3 ms·

Even with a static HTTP-only website, there's tons of stuff that you have to update anyway. Hardware gets outdated and needs replacing, at which point you canno

Even with a static HTTP-only website, there's tons of stuff that you have to update anyway. Hardware gets outdated and needs replacing, at which point you cannot postpone the kernel update anymore because you need the new device drivers, etc. etc. You also don't want to stop updating your HTTP server, CVEs get discovered quite frequently. You can of course draw a line between that churn and the churn of updating your TLS config every few years, but it's more arbitrary than you think.

UserIsUnused 7y ago
> Hardware gets outdated and needs replacing Irrelevant. Low traffic static website. > at which point you cannot postpone the kernel update anymore because you need the new device drivers, etc. etc Irrelevant as I didn't upgrade the hardware >You also don't want to stop updating your HTTP server, CVEs get discovered quite frequently it's a server for serving a single static page from 1998, nothing bad will happen if that machine is compromised, well, nothing worse that what could be done for not having HTTPs
- theandrewbailey 7y ago
  > it's a server for serving a single static page from 1998, nothing bad will happen if that machine is compromised, well, nothing worse that what could be done for not having HTTPs Here's one: the server has a remote code execution vulnerability, which is exploited to gain root permissions, and your server is serving child porn. The cops are knocking on your door. Granted, this isn't a pro-HTTPS argument, but you do need to keep your stuff updated, even if it is only a static site.