3 ms·

My website is http only, and I have no intention of adding https. The content is pure html/css with 100% locally hosted binray content, and adding encryption ga

My website is http only, and I have no intention of adding https. The content is pure html/css with 100% locally hosted binray content, and adding encryption gains very little for either me or my visitors, and allows it to be viewed by anyone regardless of what browser they are using, or even if they aren't using a browser and just telnet straight in. It is also not reliant on having permission from a 3rd party to exist, and is fully self contained. Furthermore, because it is self hosted there are several physical machines at different locations which serve as backups and are selected by updating the DNS records, which I believe is incompatible with a basic lets encrypt system. I understand the drive to push out https for interactive sites, because it is genuinely a bad idea to require users to submit their login credentials over plaintext, and it is possible there are other snooping risks and whatnot, but I really do not see the need for https on many of the simple static sites like mine that make it to hn. The only compelling argument I have seen to force encryption onto everyone is because of ISPs attacking users, but I am solidly in the camp that if you believe your ISP is attacking you you need to use a VPN for all of your traffic, because injecting ads is the least of your worries at that point.

Retric 6y ago
One reason to push HTTPS is ISP’s have been inserting advertising into HTTP sites. There are plenty of others, but when available it’s definitely better for aggregators like HN to use HTTPS.
logicalmonster 6y ago
My general opinion is that much of the web probably doesn’t need to use secure connections via https, especially if a site isn’t interactive in the slightest, but there’s one major benefit. With a secure connection you can have some reasonable assurance that visitors are reading something that wasn’t altered by any nefarious agents (your cable company, your government, criminals, etc). You could be trying to blog pictures of something innocent like your cat and garden, but if a nefarious actor wanted to, they could intercept the request and serve say terrorism instructions and hypothetically get you in trouble.
- vbrandl 6y ago
  Also any MITM can inject JS code that will be executed in the users browser.
aloknnikhil 6y ago
https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs... - MITM attacks - Ad/message injection - Malware injection - Censorship > Furthermore, because it is self hosted there are several physical machines at different locations which serve as backups and are selected by updating the DNS records, which I believe is incompatible with a basic lets encrypt system. Sure. But it's not that much more harder to do it. Use something like the caddy server and have it manage certificate deployment for you. Unless there's a client that you intend to serve that absolutely cannot handle SSL/TLS, I cannot see a reason why you'd want to stick with HTTP. And no, I don't consider IE6 as a valid excuse. You can always use an older version of Firefox on Windows 2k and it'll solve this problem. I honestly don't think I can trade all the above for more compatibility with ancient machines. > but I am solidly in the camp that if you believe your ISP is attacking you you need to use a VPN for all of your traffic, because injecting ads is the least of your worries at that point. I don't understand this. If your resistance to switch is to make it easy for anyone with any browser to use your web page, then expecting them to use a VPN because they have a terrible ISP because you refuse to use HTTPS makes their life more difficult. Surely, they don't see this problem with other websites that use HTTPS but now need to go get a VPN service just to use yours. Also, we're assuming VPNs are absolute saints here. Not really true. But even if it were true, a VPN is eventually someone else's ISP. You're hoping nothing and absolutely nothing in the routing topology will ever look at your data or bother to inject into it.
- surround 6y ago
  And how about some privacy? Although HTTPS doesn’t hide the host, it does hide the path.
oefrha 6y ago
> Furthermore, because it is self hosted there are several physical machines at different locations which serve as backups and are selected by updating the DNS records, which I believe is incompatible with a basic lets encrypt system. There’s nothing incompatible. You just request and update certs on each machine separately, with certbot. No caddy or whatever new hotness of the year required.

Retric 6y ago

One reason to push HTTPS is ISP’s have been inserting advertising into HTTP sites. There are plenty of others, but when available it’s definitely better for aggregators like HN to use HTTPS.

logicalmonster 6y ago

My general opinion is that much of the web probably doesn’t need to use secure connections via https, especially if a site isn’t interactive in the slightest, but there’s one major benefit. With a secure connection you can have some reasonable assurance that visitors are reading something that wasn’t altered by any nefarious agents (your cable company, your government, criminals, etc). You could be trying to blog pictures of something innocent like your cat and garden, but if a nefarious actor wanted to, they could intercept the request and serve say terrorism instructions and hypothetically get you in trouble.

vbrandl 6y ago
Also any MITM can inject JS code that will be executed in the users browser.

aloknnikhil 6y ago

https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs... - MITM attacks - Ad/message injection - Malware injection - Censorship > Furthermore, because it is self hosted there are several physical machines at different locations which serve as backups and are selected by updating the DNS records, which I believe is incompatible with a basic lets encrypt system. Sure. But it's not that much more harder to do it. Use something like the caddy server and have it manage certificate deployment for you. Unless there's a client that you intend to serve that absolutely cannot handle SSL/TLS, I cannot see a reason why you'd want to stick with HTTP. And no, I don't consider IE6 as a valid excuse. You can always use an older version of Firefox on Windows 2k and it'll solve this problem. I honestly don't think I can trade all the above for more compatibility with ancient machines. > but I am solidly in the camp that if you believe your ISP is attacking you you need to use a VPN for all of your traffic, because injecting ads is the least of your worries at that point. I don't understand this. If your resistance to switch is to make it easy for anyone with any browser to use your web page, then expecting them to use a VPN because they have a terrible ISP because you refuse to use HTTPS makes their life more difficult. Surely, they don't see this problem with other websites that use HTTPS but now need to go get a VPN service just to use yours. Also, we're assuming VPNs are absolute saints here. Not really true. But even if it were true, a VPN is eventually someone else's ISP. You're hoping nothing and absolutely nothing in the routing topology will ever look at your data or bother to inject into it.

surround 6y ago
And how about some privacy? Although HTTPS doesn’t hide the host, it does hide the path.

oefrha 6y ago

> Furthermore, because it is self hosted there are several physical machines at different locations which serve as backups and are selected by updating the DNS records, which I believe is incompatible with a basic lets encrypt system. There’s nothing incompatible. You just request and update certs on each machine separately, with certbot. No caddy or whatever new hotness of the year required.