8 ms·

With Let's Encrypt it's cheaper than ever to host a personal website over HTTPS with a certificate that updates itself. Due to Let's Encrypt, free hosting serv

With Let's Encrypt it's cheaper than ever to host a personal website over HTTPS with a certificate that updates itself. Due to Let's Encrypt, free hosting services like Netlify or GitHub Pages are now providing HTTPS certificates and installing it on your own server is pretty painless, if you're into managing your own server. And if your hosting provider doesn't support Let's Encrypt, you can always put Cloudflare in front of it. So I don't really understand what you're talking about, when the price and ongoing maintenance of HTTPS certificates has gone significantly down for hobbyists.

superkuh 7y ago
>So I don't really understand what you're talking about, That's because you didn't finish reading my post. >Expect to eventually be unable to host a visitable or indexable website without relying on at least one third party service in the near future.
- threeseed 7y ago
  You mean like how it has been for decades ? You have always needed at minimum hosting, SSL and domain service providers.
  - WillPostForFood 7y ago
    You definitely didn’t need, and most sites didn’t use SSL a decade ago.
    - wbl 7y ago
      DNS you always needed.
      - ryandrake 7y ago
        Not strictly necessary, but convenient. All browsers I know of allow you to browse to an IP address.
        guug 7y ago
        This shouldn't be downvoted. I distinctly remember browsing websites by their addresses.
        OJFord 7y ago
        Well, I tried to respond to GP with a tongue in cheek link of an IP address to lmgtfy or Wikipedia on DNS or something, but every site I tried checked the Host header, (I assume) so it didn't work.
      - deleted 7y ago
        [deleted]
      - swiley 7y ago
        1) no. 2) There are multiple organizations running DNS and the general consensus is that there shouldn’t be a single organization running it (except ICANN which is generally careful to delegate the root and TLDs to other organizations.) 3) Just because you have one bad thing doesn’t mean it’s ok to have two.
- mehrdadn 7y ago
  You mean besides the fact that you need an ISP?
xg15 7y ago
> Let's Encrypt [...] Netlify [...] GitHub Pages [...] your hosting provider [...] Cloudflare Those are exactly the kind of third-party services the GP was talking about. > if you're into managing your own server One of the core advantages of having a personal server has always been that you can keep it entirely off the internet and run it without any involvement of third-party services. That is not anymore possible. Like, I now need to purchase a domain name and set up infrastructure to fulfill Let's Encrypt's challanges, just so I can serve a page on my LAN.
- extra88 7y ago
  You can use HTTP instead of HTTPS or you can use a self-signed cert.
  - cutler 7y ago
    Yeah, right - and risk the wrath of your clients when they ask you why their shiny new website can't be accessed because it doesn't implement HTTPS. Face it, folks, the golden age of the internet is long past. Now we have to jump through a bewildering array of "security" hoops just to host a ing web page.
    - extra88 7y ago
      I was replying to someone who was complaining about what to do on "my LAN," no mention was made of clients. HTTPS isn't "security" with sarcasm quotes, it's actual security, it really does what it's supposed to do.
  - xg15 7y ago
    Often, this doesn't even work for small projects: - HTTP have no access to a significant part of web APIs added in the last years - and they will be blocked from all APIs that are being added in the future. - Self-signed certs show security warnings that are deliberately confusion and discouraging to click through and will likely become even more so in the future. Show those to other people is no option.
swiley 7y ago
It’s not the price that’s concerning; it’s having external dependancies.
dublin 7y ago
NO! Two big reasons, among many others: 1) These are unnecessary third-party entanglements, allowing anyone to be slienced within a year simply by refusing to renew their certificates. 2) It's the 21st century, very soon, most servers will not have administrators - smart IoT devices, if we want them to use SSL/TLS, need certificates. If you think updating these certs on regular servers is a PITA, try it on a an embedded device that has very limited or intermittent Internet access, if it's even connected to the public internet at all!

superkuh 7y ago

>So I don't really understand what you're talking about, That's because you didn't finish reading my post. >Expect to eventually be unable to host a visitable or indexable website without relying on at least one third party service in the near future.

threeseed 7y ago
You mean like how it has been for decades ? You have always needed at minimum hosting, SSL and domain service providers.
- WillPostForFood 7y ago
  You definitely didn’t need, and most sites didn’t use SSL a decade ago.
  - wbl 7y ago
    DNS you always needed.
    - ryandrake 7y ago
      Not strictly necessary, but convenient. All browsers I know of allow you to browse to an IP address.
      - guug 7y ago
        This shouldn't be downvoted. I distinctly remember browsing websites by their addresses.
      - OJFord 7y ago
        Well, I tried to respond to GP with a tongue in cheek link of an IP address to lmgtfy or Wikipedia on DNS or something, but every site I tried checked the Host header, (I assume) so it didn't work.
    - deleted 7y ago
      [deleted]
    - swiley 7y ago
      1) no. 2) There are multiple organizations running DNS and the general consensus is that there shouldn’t be a single organization running it (except ICANN which is generally careful to delegate the root and TLDs to other organizations.) 3) Just because you have one bad thing doesn’t mean it’s ok to have two.
mehrdadn 7y ago
You mean besides the fact that you need an ISP?

xg15 7y ago

> Let's Encrypt [...] Netlify [...] GitHub Pages [...] your hosting provider [...] Cloudflare Those are exactly the kind of third-party services the GP was talking about. > if you're into managing your own server One of the core advantages of having a personal server has always been that you can keep it entirely off the internet and run it without any involvement of third-party services. That is not anymore possible. Like, I now need to purchase a domain name and set up infrastructure to fulfill Let's Encrypt's challanges, just so I can serve a page on my LAN.

extra88 7y ago
You can use HTTP instead of HTTPS or you can use a self-signed cert.
- cutler 7y ago
  Yeah, right - and risk the wrath of your clients when they ask you why their shiny new website can't be accessed because it doesn't implement HTTPS. Face it, folks, the golden age of the internet is long past. Now we have to jump through a bewildering array of "security" hoops just to host a ing web page.
  - extra88 7y ago
    I was replying to someone who was complaining about what to do on "my LAN," no mention was made of clients. HTTPS isn't "security" with sarcasm quotes, it's actual security, it really does what it's supposed to do.
- xg15 7y ago
  Often, this doesn't even work for small projects: - HTTP have no access to a significant part of web APIs added in the last years - and they will be blocked from all APIs that are being added in the future. - Self-signed certs show security warnings that are deliberately confusion and discouraging to click through and will likely become even more so in the future. Show those to other people is no option.

swiley 7y ago

It’s not the price that’s concerning; it’s having external dependancies.

dublin 7y ago

NO! Two big reasons, among many others: 1) These are unnecessary third-party entanglements, allowing anyone to be slienced within a year simply by refusing to renew their certificates. 2) It's the 21st century, very soon, most servers will not have administrators - smart IoT devices, if we want them to use SSL/TLS, need certificates. If you think updating these certs on regular servers is a PITA, try it on a an embedded device that has very limited or intermittent Internet access, if it's even connected to the public internet at all!