4 ms·

Though I'm on the "encrypt all the things!" camp, let me play devil's advocate for a moment. If I set up a purely static HTTP-only site in 1998, it would still

by cesarb 7y ago

Though I'm on the "encrypt all the things!" camp, let me play devil's advocate for a moment. If I set up a purely static HTTP-only site in 1998, it would still work with today's browsers, more than 20 years later. If I set up a purely static HTTPS-only site in 1998, and didn't follow the upgrade treadmill, it would have stopped working for modern browsers some time ago.

dx034 7y ago
It would still work, just create a warning. For a page that hasn't been updated since 1998 that's ok imo. On the other hand, it needs to be hosted somewhere. Either a vps (which also needs updating) or a web hosting package (which tend to provide auto-renewing certificates). Just because the code is static doesn't mean nothing about the website has changed for 20 years.
- MayeulC 7y ago
  You assume it's not a box in my basement or my company's that has been running for 20+ years. I wouldn't be surprised to hear things like this still exist. Of course, migrating to even a raspberry Pi would be a net performance and perf/watt improvement.
majewsky 7y ago
Even with a static HTTP-only website, there's tons of stuff that you have to update anyway. Hardware gets outdated and needs replacing, at which point you cannot postpone the kernel update anymore because you need the new device drivers, etc. etc. You also don't want to stop updating your HTTP server, CVEs get discovered quite frequently. You can of course draw a line between that churn and the churn of updating your TLS config every few years, but it's more arbitrary than you think.
- UserIsUnused 7y ago
  > Hardware gets outdated and needs replacing Irrelevant. Low traffic static website. > at which point you cannot postpone the kernel update anymore because you need the new device drivers, etc. etc Irrelevant as I didn't upgrade the hardware >You also don't want to stop updating your HTTP server, CVEs get discovered quite frequently it's a server for serving a single static page from 1998, nothing bad will happen if that machine is compromised, well, nothing worse that what could be done for not having HTTPs
  - theandrewbailey 7y ago
    > it's a server for serving a single static page from 1998, nothing bad will happen if that machine is compromised, well, nothing worse that what could be done for not having HTTPs Here's one: the server has a remote code execution vulnerability, which is exploited to gain root permissions, and your server is serving child porn. The cops are knocking on your door. Granted, this isn't a pro-HTTPS argument, but you do need to keep your stuff updated, even if it is only a static site.
zzo38computer 7y ago
That is (at least one reason) why you should implement both, instead of just one.

by cesarb 7y ago

dx034 7y ago

It would still work, just create a warning. For a page that hasn't been updated since 1998 that's ok imo. On the other hand, it needs to be hosted somewhere. Either a vps (which also needs updating) or a web hosting package (which tend to provide auto-renewing certificates). Just because the code is static doesn't mean nothing about the website has changed for 20 years.

MayeulC 7y ago
You assume it's not a box in my basement or my company's that has been running for 20+ years. I wouldn't be surprised to hear things like this still exist. Of course, migrating to even a raspberry Pi would be a net performance and perf/watt improvement.

majewsky 7y ago

Even with a static HTTP-only website, there's tons of stuff that you have to update anyway. Hardware gets outdated and needs replacing, at which point you cannot postpone the kernel update anymore because you need the new device drivers, etc. etc. You also don't want to stop updating your HTTP server, CVEs get discovered quite frequently. You can of course draw a line between that churn and the churn of updating your TLS config every few years, but it's more arbitrary than you think.

UserIsUnused 7y ago
> Hardware gets outdated and needs replacing Irrelevant. Low traffic static website. > at which point you cannot postpone the kernel update anymore because you need the new device drivers, etc. etc Irrelevant as I didn't upgrade the hardware >You also don't want to stop updating your HTTP server, CVEs get discovered quite frequently it's a server for serving a single static page from 1998, nothing bad will happen if that machine is compromised, well, nothing worse that what could be done for not having HTTPs
- theandrewbailey 7y ago
  > it's a server for serving a single static page from 1998, nothing bad will happen if that machine is compromised, well, nothing worse that what could be done for not having HTTPs Here's one: the server has a remote code execution vulnerability, which is exploited to gain root permissions, and your server is serving child porn. The cops are knocking on your door. Granted, this isn't a pro-HTTPS argument, but you do need to keep your stuff updated, even if it is only a static site.

zzo38computer 7y ago

That is (at least one reason) why you should implement both, instead of just one.