> I think it's a cabal of morally righteous security-minded people who have never worked for small companies or realize that most dev teams don't have the time

> I think it's a cabal of morally righteous security-minded people who have never worked for small companies or realize that most dev teams don't have the time to deal with all this forced entropy. This is just one anecdote, but I worked at a company small enough that I was the only developer/ops person. Time spent managing HTTPS infrastructure couldn't have been more than a handful of hours a year. What is so painful to you about running your website(s) on HTTPS?