3 ms·

Just listening to the number of complex shenanigans experienced sysadmins have to employ to keep up with the demands of managing HTTPS makes me wonder how on ea

by cutler 7y ago

Just listening to the number of complex shenanigans experienced sysadmins have to employ to keep up with the demands of managing HTTPS makes me wonder how on earth your average non-technical DIY static site developer has a chance in hell of keeping his site from failing modern browsers' requirements. Universal HTTPS is a bad joke.

jmspring 7y ago
Downvoted. If one is registering domains and dealing with DNS entries, etc, it’s not a stretch to find someone to setup LetsEncrypt for you. Heck - googling - https://tecadmin.net/auto-renew-lets-encrypt-certificates/ https://tecadmin.net/auto-renew-lets-encrypt-certificates/
- cutler 7y ago
  As a sysadmin myself the number of non-trivial modes in which certbot can fail never ceases to amaze me. Running Apache? Watch your certbot renew fail to bind to port 80 because your server is running. Now your renewal cron task needs to take into account stopping and restarting the server which the standard cron task does not include. What made the web great was that it didn't keep out the DIY developer. Now it does exactly that .... via universal compulsory HTTPS on trivial, static sites.
  - baobabKoodaa 7y ago
    Static sites can be easily published on Netlify or GitHub Pages at no cost - certificates provided by the host.
dannyw 7y ago
To be honest, even before Let's Encrypt I could buy a PositivesSSL from namecheap for about $10 a year, and set it up with Apache or Nginx in about 20-30 mins. Had to renew every X years which was annoying, but cmon. There were step by step tutorials. Now, with Let's Encrypt, there's no excuse to not SSL.
- cutler 7y ago
  But on static sites ... why? I'm not arguing against HTTPS/SSL where it makes sense, just the way it's been imposed indiscriminately on the whole damned www.
  - dannyw 7y ago
    Because a hostile MITM agent can deliver exploit code by MITMing your static site. Even if your site is some static video game guide for Club Penguin, an attacker can inject some 0day, some privacy-invading analytics code, or even a dumb alert("Your windows is out of date").

by cutler 7y ago

jmspring 7y ago

Downvoted. If one is registering domains and dealing with DNS entries, etc, it’s not a stretch to find someone to setup LetsEncrypt for you. Heck - googling - https://tecadmin.net/auto-renew-lets-encrypt-certificates/ https://tecadmin.net/auto-renew-lets-encrypt-certificates/

cutler 7y ago
As a sysadmin myself the number of non-trivial modes in which certbot can fail never ceases to amaze me. Running Apache? Watch your certbot renew fail to bind to port 80 because your server is running. Now your renewal cron task needs to take into account stopping and restarting the server which the standard cron task does not include. What made the web great was that it didn't keep out the DIY developer. Now it does exactly that .... via universal compulsory HTTPS on trivial, static sites.
- baobabKoodaa 7y ago
  Static sites can be easily published on Netlify or GitHub Pages at no cost - certificates provided by the host.

dannyw 7y ago

To be honest, even before Let's Encrypt I could buy a PositivesSSL from namecheap for about $10 a year, and set it up with Apache or Nginx in about 20-30 mins. Had to renew every X years which was annoying, but cmon. There were step by step tutorials. Now, with Let's Encrypt, there's no excuse to not SSL.

cutler 7y ago
But on static sites ... why? I'm not arguing against HTTPS/SSL where it makes sense, just the way it's been imposed indiscriminately on the whole damned www.
- dannyw 7y ago
  Because a hostile MITM agent can deliver exploit code by MITMing your static site. Even if your site is some static video game guide for Club Penguin, an attacker can inject some 0day, some privacy-invading analytics code, or even a dumb alert("Your windows is out of date").