15 ms·

So it's easy as long as you use Cloudflare, otherwise you still have to fight with private keys, csrs, permissions, hsts, http->https redirects and what happens

So it's easy as long as you use Cloudflare, otherwise you still have to fight with private keys, csrs, permissions, hsts, http->https redirects and what happens when it expires or otherwise goes wrong. Thanks Troy!

scrollaway 8y ago
I wonder how highly you must think of yourself to adopt such a snarky tone when talking about someone who contributed so much to internet security. "Thanks lbriner!" Edit: Downvoters have spoken, and apparently the parent comment is the kind of content you guys want to see on this site. What a world.
- Spivak 8y ago
  Well the advice pretty much boils down to "HTTPS is Easy (when you pay someone else to manage it for you)!" And maybe that's good advice but at least be upfront about the actual statement. "Web development is easy! (when you pay Squarespace)" "Payment processing is easy! (when you pay Stripe)" "Email is easy! (when you pay FastMail)"
- Someone1234 8y ago
  The snark is well deserved. The article's title is condescending and wrong, setting up TLS isn't "easy," and claiming otherwise is unproductive. This is nothing but a glorified ad for CloudFlare, and doesn't prove that HTTPS is "easy" but rather using CloudFlare's package offering is easier. I like Troy Hunt, but this isn't one of his best.
  - Reedx 8y ago
    > setting up TLS isn't "easy," and claiming otherwise is unproductive. Well... it is if you use Cloudflare. But yeah, it should be httpsiseasyIFusingcloudflare.com or something. > This is nothing but a glorified ad for CloudFlare It's technically not though. He says they didn't even know he was making this. It's just a nice little free resource for anyone using Cloudflare or looking for a relatively easy path to https. For him, it'll drive some traffic back to his other site and build his brand a bit more. It'll probably result in a bunch of Cloudflare sites beefing up their security a bit and capture some who haven't previously tackled https at all. Isn't that a good thing?
- deleted 8y ago
  [deleted]
- shawn 8y ago
  For what it’s worth, whenever someone seems arrogant on the internet, it’s easier to just ignore them than call them out. After all, they could be right.
lmm 8y ago
Don't forget he still mostly recommends the configuration where you send your traffic unencrypted across the public internet from Cloudflare to you, breaking all your security guarantees and rendering the whole exercise pointless.
- Ajedi32 8y ago
  The fourth video in the series explains how to encrypt traffic between Cloudflare and the host server. Also, the article kinda covers this already: > And before anyone loses their minds over the entire network not being encrypted or Cloudflare being able to MitM the traffic, have a read of CloudFlare, SSL and unhealthy security absolutism. https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security-absolutism/ https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-securi...
  - Someone1234 8y ago
    I wouldn't say it "covers it," more "glosses over it rapidly." "Perfect is the enemy of good" is a legit problem we should avoid (i.e. not using HTTPS at all because CloudFlare isn't perfect) but the benefits and drawbacks should at least be discussed. For example I think an insecure back-channel between your personal blog and CloudFlare is likely fine, but your eCommerce business, perhaps not.
Ajedi32 8y ago
ACME clients like Certbot can and do handle a lot of that for you as well. Certbot isn't as universal as Cloudflare though, since you can't run it on a lot of shared hosting sites. It also requires a basic level of proficiency with the command line, which is unfortunately a bar a little too high for some users.
- detaro 8y ago
  For shared hosting sites the answer is even easier: use a shared hosting provider that provides you with HTTPS.
- bjpbakker 8y ago
  > It also requires a basic level of proficiency with the command line Sorry but when you lack all basic computer skills, you should _not_ be setting up TLS for a web server. No matter if you use Cloudflare or something else, have someone else do it.
- smacktoward 8y ago
  Certbot definitely makes HTTPS easier. That doesn't necessarily mean the situation has improved enough to be called easy with a straight face, though.

scrollaway 8y ago

I wonder how highly you must think of yourself to adopt such a snarky tone when talking about someone who contributed so much to internet security. "Thanks lbriner!" Edit: Downvoters have spoken, and apparently the parent comment is the kind of content you guys want to see on this site. What a world.

Spivak 8y ago
Well the advice pretty much boils down to "HTTPS is Easy (when you pay someone else to manage it for you)!" And maybe that's good advice but at least be upfront about the actual statement. "Web development is easy! (when you pay Squarespace)" "Payment processing is easy! (when you pay Stripe)" "Email is easy! (when you pay FastMail)"
Someone1234 8y ago
The snark is well deserved. The article's title is condescending and wrong, setting up TLS isn't "easy," and claiming otherwise is unproductive. This is nothing but a glorified ad for CloudFlare, and doesn't prove that HTTPS is "easy" but rather using CloudFlare's package offering is easier. I like Troy Hunt, but this isn't one of his best.
- Reedx 8y ago
  > setting up TLS isn't "easy," and claiming otherwise is unproductive. Well... it is if you use Cloudflare. But yeah, it should be httpsiseasyIFusingcloudflare.com or something. > This is nothing but a glorified ad for CloudFlare It's technically not though. He says they didn't even know he was making this. It's just a nice little free resource for anyone using Cloudflare or looking for a relatively easy path to https. For him, it'll drive some traffic back to his other site and build his brand a bit more. It'll probably result in a bunch of Cloudflare sites beefing up their security a bit and capture some who haven't previously tackled https at all. Isn't that a good thing?
deleted 8y ago
[deleted]
shawn 8y ago
For what it’s worth, whenever someone seems arrogant on the internet, it’s easier to just ignore them than call them out. After all, they could be right.

lmm 8y ago

Don't forget he still mostly recommends the configuration where you send your traffic unencrypted across the public internet from Cloudflare to you, breaking all your security guarantees and rendering the whole exercise pointless.

Ajedi32 8y ago
The fourth video in the series explains how to encrypt traffic between Cloudflare and the host server. Also, the article kinda covers this already: > And before anyone loses their minds over the entire network not being encrypted or Cloudflare being able to MitM the traffic, have a read of CloudFlare, SSL and unhealthy security absolutism. https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security-absolutism/ https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-securi...
- Someone1234 8y ago
  I wouldn't say it "covers it," more "glosses over it rapidly." "Perfect is the enemy of good" is a legit problem we should avoid (i.e. not using HTTPS at all because CloudFlare isn't perfect) but the benefits and drawbacks should at least be discussed. For example I think an insecure back-channel between your personal blog and CloudFlare is likely fine, but your eCommerce business, perhaps not.

Ajedi32 8y ago

ACME clients like Certbot can and do handle a lot of that for you as well. Certbot isn't as universal as Cloudflare though, since you can't run it on a lot of shared hosting sites. It also requires a basic level of proficiency with the command line, which is unfortunately a bar a little too high for some users.

detaro 8y ago
For shared hosting sites the answer is even easier: use a shared hosting provider that provides you with HTTPS.
bjpbakker 8y ago
> It also requires a basic level of proficiency with the command line Sorry but when you lack all basic computer skills, you should _not_ be setting up TLS for a web server. No matter if you use Cloudflare or something else, have someone else do it.
smacktoward 8y ago
Certbot definitely makes HTTPS easier. That doesn't necessarily mean the situation has improved enough to be called easy with a straight face, though.