8 ms·

Because my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop s

Because my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.

robin_reala 8y ago
But your static blog isn’t secure served over HTTP. And that’s fine if you choose it.
- skolemtotem 8y ago
  Oh no, someone's going to MITM my shitty blog posts. "Secure" is a word that only makes sense with context, and without that context it only serves to cause irrational panic. I wonder why Google's really doing this.
  - UncleMeat 8y ago
    Yes. They literally will. ISPs have injected ads into pages delivered to their customers. Data integrity also comes from HTTPS too.
    - patmcguire 8y ago
      Boxing out ISPs is probably a large part of why they're doing it. Google believes traffic should be able to go directly from your computer to the server in question and then load up Adsense without any interference from your ISP injecting ads. They can do things for more than one reason, it's a good thing, but it also nullifies one of the few channels they don't have access to.
  - LeoPanthera 8y ago
    You may not care if bad actors inject crap into your web page, but I care, as may many of your readers. This is not a theoretical vulnerability. Comcast routinely adds stuff to unencrypted web pages.
  - giobox 8y ago
    > I wonder why Google's really doing this. You don't have to wonder all that hard given how publicly Google has discussed their stance on this. They have been using their leverage to try to force SSL usage for some time, including adversely affecting search rankings for sites that don't use it. They have clearly articulated many times they think SSL everywhere is important for the web, and they have the leverage in search/browser marketshare to try to make this a reality. > https://security.googleblog.com/2014/08/https-as-ranking-signal_6.html https://security.googleblog.com/2014/08/https-as-ranking-sig... The Google IO talk for Google's desire for "HTTPS everywhere" > https://www.youtube.com/watch?v=cBhZ6S0PFCY&utm_source=wmx_blog&utm_medium=referral&utm_campaign=tls_en_post https://www.youtube.com/watch?v=cBhZ6S0PFCY&utm_source=wmx_b... For what its worth, most metrics show a significant jump in SSL usage in 2016/17 following the announcement that it could adversely affect search rankings, although who knows if the two are related.
  - elorant 8y ago
    You'd be amazed at the amount of web sites which are not secured. E-commerce sites, corporate sites, classified sites, you name it. How unlikely would be to visit a news site through some "free" vpn service only to have most of the ads replaced with shady ones. I mean let's get realistic here, https while inconvenient will make the web a better place. And even if your site isn't secure most users won't even notice because they rarely ever watch the address bar. If they did there wouldn't be a bazillion of phising attacks out there.
  - criddell 8y ago
    It's not irrational. Remember the Great Cannon of China attack in 2015? That attack tool works by modifying the responses to insert code to attack the victim. If your shitty blog posts aren't over https, then they can be used to attack other people. In a way, it's a little like a public health argument. You might not be worried about measles but you should still be vaccinated for the sake of the herd.
- communist_ 8y ago
  This is completely untrue. If HTTP is enough for Debian packages it's enough for my blog. It's a myth that HTTPS is the only way for the Web to be secure; there are many ways to encrypt and verify data. Google it just trying to consolidate its power over the Internet by making us rely on centralized certificate authorities.
hartator 8y ago
Yes, plus it gives the feeling that https://chase-very-secure-sign-in-1024-bits-certificate.scam.com https://chase-very-secure-sign-in-1024-bits-certificate.scam... is perfectly secure when it’s not. Good education >> Browser gimmicks.
- UncleMeat 8y ago
  Good education doesn't scale. Browser "gimmicks" help people make better decisions when they don't have good education. Also I get a huge red alert when I follow that link. Seems like chrome is doing a good job telling people it isn't secure.
- icebraining 8y ago
  On the contrary, the move is also to remove the padlock and "Secure" signs from such sites.
hughes 8y ago
Nobody's saying it does - including Chrome. The browser will simply (and correctly) show "Not Secure" in the address bar when next to the url viewing your blog. If a user doesn't have an expectation of security, they won't be bothered or perhaps even notice.
- deleted 8y ago
  [deleted]
- ysavir 8y ago
  Which is great for users that understand what these security concerns are all about, like typical HN folk. But these people are probably aware of cyber security already, so not much gain here. And people that _don't_ understand cyber security will have no context for what "not secure" means, and may needlessly avoid a variety of HTTP static-HTML sites, where these security issues aren't that great a concern.
  - sarif 8y ago
    Um, good? If people avoid your site because its not secure, maybe you should fix it?
    - NeoBasilisk 8y ago
      What does it mean to fix a site that does not accept/process POST requests?
      - UncleMeat 8y ago
        Start serving over https? Since when has encryption only mattered for POST?
        NeoBasilisk 8y ago
        Can you explain the benefit in other situations? Preventing MitM attacks is the only thing I can think of.
amaccuish 8y ago
And what happens if my grandmother mitm your site to redirect to a fake login page. Internet security is everyone hosting on the internet's responsibility. You're doing a disservice to your users.
0x0 8y ago
How is having a "not secure" label showing up on your not secure http html folder an inconvenience? I think it makes more sense to move to secure by default, with a large "not secure" label for the nondefault (non-https) sites. Better to be proactive with the labeling than relying on endusers having to remember to look for that little padlock now that letsencrypt hands out certificates for free in a super easy, automated fashion.
Nadya 8y ago
>Because my statically generated blog really needs https. So I was reading your blog and am particularly concerned about the crypto miner present on the page. Care to explain this to me? Hint: MITM due to insecure context and the miner isn't coming from you but as a user, I'm going to blame you because it happens on your insecure blog page. Both my personal static site and my "literally only I can use it I've disabled user registration" file host use https. I can think of no good reason not to - to which people always link me that stupid anti-https n-gate article. The same site where the owner links to a Patreon account that I cannot verify is them and not a malicious actor looking to get donations from readers of the site. They also link to a Twitter account that may or may not be them.
mike-cardwell 8y ago
If the only advantage you can think of for sending traffic unencrypted is that it saves you a small amount of time, you're unlikely to find anyone who cares. "I'm lazy, so I don't want to set up encryption on my website, but please don't tell my site visitors. They don't need to know"

robin_reala 8y ago

But your static blog isn’t secure served over HTTP. And that’s fine if you choose it.

skolemtotem 8y ago
Oh no, someone's going to MITM my shitty blog posts. "Secure" is a word that only makes sense with context, and without that context it only serves to cause irrational panic. I wonder why Google's really doing this.
- UncleMeat 8y ago
  Yes. They literally will. ISPs have injected ads into pages delivered to their customers. Data integrity also comes from HTTPS too.
  - patmcguire 8y ago
    Boxing out ISPs is probably a large part of why they're doing it. Google believes traffic should be able to go directly from your computer to the server in question and then load up Adsense without any interference from your ISP injecting ads. They can do things for more than one reason, it's a good thing, but it also nullifies one of the few channels they don't have access to.
- LeoPanthera 8y ago
  You may not care if bad actors inject crap into your web page, but I care, as may many of your readers. This is not a theoretical vulnerability. Comcast routinely adds stuff to unencrypted web pages.
- giobox 8y ago
  > I wonder why Google's really doing this. You don't have to wonder all that hard given how publicly Google has discussed their stance on this. They have been using their leverage to try to force SSL usage for some time, including adversely affecting search rankings for sites that don't use it. They have clearly articulated many times they think SSL everywhere is important for the web, and they have the leverage in search/browser marketshare to try to make this a reality. > https://security.googleblog.com/2014/08/https-as-ranking-signal_6.html https://security.googleblog.com/2014/08/https-as-ranking-sig... The Google IO talk for Google's desire for "HTTPS everywhere" > https://www.youtube.com/watch?v=cBhZ6S0PFCY&utm_source=wmx_blog&utm_medium=referral&utm_campaign=tls_en_post https://www.youtube.com/watch?v=cBhZ6S0PFCY&utm_source=wmx_b... For what its worth, most metrics show a significant jump in SSL usage in 2016/17 following the announcement that it could adversely affect search rankings, although who knows if the two are related.
- elorant 8y ago
  You'd be amazed at the amount of web sites which are not secured. E-commerce sites, corporate sites, classified sites, you name it. How unlikely would be to visit a news site through some "free" vpn service only to have most of the ads replaced with shady ones. I mean let's get realistic here, https while inconvenient will make the web a better place. And even if your site isn't secure most users won't even notice because they rarely ever watch the address bar. If they did there wouldn't be a bazillion of phising attacks out there.
- criddell 8y ago
  It's not irrational. Remember the Great Cannon of China attack in 2015? That attack tool works by modifying the responses to insert code to attack the victim. If your shitty blog posts aren't over https, then they can be used to attack other people. In a way, it's a little like a public health argument. You might not be worried about measles but you should still be vaccinated for the sake of the herd.
communist_ 8y ago
This is completely untrue. If HTTP is enough for Debian packages it's enough for my blog. It's a myth that HTTPS is the only way for the Web to be secure; there are many ways to encrypt and verify data. Google it just trying to consolidate its power over the Internet by making us rely on centralized certificate authorities.

hartator 8y ago

Yes, plus it gives the feeling that https://chase-very-secure-sign-in-1024-bits-certificate.scam.com https://chase-very-secure-sign-in-1024-bits-certificate.scam... is perfectly secure when it’s not. Good education >> Browser gimmicks.

UncleMeat 8y ago
Good education doesn't scale. Browser "gimmicks" help people make better decisions when they don't have good education. Also I get a huge red alert when I follow that link. Seems like chrome is doing a good job telling people it isn't secure.
icebraining 8y ago
On the contrary, the move is also to remove the padlock and "Secure" signs from such sites.

hughes 8y ago

Nobody's saying it does - including Chrome. The browser will simply (and correctly) show "Not Secure" in the address bar when next to the url viewing your blog. If a user doesn't have an expectation of security, they won't be bothered or perhaps even notice.

deleted 8y ago
[deleted]
ysavir 8y ago
Which is great for users that understand what these security concerns are all about, like typical HN folk. But these people are probably aware of cyber security already, so not much gain here. And people that _don't_ understand cyber security will have no context for what "not secure" means, and may needlessly avoid a variety of HTTP static-HTML sites, where these security issues aren't that great a concern.
- sarif 8y ago
  Um, good? If people avoid your site because its not secure, maybe you should fix it?
  - NeoBasilisk 8y ago
    What does it mean to fix a site that does not accept/process POST requests?
    - UncleMeat 8y ago
      Start serving over https? Since when has encryption only mattered for POST?
      - NeoBasilisk 8y ago
        Can you explain the benefit in other situations? Preventing MitM attacks is the only thing I can think of.

amaccuish 8y ago

And what happens if my grandmother mitm your site to redirect to a fake login page. Internet security is everyone hosting on the internet's responsibility. You're doing a disservice to your users.

0x0 8y ago

How is having a "not secure" label showing up on your not secure http html folder an inconvenience? I think it makes more sense to move to secure by default, with a large "not secure" label for the nondefault (non-https) sites. Better to be proactive with the labeling than relying on endusers having to remember to look for that little padlock now that letsencrypt hands out certificates for free in a super easy, automated fashion.

Nadya 8y ago

>Because my statically generated blog really needs https. So I was reading your blog and am particularly concerned about the crypto miner present on the page. Care to explain this to me? Hint: MITM due to insecure context and the miner isn't coming from you but as a user, I'm going to blame you because it happens on your insecure blog page. Both my personal static site and my "literally only I can use it I've disabled user registration" file host use https. I can think of no good reason not to - to which people always link me that stupid anti-https n-gate article. The same site where the owner links to a Patreon account that I cannot verify is them and not a malicious actor looking to get donations from readers of the site. They also link to a Twitter account that may or may not be them.

mike-cardwell 8y ago

If the only advantage you can think of for sending traffic unencrypted is that it saves you a small amount of time, you're unlikely to find anyone who cares. "I'm lazy, so I don't want to set up encryption on my website, but please don't tell my site visitors. They don't need to know"