7 ms·

Why this Website is not, and may never be, HTTPS

55 points by ColinWright 5y ago

davidjgraph 5y ago
Because it's only the correct version of the web site that comprises "HTML, CSS, and JPG". The problem isn't about what the correct version of site contains, it's about what the intercepted version contains. Anyone in the middle can change the web site into anything they like. They could add a "donate link", saying that the author needs money to sustain the site.
- prepend 5y ago
  I don’t think this is not a likely enough situation to affect design. I think the author is stating that it is an acceptable risk, and users shouldn’t care.
  - notafraudster 5y ago
    As I mention in my top-level comment, it seems reasonable to say "I don't really care about surveillance risk of my low traffic blog", but it's a bit incongruous when it's combined with "I care a great deal that Big SSL might be rope-a-doping me and five years from now they'll charge me money for my SSL cert for my low traffic blog, and if you don't like it, it's your problem!" We're talking about a free thing that on one hand takes five minutes to set up and on the other hand provides almost no benefit! It's hard to imagine lower stakes for anyone involved.
    - prepend 5y ago
      My time is very valuable as I need to spend it commenting on HN. 5 minutes every two months isn’t a great amount, but it’s great compared to the benefit to this blogger. I can imagine lower stakes with something that takes zero minutes.
      - AstralStorm 5y ago
        Maintaining your own web server costs more than that. Zero minutes would use an external provider. Otherwise you're opening an unmaintained insecure webserver - a potential bounce for all sorts of illegal activity.
- bjourne 5y ago
  The site happens to have a donate page: http://misc-stuff.terraaeon.com/donate.html http://misc-stuff.terraaeon.com/donate.html From my perspective, it doesn't matter much if that page was added through a MITM attack or not - I neither know nor trust the author of the site and have no inclination of donating money to them.
xjdjfjdjdj 5y ago
Just use Cloudflare and terminate SSL there
- SXX 5y ago
  Author point out that he don't want an extra point of failure and outside control. He already have domain registar and whatever his server require.
  - dbbk 5y ago
    The author is being irrationally precious IMO.
    - duckah 5y ago
      [dead]
  - true_religion 5y ago
    At that point I'd just use a self-signed certificate. Although browsers hate it, it's secure in every way I generally care about.
nicbou 5y ago
tl;dr: I understand the arguments for HTTPS, and I don't care. This is totally reasonable. It's just a hobby blog. There's not much that can go wrong here.
brodo 5y ago
While I can understand the concerns about added complexity, he won‘t be able to keep this up forever. Browsers will deprecate plain HTTP sooner or later.
- prepend 5y ago
  I certainly hope not. Blogs like this will help stop browsers from doing dumb things like deprecating HTTP where appropriate.
  - dinkleberg 5y ago
    I highly doubt that blogs like this will make the slightest impact on those decisions.
    - prepend 5y ago
      There’s this thing called a “long tail” that the Internet was designed to make really large and powerful. If everyone had their own simple blog (or plan file) instead of Facebook/etc, I think the world would be a better place.
- krinchan 5y ago
  Yeah, I empathize but he's really not reading current trends at all if he thinks HTTP is still going to be around in 3 years. I can't wait for the pure hell that is captive WiFi once browsers provide sufficient friction to accessing non-HTTPS sites. Most devices are good enough at popping up the portal but far too often I find myself pulling up http://neverssl.com http://neverssl.com to force things to start working.
  - yholio 5y ago
    It's only a matter of time until captive WiFi networks will force you to install their root certificate or app if you want to use their services.
    - 5y ago
NovemberWhiskey 5y ago
That all just seems strangely perverse. The author objects to outside control, yet is at the mercy of their domain registrar, to whom the same set of problems seems to apply, as well as their hosting provider. If the author objects so much to outside control, they might think on the fact that offering their content unencrypted allows it to be rewritten by ISPs to introduce ads or other content outside their editorial control while still inside the network.
- throwawayay02 5y ago
  I think it is likely he hosts it himself. And it is a stretch to include the domain registrar since the service it provides is only one of addressing and not content.
  - NovemberWhiskey 5y ago
    Unless he's directly peering at an exchange into his own datacenter (I doubt it), then he's not hosting it by himself - he's depending on a provider for connectivity and hosting. I don't see what distinction you're trying make between "addressing" and "content". In either case he would be dependent on a third party (that he may have to pay for their services) to keep his site online. He renews his certificate every two years, or his site effectively goes offline. He renews his domain every two years, or his site effectively goes offline. What's the difference supposed to be?
prepend 5y ago
I like this post as I run a simple, personal blog and don’t care about tls/https (my isp does it for me automagically so it’s less of an issue for me). I get questions about why don’t I require or default to tls and I’ll point those folks to this post to explain my reasons. I don’t like pointless security and, as a developer, get annoyed by many “security” requirements that just seem to increase complexity without any tangible benefits. Yes, there is some benefit, but it’s not much. As the author says, MITM and isp snooping isn’t really applicable to simple web blogs. So who cares about protecting the content. It’s like protecting against Martian attackers. Yes, it’s nice to be safe from Martian attackers but not worth a penny or second of time.
oyagci 5y ago
Troy Hunt gives great argument about why every website needs to be HTTPS: https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs...
- aaomidi 5y ago
  https://doesmysiteneedhttps.com/ https://doesmysiteneedhttps.com/ as well
high_byte 5y ago
great rant, facts stand that people with HTTPS Everywhere never get a glimps. it might not be monetized but what's the point of putting your ideas out there if "out there" has low reachability? also looking from security standpoint, anyone could mitm your website. that's bad for your name.
- prepend 5y ago
  > anyone could mitm your website. Not anyone, just a select few and it’s more likely that the notoriety would be good for your name, not bad. The MITM would be detected and corrected. The odds of a MITM on a self hosted blog are much lower than just normal stuff like the host being rooted.
a254613e 5y ago
> I can only say that if an imposter site encourages you to pay for something or download code, you will immediately know you are in the wrong place. That is such a flawed argument. If someone makes an imposter site, they're not gonna keep that warning there. And first visitors would have never seen the previous warning. Of course the chances of that happening are very low for a website like that, but the argument is still flawed. The whole thing could be summed up "Because I don't want to", all of those other arguments seem weak at best. Which fine, do whatever you want with your blog, but it doesn't change the fact that the arguments brought up are bad under the disguise of being a big reason for not having https.
notafraudster 5y ago
A lot of the complexity the author is worried about is brought on by iconoclastic choices. > Code exists for authomating [sic] [LetsEncrypted renewal certificates], but when I last checked, it did not run on my hardware platform I mean, we're talking about a task scheduler here. *nix and BSD and MacOS have Cron. Windows has a task scheduler. Every cloud platform has a mechanism to schedule tasks. Is this a Temple OS situation? But if minimal complexity is what the author wants, they should consider building a static site and deploying it, say, using GitHub Pages, which supports SSL out of the box right now. > Lastly, as the operator of a personal website, I object to any outside control. I run my own website on my own server for exactly this reason. So then let's dispense with the notion that HTTPS is adding complexity and get back to the actual point here: potentially well justified neuroticism about having everything under your control is leading to additional complexity. That's fine. Just own it. The whole thing boils down to "I don't want to do HTTPS and I don't want to let someone else do it for me because I don't want to and that's what I want". You do you, dude. > A TLS certificate is issued by an organization that is not controlled by website owners, website developers, or users of the Internet. That means any time the issuer wants to raise requirements or fees for issuing TLS certificates, he is free to do so. Turn off your certificate when that happens? Unless you do pinning or HSTS you have no obligation to use HTTPS in perpetuity just because you use it now. If it was someone who wasn't familiar with system administration I'd appreciate that maybe they don't know how to set up their webserver as such, but given that this is a person who's chosen to run their own. I'm actually not really sure why even this parade of horribles would be coherent. The author has a custom domain for which they pay a registrar. If the registrar raised it prices, he would have to migrate to another registrar or allow the domain to deregister or pay the additional fee. Everything on this earth is transient, it's OK, be at peace. If anything I'd be more interested in a parallel blog post that says "Why I ran my own domain registrar rather than give someone else $10 USD a year for a custom domain" -- that'd actually be the kind of adorable crankery I love to see. I do get wanting to internalize the locus of control as much as possible, but at some point -- running your own email, running your own domain registrar, issuing your own SSL cert -- the level of complexity leaps up to the point that almost no one does. Which is totally fair! But also not a big deal! It's OK to use external services. Oddly I actually agree with the author about the underlying point that HTTPS is not really in a cosmic sense necessary for every little domain, but because it's trivial to implement and free -- even notwithstanding engaging any of the ideas about privacy and surveillance that militate towards HTTPS -- I don't understand the objection.
jamespwilliams 5y ago
Okay, sure, if you don't care about the visitors to your site, don't bother with HTTPS. Personally, I don't want visitors to my site having adverts injected by their ISPs or public wifi networks they're connected to. I don't want to needlessly expose my visitors to having malicious JS being run on their machines. I don't want a MITM to be able to change the text that a visitor receives on my website, and make the reader believe that I said something I didn't say. Especially when the fix for all of this is incredibly simple and introduces only a miniscule overhead. https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs...
- timw4mail 5y ago
  I don't want to require an up-to-date computing device to visit my website. I have HTTPS (with modern ciphers and protocols) for my website, but I also serve it as HTTP. I really do appreciate the advantages of HTTPS, but I have issue with the time-bombed nature of the technology: website certificates, root certificates, and ciphers that become less secure. I do not like that old devices can essentially no longer use the web due to HTTPS.
ribit 5y ago
I don't disagree with the author, but I'd like to point out that he literally has a donate link in the bottom.
deleted 5y ago
[deleted]
thih9 5y ago
> If some users are afraid of a possible man-in-the-middle attack, I can only say that if an imposter site encourages you to pay for something or download code, you will immediately know you are in the wrong place. There is a donation page that seems to contradict the above: http://misc-stuff.terraaeon.com/donate.html http://misc-stuff.terraaeon.com/donate.html .
- wgj 5y ago
  It links to a bitcoin public key. I know literally nothing about bitcoin. Can a key like that be verified before using it? Or you just trust you have the right key?
  - nerdponx 5y ago
    There's no way to verify the address. I suppose you could encrypt the address with PGP or something.
  - georgyo 5y ago
    Entirely trust.
  - scoopertrooper 5y ago
    Not really. Though this guy has received a grand total of $19.52 dollars from one single transaction, so I think it's fair to say this problem is a bit of a edge case. https://www.blockchain.com/btc/address/1DsNqMZHhU54WJdSXeAa5K7EL8PNZP9Gii https://www.blockchain.com/btc/address/1DsNqMZHhU54WJdSXeAa5...
    - thih9 5y ago
      Edge case or not, it shows that the need for secure connections can suddenly appear in unexpected places. It might not matter there and then. But in a couple of years that website might become more profitable, or might grow and include more content that is dangerous when insecure.
- aaomidi 5y ago
axiosgunnar 5y ago
Is this a case of „I have nothing to hide“ by somebody who should know better?
jawns 5y ago
One common mistake in reasoning I see is overestimating how independent we really are. The author enjoys the feeling of independence, but at least some of it is illusory. It seems a little strange to me to draw a line in the sand about something like Let's Encrypt when, try as he might, he's not going to ever be able to enjoy complete independence, especially not on the web.
SimeVidas 5y ago
> I can only say that if an imposter site encourages you to pay for something or download code, you will immediately know you are in the wrong place. I actually laughed out loud (it was a dry laugh, I just woke up).
ibrahimcesar 5y ago
Stong language indeed.
kissgyorgy 5y ago
All of his arguments are false or bullshit, please educate yourself about why. I'm too tired to elaborate false presumptions that has been debunked years ago, but here are some articles: https://www.makeuseof.com/tag/https-ssl-certificate-myths/ https://www.makeuseof.com/tag/https-ssl-certificate-myths/ https://aboutssl.org/debunking-https-and-ssl-security-myths/ https://aboutssl.org/debunking-https-and-ssl-security-myths/ Also there was a website which explained everything mentioned in this article, but I can't find it anymore.
- kissgyorgy 5y ago
  I found it: https://istlsfastyet.com/ https://istlsfastyet.com/ You should not care about TLS performance anymore!
proxysna 5y ago
Sounds like a set of excuses tbh. I am running an ancient Solaris VM in internal network, and still have HTTPS for services, without any issues/added complexity. Unless you call a single cronjob that.
bjt2n3904 5y ago
People have made a reasonable rebuttal to the article here... But there's a double edge to the HTTPS sword that I don't think is being discussed. Automating things with cron is the weak and easy argument to defeat. There's a much harder one he's hinting at though. The year is 2040. HTTPS is by and large well adopted, and certificate authorities have waned under the power of let's encrypt. Firefox and Chrome have progressed from showing a warning, to refusing to load sites that are insecure, much like how expired certificates are handled today. However, the government has adopted control over much of the internet. Facebook is now run by the federal government, and most online interaction requires a government photo ID. Further more, comments you made in the past have damaged your social credit score, and Let's Encrypt will no longer issue you certificates, and traffic to your static blog has dramatically dropped to near zero. Not to mention, the hit your site takes in page rank for not offering https any more. There's a million things that can be said about how to operate in such a world -- and by and large it seems we're headed that way. But this fact remains: certificate authorities are a centralized power that the public can't control. And that means you're at their mercy.
wayneftw 5y ago
> Lastly, as the operator of a personal website, I object to any outside control. And that’s exactly what you lose when somebody’s ISP injects JavaScript into your page since you have no SSL.
akagusu 5y ago
Best post ever. It's rare these days to see people challenging the status quo for whatever reason they have.
duckah 5y ago
[dead]
LinAGKar 5y ago
> You would not expect This is a mother**ing website (Caution: stong language) to be an HTTPS website, so why would you expect the Miscellaneous Stuff website to be? But motherfuckingwebsite.com does have HTTPS.

55 points by ColinWright 5y ago

Because it's only the correct version of the web site that comprises "HTML, CSS, and JPG". The problem isn't about what the correct version of site contains, it's about what the intercepted version contains. Anyone in the middle can change the web site into anything they like. They could add a "donate link", saying that the author needs money to sustain the site.

prepend 5y ago
I don’t think this is not a likely enough situation to affect design. I think the author is stating that it is an acceptable risk, and users shouldn’t care.
- notafraudster 5y ago
  As I mention in my top-level comment, it seems reasonable to say "I don't really care about surveillance risk of my low traffic blog", but it's a bit incongruous when it's combined with "I care a great deal that Big SSL might be rope-a-doping me and five years from now they'll charge me money for my SSL cert for my low traffic blog, and if you don't like it, it's your problem!" We're talking about a free thing that on one hand takes five minutes to set up and on the other hand provides almost no benefit! It's hard to imagine lower stakes for anyone involved.
  - prepend 5y ago
    My time is very valuable as I need to spend it commenting on HN. 5 minutes every two months isn’t a great amount, but it’s great compared to the benefit to this blogger. I can imagine lower stakes with something that takes zero minutes.
    - AstralStorm 5y ago
      Maintaining your own web server costs more than that. Zero minutes would use an external provider. Otherwise you're opening an unmaintained insecure webserver - a potential bounce for all sorts of illegal activity.
bjourne 5y ago
The site happens to have a donate page: http://misc-stuff.terraaeon.com/donate.html http://misc-stuff.terraaeon.com/donate.html From my perspective, it doesn't matter much if that page was added through a MITM attack or not - I neither know nor trust the author of the site and have no inclination of donating money to them.

xjdjfjdjdj 5y ago

Just use Cloudflare and terminate SSL there

SXX 5y ago
Author point out that he don't want an extra point of failure and outside control. He already have domain registar and whatever his server require.
- dbbk 5y ago
  The author is being irrationally precious IMO.
  - duckah 5y ago
    [dead]
- true_religion 5y ago
  At that point I'd just use a self-signed certificate. Although browsers hate it, it's secure in every way I generally care about.

nicbou 5y ago

tl;dr: I understand the arguments for HTTPS, and I don't care. This is totally reasonable. It's just a hobby blog. There's not much that can go wrong here.

brodo 5y ago

While I can understand the concerns about added complexity, he won‘t be able to keep this up forever. Browsers will deprecate plain HTTP sooner or later.

prepend 5y ago
I certainly hope not. Blogs like this will help stop browsers from doing dumb things like deprecating HTTP where appropriate.
- dinkleberg 5y ago
  I highly doubt that blogs like this will make the slightest impact on those decisions.
  - prepend 5y ago
    There’s this thing called a “long tail” that the Internet was designed to make really large and powerful. If everyone had their own simple blog (or plan file) instead of Facebook/etc, I think the world would be a better place.
krinchan 5y ago
Yeah, I empathize but he's really not reading current trends at all if he thinks HTTP is still going to be around in 3 years. I can't wait for the pure hell that is captive WiFi once browsers provide sufficient friction to accessing non-HTTPS sites. Most devices are good enough at popping up the portal but far too often I find myself pulling up http://neverssl.com http://neverssl.com to force things to start working.
- yholio 5y ago
  It's only a matter of time until captive WiFi networks will force you to install their root certificate or app if you want to use their services.
  - 5y ago

NovemberWhiskey 5y ago

That all just seems strangely perverse. The author objects to outside control, yet is at the mercy of their domain registrar, to whom the same set of problems seems to apply, as well as their hosting provider. If the author objects so much to outside control, they might think on the fact that offering their content unencrypted allows it to be rewritten by ISPs to introduce ads or other content outside their editorial control while still inside the network.

throwawayay02 5y ago
I think it is likely he hosts it himself. And it is a stretch to include the domain registrar since the service it provides is only one of addressing and not content.
- NovemberWhiskey 5y ago
  Unless he's directly peering at an exchange into his own datacenter (I doubt it), then he's not hosting it by himself - he's depending on a provider for connectivity and hosting. I don't see what distinction you're trying make between "addressing" and "content". In either case he would be dependent on a third party (that he may have to pay for their services) to keep his site online. He renews his certificate every two years, or his site effectively goes offline. He renews his domain every two years, or his site effectively goes offline. What's the difference supposed to be?

prepend 5y ago

I like this post as I run a simple, personal blog and don’t care about tls/https (my isp does it for me automagically so it’s less of an issue for me). I get questions about why don’t I require or default to tls and I’ll point those folks to this post to explain my reasons. I don’t like pointless security and, as a developer, get annoyed by many “security” requirements that just seem to increase complexity without any tangible benefits. Yes, there is some benefit, but it’s not much. As the author says, MITM and isp snooping isn’t really applicable to simple web blogs. So who cares about protecting the content. It’s like protecting against Martian attackers. Yes, it’s nice to be safe from Martian attackers but not worth a penny or second of time.

oyagci 5y ago

Troy Hunt gives great argument about why every website needs to be HTTPS: https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs...

aaomidi 5y ago
https://doesmysiteneedhttps.com/ https://doesmysiteneedhttps.com/ as well

high_byte 5y ago

great rant, facts stand that people with HTTPS Everywhere never get a glimps. it might not be monetized but what's the point of putting your ideas out there if "out there" has low reachability? also looking from security standpoint, anyone could mitm your website. that's bad for your name.

prepend 5y ago
> anyone could mitm your website. Not anyone, just a select few and it’s more likely that the notoriety would be good for your name, not bad. The MITM would be detected and corrected. The odds of a MITM on a self hosted blog are much lower than just normal stuff like the host being rooted.

a254613e 5y ago

> I can only say that if an imposter site encourages you to pay for something or download code, you will immediately know you are in the wrong place. That is such a flawed argument. If someone makes an imposter site, they're not gonna keep that warning there. And first visitors would have never seen the previous warning. Of course the chances of that happening are very low for a website like that, but the argument is still flawed. The whole thing could be summed up "Because I don't want to", all of those other arguments seem weak at best. Which fine, do whatever you want with your blog, but it doesn't change the fact that the arguments brought up are bad under the disguise of being a big reason for not having https.

notafraudster 5y ago

A lot of the complexity the author is worried about is brought on by iconoclastic choices. > Code exists for authomating [sic] [LetsEncrypted renewal certificates], but when I last checked, it did not run on my hardware platform I mean, we're talking about a task scheduler here. *nix and BSD and MacOS have Cron. Windows has a task scheduler. Every cloud platform has a mechanism to schedule tasks. Is this a Temple OS situation? But if minimal complexity is what the author wants, they should consider building a static site and deploying it, say, using GitHub Pages, which supports SSL out of the box right now. > Lastly, as the operator of a personal website, I object to any outside control. I run my own website on my own server for exactly this reason. So then let's dispense with the notion that HTTPS is adding complexity and get back to the actual point here: potentially well justified neuroticism about having everything under your control is leading to additional complexity. That's fine. Just own it. The whole thing boils down to "I don't want to do HTTPS and I don't want to let someone else do it for me because I don't want to and that's what I want". You do you, dude. > A TLS certificate is issued by an organization that is not controlled by website owners, website developers, or users of the Internet. That means any time the issuer wants to raise requirements or fees for issuing TLS certificates, he is free to do so. Turn off your certificate when that happens? Unless you do pinning or HSTS you have no obligation to use HTTPS in perpetuity just because you use it now. If it was someone who wasn't familiar with system administration I'd appreciate that maybe they don't know how to set up their webserver as such, but given that this is a person who's chosen to run their own. I'm actually not really sure why even this parade of horribles would be coherent. The author has a custom domain for which they pay a registrar. If the registrar raised it prices, he would have to migrate to another registrar or allow the domain to deregister or pay the additional fee. Everything on this earth is transient, it's OK, be at peace. If anything I'd be more interested in a parallel blog post that says "Why I ran my own domain registrar rather than give someone else $10 USD a year for a custom domain" -- that'd actually be the kind of adorable crankery I love to see. I do get wanting to internalize the locus of control as much as possible, but at some point -- running your own email, running your own domain registrar, issuing your own SSL cert -- the level of complexity leaps up to the point that almost no one does. Which is totally fair! But also not a big deal! It's OK to use external services. Oddly I actually agree with the author about the underlying point that HTTPS is not really in a cosmic sense necessary for every little domain, but because it's trivial to implement and free -- even notwithstanding engaging any of the ideas about privacy and surveillance that militate towards HTTPS -- I don't understand the objection.

jamespwilliams 5y ago

Okay, sure, if you don't care about the visitors to your site, don't bother with HTTPS. Personally, I don't want visitors to my site having adverts injected by their ISPs or public wifi networks they're connected to. I don't want to needlessly expose my visitors to having malicious JS being run on their machines. I don't want a MITM to be able to change the text that a visitor receives on my website, and make the reader believe that I said something I didn't say. Especially when the fix for all of this is incredibly simple and introduces only a miniscule overhead. https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs...

timw4mail 5y ago
I don't want to require an up-to-date computing device to visit my website. I have HTTPS (with modern ciphers and protocols) for my website, but I also serve it as HTTP. I really do appreciate the advantages of HTTPS, but I have issue with the time-bombed nature of the technology: website certificates, root certificates, and ciphers that become less secure. I do not like that old devices can essentially no longer use the web due to HTTPS.

ribit 5y ago

I don't disagree with the author, but I'd like to point out that he literally has a donate link in the bottom.

deleted 5y ago

[deleted]

thih9 5y ago

> If some users are afraid of a possible man-in-the-middle attack, I can only say that if an imposter site encourages you to pay for something or download code, you will immediately know you are in the wrong place. There is a donation page that seems to contradict the above: http://misc-stuff.terraaeon.com/donate.html http://misc-stuff.terraaeon.com/donate.html .

wgj 5y ago
It links to a bitcoin public key. I know literally nothing about bitcoin. Can a key like that be verified before using it? Or you just trust you have the right key?
- nerdponx 5y ago
  There's no way to verify the address. I suppose you could encrypt the address with PGP or something.
- georgyo 5y ago
  Entirely trust.
- scoopertrooper 5y ago
  Not really. Though this guy has received a grand total of $19.52 dollars from one single transaction, so I think it's fair to say this problem is a bit of a edge case. https://www.blockchain.com/btc/address/1DsNqMZHhU54WJdSXeAa5K7EL8PNZP9Gii https://www.blockchain.com/btc/address/1DsNqMZHhU54WJdSXeAa5...
  - thih9 5y ago
    Edge case or not, it shows that the need for secure connections can suddenly appear in unexpected places. It might not matter there and then. But in a couple of years that website might become more profitable, or might grow and include more content that is dangerous when insecure.
aaomidi 5y ago

axiosgunnar 5y ago

Is this a case of „I have nothing to hide“ by somebody who should know better?

jawns 5y ago

One common mistake in reasoning I see is overestimating how independent we really are. The author enjoys the feeling of independence, but at least some of it is illusory. It seems a little strange to me to draw a line in the sand about something like Let's Encrypt when, try as he might, he's not going to ever be able to enjoy complete independence, especially not on the web.

SimeVidas 5y ago

> I can only say that if an imposter site encourages you to pay for something or download code, you will immediately know you are in the wrong place. I actually laughed out loud (it was a dry laugh, I just woke up).

ibrahimcesar 5y ago

Stong language indeed.

kissgyorgy 5y ago

All of his arguments are false or bullshit, please educate yourself about why. I'm too tired to elaborate false presumptions that has been debunked years ago, but here are some articles: https://www.makeuseof.com/tag/https-ssl-certificate-myths/ https://www.makeuseof.com/tag/https-ssl-certificate-myths/ https://aboutssl.org/debunking-https-and-ssl-security-myths/ https://aboutssl.org/debunking-https-and-ssl-security-myths/ Also there was a website which explained everything mentioned in this article, but I can't find it anymore.

kissgyorgy 5y ago
I found it: https://istlsfastyet.com/ https://istlsfastyet.com/ You should not care about TLS performance anymore!

proxysna 5y ago

Sounds like a set of excuses tbh. I am running an ancient Solaris VM in internal network, and still have HTTPS for services, without any issues/added complexity. Unless you call a single cronjob that.

bjt2n3904 5y ago

People have made a reasonable rebuttal to the article here... But there's a double edge to the HTTPS sword that I don't think is being discussed. Automating things with cron is the weak and easy argument to defeat. There's a much harder one he's hinting at though. The year is 2040. HTTPS is by and large well adopted, and certificate authorities have waned under the power of let's encrypt. Firefox and Chrome have progressed from showing a warning, to refusing to load sites that are insecure, much like how expired certificates are handled today. However, the government has adopted control over much of the internet. Facebook is now run by the federal government, and most online interaction requires a government photo ID. Further more, comments you made in the past have damaged your social credit score, and Let's Encrypt will no longer issue you certificates, and traffic to your static blog has dramatically dropped to near zero. Not to mention, the hit your site takes in page rank for not offering https any more. There's a million things that can be said about how to operate in such a world -- and by and large it seems we're headed that way. But this fact remains: certificate authorities are a centralized power that the public can't control. And that means you're at their mercy.

wayneftw 5y ago

> Lastly, as the operator of a personal website, I object to any outside control. And that’s exactly what you lose when somebody’s ISP injects JavaScript into your page since you have no SSL.

akagusu 5y ago

Best post ever. It's rare these days to see people challenging the status quo for whatever reason they have.

duckah 5y ago

[dead]

LinAGKar 5y ago

> You would not expect This is a mother**ing website (Caution: stong language) to be an HTTPS website, so why would you expect the Miscellaneous Stuff website to be? But motherfuckingwebsite.com does have HTTPS.