3 ms·

Deprecating unencrypted HTTP is a big systemic improvement even though some individual sites may not benefit much. It's a network effect. (What's the money grab

Deprecating unencrypted HTTP is a big systemic improvement even though some individual sites may not benefit much. It's a network effect. (What's the money grab given free let's encrypt certs?)

winternett 5y ago
Lets encrypt from what I understand require time consuming updates every few months. My host provider also does not allow me to install them manually, further complicating the process, and conveniently they sell certs for $125 a year... Per site. It's been a thorn in my side because we're too big to easily move now.
- fulafel 5y ago
  You are absolutely not meant to do the updates manually.
  - winternett 5y ago
    On one ISP that I host sites on, they restrict cert installs and don't allow SSH access. It's done in order to sell their cert services. I have too many sites on there to move easily... It's complicated. Eventually I'll bite the bullet and move to a new host. :/
    - fulafel 5y ago
      Sorry about your service provider failing at their job and squeezing you for $$ cert services! But I'm not nearly convinced this is big enough to stop encrypting the web.
switch007 5y ago
Setting up, monitoring and maintaining LE isn't free
- shadowgovt 5y ago
  But monitoring and maintenance are things someone needs to do if they operate a site, period.
  - winternett 5y ago
    But if you're independently running, paying for, and managing multiple sites, it's a HUGE burden. It also kills innovation for independent devs and startups, and dramatically raises the cost/investment threshold for this kind of innovation. Pricing on cert services is also far too high when everyone's concern and agreement should be security as a basis for operations. It's not something that should be an upcharge or income opportunity. You buy a door lock for your home once, and it works as long as you don't compromise the key. If you buy a house, door locks are expected to come with the house in most circumstances.
    - shadowgovt 5y ago
      And, indeed, if you build your site via a service provider or platform, an SSL solution is usually provided. Building a site from scratch in this day and age is a lot more analogous to building your house from scratch. Nobody to blame but yourself if you buy substandard locks and thieves get in. Only here the metaphor breaks down, because if you aren't encrypting your HTTP traffic and it is intercepted, it's your users who suffer, not the site owner. I, too, pine for the days of simpler internet. But that was a function of the user base, not the technology. It was always insecure... it simply hadn't been exploited yet. Now that it has, and is, site administrators owe it to users to secure their connections.
    - fulafel 5y ago
      Setting up certbot is easy, not a big burden for indie devs. Or if you want to know nothing about tls & certs, just get hosting that comes with tls.
      - winternett 5y ago
        I wasn't writing to the update process, as much as the original installation of a cert. On a house you own, you can change locks and keys any time you want to keep security up to date (for example). no house in "move in ready condition" comes without sufficiently keyed door locks of some kind (on day1).

Deprecating unencrypted HTTP is a big systemic improvement even though some individual sites may not benefit much. It's a network effect. (What's the money grab given free let's encrypt certs?)

winternett 5y ago

Lets encrypt from what I understand require time consuming updates every few months. My host provider also does not allow me to install them manually, further complicating the process, and conveniently they sell certs for $125 a year... Per site. It's been a thorn in my side because we're too big to easily move now.

fulafel 5y ago
You are absolutely not meant to do the updates manually.
- winternett 5y ago
  On one ISP that I host sites on, they restrict cert installs and don't allow SSH access. It's done in order to sell their cert services. I have too many sites on there to move easily... It's complicated. Eventually I'll bite the bullet and move to a new host. :/
  - fulafel 5y ago
    Sorry about your service provider failing at their job and squeezing you for $$ cert services! But I'm not nearly convinced this is big enough to stop encrypting the web.

switch007 5y ago

Setting up, monitoring and maintaining LE isn't free

shadowgovt 5y ago
But monitoring and maintenance are things someone needs to do if they operate a site, period.
- winternett 5y ago
  But if you're independently running, paying for, and managing multiple sites, it's a HUGE burden. It also kills innovation for independent devs and startups, and dramatically raises the cost/investment threshold for this kind of innovation. Pricing on cert services is also far too high when everyone's concern and agreement should be security as a basis for operations. It's not something that should be an upcharge or income opportunity. You buy a door lock for your home once, and it works as long as you don't compromise the key. If you buy a house, door locks are expected to come with the house in most circumstances.
  - shadowgovt 5y ago
    And, indeed, if you build your site via a service provider or platform, an SSL solution is usually provided. Building a site from scratch in this day and age is a lot more analogous to building your house from scratch. Nobody to blame but yourself if you buy substandard locks and thieves get in. Only here the metaphor breaks down, because if you aren't encrypting your HTTP traffic and it is intercepted, it's your users who suffer, not the site owner. I, too, pine for the days of simpler internet. But that was a function of the user base, not the technology. It was always insecure... it simply hadn't been exploited yet. Now that it has, and is, site administrators owe it to users to secure their connections.
  - fulafel 5y ago
    Setting up certbot is easy, not a big burden for indie devs. Or if you want to know nothing about tls & certs, just get hosting that comes with tls.
    - winternett 5y ago
      I wasn't writing to the update process, as much as the original installation of a cert. On a house you own, you can change locks and keys any time you want to keep security up to date (for example). no house in "move in ready condition" comes without sufficiently keyed door locks of some kind (on day1).