5 ms·

Some websites adamantly insist they did not need HTTPS because they are purely static. https://www.troyhunt.com/heres-why-your-static-website-needs-https/ http

Some websites adamantly insist they did not need HTTPS because they are purely static. https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs... The same website to my surprise has an article on why this is faulty reasoning.

enriquto 7y ago
my static website is a sand castle in the beach. When I'm not around, kids may break it, or a random person may impersonate as its creator. That is alright, it is just a sand castle. The only purpose of its existence is to provide casual onlookers a nice view (or read) for a few minutes. Having to set up a "certificate" for that would be an unacceptable burden.
- jmkni 7y ago
  Got a link? I'd like to see this sand castle :-)
- AndrewStephens 7y ago
  It is a sand castle on a private beach owned by you. Have you ever posted a link to your site anywhere? Imagine you sent me a post card saying "Come to my beach to look at my cool sandcastle" and then when I got there the sandcastle was actually a robot that stole my credit card. You could say that it wasn't your fault - somebody broke into your private beach and replaced the sandcastle. But I would probably still blame you for not securing the area and double-checking the contents before inviting people. Even if I didn't blame you, I probably wouldn't respond to another invitation.
  - AnIdiotOnTheNet 7y ago
    > and then when I got there the sandcastle was actually a robot that stole my credit card. What kind of moron shows up to see a sandcastle and doesn't think twice about handing over their credit card?
    - AndrewStephens 7y ago
      That's the thing with credit card stealing robots - they are nimble and you don't know if they are stealing from you. Likewise, if I go to a website and serves up malware, you don't know it is stealing from you.
  - enriquto 7y ago
    > Imagine you sent me a post card (...) I like this. Post-cards are a better analogy for plain http than the sand castle. Of course postcards are not "secure": everybody can read them, and you can trivially impersonate somebody else sending a postcard. Any serious snail mail communication must go via safer channels. Yet, postcards are a very nice thing to have, it would be a shame if they weren't possible. My kids can easily send a postcard to their grandparents, just by themselves. My grandfathers will probably (but nor surely) receive the postcard, and they will recognize who wrote them (but they can never be sure, really), and everybody will be happy. In the same vein, HTTPS is better than plain HTTP for serious communication, and there's nothing wrong with it. Yet, the existence of HTTP is another fundamental part of the internet, and I make a point of using it as much as possible. Do you propose that anonymous postcards shouldn't exist, and that the post office should only accept letters certified by adults who had identified themselves at the local police station? I would hate that! And for the same reasons I hate a world without http.
iudqnolq 7y ago
Our asshat twin n-gate has something to say about this > Horseshit. Users must keep themselves safe. Software can't ever do that for you. Users are on their own to ensure they use a quality web client, on a computer they're reasonably sure is well-maintained, over an internet connection that is not run by people who hate them. None of the packets I send out are unsafe, so my site does not need HTTPS. > None of those things are my problem. If people don't want to see my site with random trash inserted into it, they can choose not to access it through broken and/or compromised networks. If other website operators are concerned about this sort of thing, they are free to use HTTPS, but I have no reason to do so. Encryption should be available to anyone who wants to serve encrypted content, but I have no interest in using it for my website. It's a shame that people are using web browsers (note: not my website, but BROWSERS) as attack vectors. The legions of browser programmers employed by Mozilla, Google, Apple, and Microsoft should do something about that. It's not my flaw to fix, because it's a problem with the clients. My site does not need HTTPS. > Earlier you recommended letsencrypt, and now suddenly you want me to pick a competent certificate authority? The only reason they didn't leak my info already is because my site does not need HTTPS. > Obviously my site does not display ads; as has [been pointed out][https://news.ycombinator.com/item?id=14666391 https://news.ycombinator.com/item?id=14666391], It does not even appear to be monetized. This is because I have a real job and the entire web ad industry can fuck itself off a cliff. So, while mixed-content warnings are pretty obnoxious, my site does not need HTTPS. http://n-gate.com/software/2017/ http://n-gate.com/software/2017/
- saagarjha 7y ago
  The website is actually quite useful: I notice that intersection between the threads discussed there and the ones I comment on is almost exactly the empty set. So it’s a great check to see whether I’m doing a good job ;)
  - iudqnolq 7y ago
    I also read his work occasionally, and find it has some worth. I do, however, stand by my claim he's an asshat.
- 7y ago
cesarb 7y ago
Though I'm on the "encrypt all the things!" camp, let me play devil's advocate for a moment. If I set up a purely static HTTP-only site in 1998, it would still work with today's browsers, more than 20 years later. If I set up a purely static HTTPS-only site in 1998, and didn't follow the upgrade treadmill, it would have stopped working for modern browsers some time ago.
- dx034 7y ago
  It would still work, just create a warning. For a page that hasn't been updated since 1998 that's ok imo. On the other hand, it needs to be hosted somewhere. Either a vps (which also needs updating) or a web hosting package (which tend to provide auto-renewing certificates). Just because the code is static doesn't mean nothing about the website has changed for 20 years.
  - MayeulC 7y ago
    You assume it's not a box in my basement or my company's that has been running for 20+ years. I wouldn't be surprised to hear things like this still exist. Of course, migrating to even a raspberry Pi would be a net performance and perf/watt improvement.
- majewsky 7y ago
  Even with a static HTTP-only website, there's tons of stuff that you have to update anyway. Hardware gets outdated and needs replacing, at which point you cannot postpone the kernel update anymore because you need the new device drivers, etc. etc. You also don't want to stop updating your HTTP server, CVEs get discovered quite frequently. You can of course draw a line between that churn and the churn of updating your TLS config every few years, but it's more arbitrary than you think.
  - UserIsUnused 7y ago
    > Hardware gets outdated and needs replacing Irrelevant. Low traffic static website. > at which point you cannot postpone the kernel update anymore because you need the new device drivers, etc. etc Irrelevant as I didn't upgrade the hardware >You also don't want to stop updating your HTTP server, CVEs get discovered quite frequently it's a server for serving a single static page from 1998, nothing bad will happen if that machine is compromised, well, nothing worse that what could be done for not having HTTPs
dingo_bat 7y ago
There's literally no argument on that article for the question "why does my static website need https?"

enriquto 7y ago

my static website is a sand castle in the beach. When I'm not around, kids may break it, or a random person may impersonate as its creator. That is alright, it is just a sand castle. The only purpose of its existence is to provide casual onlookers a nice view (or read) for a few minutes. Having to set up a "certificate" for that would be an unacceptable burden.

jmkni 7y ago
Got a link? I'd like to see this sand castle :-)
AndrewStephens 7y ago
It is a sand castle on a private beach owned by you. Have you ever posted a link to your site anywhere? Imagine you sent me a post card saying "Come to my beach to look at my cool sandcastle" and then when I got there the sandcastle was actually a robot that stole my credit card. You could say that it wasn't your fault - somebody broke into your private beach and replaced the sandcastle. But I would probably still blame you for not securing the area and double-checking the contents before inviting people. Even if I didn't blame you, I probably wouldn't respond to another invitation.
- AnIdiotOnTheNet 7y ago
  > and then when I got there the sandcastle was actually a robot that stole my credit card. What kind of moron shows up to see a sandcastle and doesn't think twice about handing over their credit card?
  - AndrewStephens 7y ago
    That's the thing with credit card stealing robots - they are nimble and you don't know if they are stealing from you. Likewise, if I go to a website and serves up malware, you don't know it is stealing from you.
- enriquto 7y ago
  > Imagine you sent me a post card (...) I like this. Post-cards are a better analogy for plain http than the sand castle. Of course postcards are not "secure": everybody can read them, and you can trivially impersonate somebody else sending a postcard. Any serious snail mail communication must go via safer channels. Yet, postcards are a very nice thing to have, it would be a shame if they weren't possible. My kids can easily send a postcard to their grandparents, just by themselves. My grandfathers will probably (but nor surely) receive the postcard, and they will recognize who wrote them (but they can never be sure, really), and everybody will be happy. In the same vein, HTTPS is better than plain HTTP for serious communication, and there's nothing wrong with it. Yet, the existence of HTTP is another fundamental part of the internet, and I make a point of using it as much as possible. Do you propose that anonymous postcards shouldn't exist, and that the post office should only accept letters certified by adults who had identified themselves at the local police station? I would hate that! And for the same reasons I hate a world without http.

iudqnolq 7y ago

Our asshat twin n-gate has something to say about this > Horseshit. Users must keep themselves safe. Software can't ever do that for you. Users are on their own to ensure they use a quality web client, on a computer they're reasonably sure is well-maintained, over an internet connection that is not run by people who hate them. None of the packets I send out are unsafe, so my site does not need HTTPS. > None of those things are my problem. If people don't want to see my site with random trash inserted into it, they can choose not to access it through broken and/or compromised networks. If other website operators are concerned about this sort of thing, they are free to use HTTPS, but I have no reason to do so. Encryption should be available to anyone who wants to serve encrypted content, but I have no interest in using it for my website. It's a shame that people are using web browsers (note: not my website, but BROWSERS) as attack vectors. The legions of browser programmers employed by Mozilla, Google, Apple, and Microsoft should do something about that. It's not my flaw to fix, because it's a problem with the clients. My site does not need HTTPS. > Earlier you recommended letsencrypt, and now suddenly you want me to pick a competent certificate authority? The only reason they didn't leak my info already is because my site does not need HTTPS. > Obviously my site does not display ads; as has [been pointed out][https://news.ycombinator.com/item?id=14666391 https://news.ycombinator.com/item?id=14666391], It does not even appear to be monetized. This is because I have a real job and the entire web ad industry can fuck itself off a cliff. So, while mixed-content warnings are pretty obnoxious, my site does not need HTTPS. http://n-gate.com/software/2017/ http://n-gate.com/software/2017/

saagarjha 7y ago
The website is actually quite useful: I notice that intersection between the threads discussed there and the ones I comment on is almost exactly the empty set. So it’s a great check to see whether I’m doing a good job ;)
- iudqnolq 7y ago
  I also read his work occasionally, and find it has some worth. I do, however, stand by my claim he's an asshat.
7y ago

cesarb 7y ago

Though I'm on the "encrypt all the things!" camp, let me play devil's advocate for a moment. If I set up a purely static HTTP-only site in 1998, it would still work with today's browsers, more than 20 years later. If I set up a purely static HTTPS-only site in 1998, and didn't follow the upgrade treadmill, it would have stopped working for modern browsers some time ago.

dx034 7y ago
It would still work, just create a warning. For a page that hasn't been updated since 1998 that's ok imo. On the other hand, it needs to be hosted somewhere. Either a vps (which also needs updating) or a web hosting package (which tend to provide auto-renewing certificates). Just because the code is static doesn't mean nothing about the website has changed for 20 years.
- MayeulC 7y ago
  You assume it's not a box in my basement or my company's that has been running for 20+ years. I wouldn't be surprised to hear things like this still exist. Of course, migrating to even a raspberry Pi would be a net performance and perf/watt improvement.
majewsky 7y ago
Even with a static HTTP-only website, there's tons of stuff that you have to update anyway. Hardware gets outdated and needs replacing, at which point you cannot postpone the kernel update anymore because you need the new device drivers, etc. etc. You also don't want to stop updating your HTTP server, CVEs get discovered quite frequently. You can of course draw a line between that churn and the churn of updating your TLS config every few years, but it's more arbitrary than you think.
- UserIsUnused 7y ago
  > Hardware gets outdated and needs replacing Irrelevant. Low traffic static website. > at which point you cannot postpone the kernel update anymore because you need the new device drivers, etc. etc Irrelevant as I didn't upgrade the hardware >You also don't want to stop updating your HTTP server, CVEs get discovered quite frequently it's a server for serving a single static page from 1998, nothing bad will happen if that machine is compromised, well, nothing worse that what could be done for not having HTTPs

dingo_bat 7y ago

There's literally no argument on that article for the question "why does my static website need https?"