7 ms·

awww crap - I've got loads of low-traffic websites that don't need https[1] that I'm now going to have to spend time sorting out certificates for. To be honest

awww crap - I've got loads of low-traffic websites that don't need https[1] that I'm now going to have to spend time sorting out certificates for. To be honest, it's about time that cert enablement is built into all web server configs (on all OSs) as a native feature instead of having to manually roll the config using this-weeks-currently-preferred letsencrypt script. --- [1] Yes, yes, I know everyone on HN prefers everything to be https, but out in the real world, most people don't care if all they are doing is browsing for information.

abdusco 6y ago
Take a look at Caddy server. Every site is configured for https by default with auto-renewed letsencrypt certificates. It even has an nginx-compatible configuration (but I think you'll like it's own (really simple) config more)
- Jaruzel 6y ago
  I'll check it out - cheers!
glotgizmo 6y ago
I route my domains through cloudflare for this reason. Just makes life easier for my <1k visitors/month sites.
aurbano 6y ago
If you're ok with fronting your sites with Cloudflare you can get "fake" HTTPS by using the flexible option (HTTPS from the client to Cloudflare, and HTTP from them to your server) This satisfies the need to be on HTTPS, without actually having to change anything in your server. Not saying this is ideal, but for websites that don't _need_ it it could be the best/easiest approach.
kevincox 6y ago
It doesn't completely block users from your site. It just makes them extra aware that any middleman will be able to see what they are reading, see anything they send and could possibly modify the traffic. If you are concerned about the power-users who enable this being aware of these facts then maybe you do need https after all. (Of course I suspect this mode will be made the default at some point, but that is probably at least a couple of years off.)
lxgr 6y ago
> about time that cert enablement is built into all web server configs It feels like we're slowly getting there! +1 for Caddy for making HTTPS a surprisingly pleasant process. My home router and NAS also support (and enable) Letsencrypt out of the box, which was a nice surprise.
jorl17 6y ago
The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall and doing it myself. Whoever was accessing simple http websites for the very short end of a stick (metaphorically speaking)
- cat199 6y ago
  there is a middle ground of authenticating traffic without encrypting it - c.f. IPSEC AH mode - granted this type of thing isn't in HTTP but easily could be
  - ric2b 6y ago
    What would be the advantage of that? Saving a few CPU cycles, maybe?
- doublerabbit 6y ago
  > The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code I keep hearing this as a plausible excuse, yet I've never seen any proof of such. non-https does make it possible but has anyone got any source where someone has been victim of such attacks?
  - snazz 6y ago
    ISPs in the US have been doing it for years: https://www.infoworld.com/article/2925839/code-injection-new-low-isps.html https://www.infoworld.com/article/2925839/code-injection-new...
  - ozim 6y ago
    First link, Kazakhstan even tried to MITM people with HTTPS, second injecting ads by ISP. [1]https://www.privateinternetaccess.com/blog/kazakhstan-tries-and-fails-to-mitm-all-of-its-internet-users-with-rogue-certificate-installation/ https://www.privateinternetaccess.com/blog/kazakhstan-tries-... [2]https://security.stackexchange.com/questions/157828/my-isp-bsnl-india-is-injecting-ads-using-phozeca-which-spoils-websites-and-mak https://security.stackexchange.com/questions/157828/my-isp-b...
deleted 6y ago
[deleted]
superkuh 6y ago
This is incredibly bad for the health of the web. In kneejerk response to the invasion of privacy from world governments we're handing absolute control of the web back to those very governments. Everyone being forced to get permission from a centralized cert authority that is easily influenced, pressured, etc in order to host a visitable website is the end of the web as we know it. This is a slide into a total loss of autonomy. I give it about 3 years before all commercial browsers stop allowing you to visit HTTP sites at all and Firefox only allows if you use their unstable beta build. At that point you won't be able to host a visitable website without getting permission from someone else. And that's the end of the personal web.
- ric2b 6y ago
  I think you misunderstand how HTTPS works, there's no central root CS, nothing stops you from adding other trusted root certificate authorities. In fact, your browser trusts a few dozens of different ones, and companies routinely manage their own.
  - superkuh 6y ago
    No, I'm just assuming that you're going to follow through on that thought and realize statistically no one does that for self signed certs except corporations which aren't human persons anyway.
    - ric2b 6y ago
      The point isn't that you can run it yourself, it's that there isn't a central one and there are dozens or hundreds of different options already, based in different countries.
cpeterso 6y ago
Firefox HTTPS-Only Mode is not enabled by default. The mode just shows the user an interstitial warning when navigating to non-HTTPS sites; the user is not blocked from visiting non-HTTPS sites.

abdusco 6y ago

Take a look at Caddy server. Every site is configured for https by default with auto-renewed letsencrypt certificates. It even has an nginx-compatible configuration (but I think you'll like it's own (really simple) config more)

Jaruzel 6y ago
I'll check it out - cheers!

glotgizmo 6y ago

I route my domains through cloudflare for this reason. Just makes life easier for my <1k visitors/month sites.

aurbano 6y ago

If you're ok with fronting your sites with Cloudflare you can get "fake" HTTPS by using the flexible option (HTTPS from the client to Cloudflare, and HTTP from them to your server) This satisfies the need to be on HTTPS, without actually having to change anything in your server. Not saying this is ideal, but for websites that don't _need_ it it could be the best/easiest approach.

kevincox 6y ago

It doesn't completely block users from your site. It just makes them extra aware that any middleman will be able to see what they are reading, see anything they send and could possibly modify the traffic. If you are concerned about the power-users who enable this being aware of these facts then maybe you do need https after all. (Of course I suspect this mode will be made the default at some point, but that is probably at least a couple of years off.)

lxgr 6y ago

> about time that cert enablement is built into all web server configs It feels like we're slowly getting there! +1 for Caddy for making HTTPS a surprisingly pleasant process. My home router and NAS also support (and enable) Letsencrypt out of the box, which was a nice surprise.

jorl17 6y ago

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall and doing it myself. Whoever was accessing simple http websites for the very short end of a stick (metaphorically speaking)

cat199 6y ago
there is a middle ground of authenticating traffic without encrypting it - c.f. IPSEC AH mode - granted this type of thing isn't in HTTP but easily could be
- ric2b 6y ago
  What would be the advantage of that? Saving a few CPU cycles, maybe?
doublerabbit 6y ago
> The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code I keep hearing this as a plausible excuse, yet I've never seen any proof of such. non-https does make it possible but has anyone got any source where someone has been victim of such attacks?
- snazz 6y ago
  ISPs in the US have been doing it for years: https://www.infoworld.com/article/2925839/code-injection-new-low-isps.html https://www.infoworld.com/article/2925839/code-injection-new...
- ozim 6y ago
  First link, Kazakhstan even tried to MITM people with HTTPS, second injecting ads by ISP. [1]https://www.privateinternetaccess.com/blog/kazakhstan-tries-and-fails-to-mitm-all-of-its-internet-users-with-rogue-certificate-installation/ https://www.privateinternetaccess.com/blog/kazakhstan-tries-... [2]https://security.stackexchange.com/questions/157828/my-isp-bsnl-india-is-injecting-ads-using-phozeca-which-spoils-websites-and-mak https://security.stackexchange.com/questions/157828/my-isp-b...

deleted 6y ago

[deleted]

superkuh 6y ago

This is incredibly bad for the health of the web. In kneejerk response to the invasion of privacy from world governments we're handing absolute control of the web back to those very governments. Everyone being forced to get permission from a centralized cert authority that is easily influenced, pressured, etc in order to host a visitable website is the end of the web as we know it. This is a slide into a total loss of autonomy. I give it about 3 years before all commercial browsers stop allowing you to visit HTTP sites at all and Firefox only allows if you use their unstable beta build. At that point you won't be able to host a visitable website without getting permission from someone else. And that's the end of the personal web.

ric2b 6y ago
I think you misunderstand how HTTPS works, there's no central root CS, nothing stops you from adding other trusted root certificate authorities. In fact, your browser trusts a few dozens of different ones, and companies routinely manage their own.
- superkuh 6y ago
  No, I'm just assuming that you're going to follow through on that thought and realize statistically no one does that for self signed certs except corporations which aren't human persons anyway.
  - ric2b 6y ago
    The point isn't that you can run it yourself, it's that there isn't a central one and there are dozens or hundreds of different options already, based in different countries.

cpeterso 6y ago

Firefox HTTPS-Only Mode is not enabled by default. The mode just shows the user an interstitial warning when navigating to non-HTTPS sites; the user is not blocked from visiting non-HTTPS sites.