How am I compromising anybody's privacy or security by hosting information about my defunct bare metal Raspberry Pi project? What is the threat model?
    - Cthulhu_ 9y ago
      Does it have an admin interface? Without encryption, your username / password are broadcast unencrypted; if intercepted by whoever, they can hijack your blog and post spam / spread malware / subtly inject some JS to mine some dank monero.
      - Joeboy 9y ago
        Nope.
    - mAritz 9y ago
      The traffic can be intercepted and changed. If someone trusts you (say you gave them the link) but the content they are being served is not the content you intended to be shared, is that not a security issue? ISPs have been known to inject ads for example.

deadbunny 9y ago

> HTTP has a zero ongoing cost Only if you value your (and your users/readers) privacy at $0