4 ms·
I'm throwing a rock into the ocean here with all these comments. But I feel like the entire assumption of the article ie "SSL is expensive + hard". Is it really
by taybenlor 15y ago
I'm throwing a rock into the ocean here with all these comments. But I feel like the entire assumption of the article ie "SSL is expensive + hard". Is it really?
All the big companies are making the change to SSL. Sure it may seem expensive, but how many engineer hours will you throw away on cutting those costs? Will those hours have cost you even more? Further: what is the cost if your engineers' implementation is poor and easily broken?
You spend money on SSL, SSL tech gets cheaper and faster. Rinse, repeat.
Or am I missing something?
- marshray 15y agoUsually it depends on how complex and interdependent your site software has become. How many places do you have to find and fix where "http:" was hard coded? How many existing links and web APIs are going to break if you start returning redirects? How many third-party affiliates and SDK partners are going to be affected by your change? Are you going to discard everyone's existing sessions? How are you going to test all this stuff in advance?
- tptacek 15y agoI wrote the article and I don't think TLS is hard.
- marshray 15y agoI'm not trying to be a twit here, but be fair to the site admins: say that after *.matasano.com works fully under https without any mixed-content warnings. E.g., http://www.matasano.com/ http://www.matasano.com/ sources http://use.typekit.com/zpb4ovg.js http://use.typekit.com/zpb4ovg.js. But there's no https://use.typekit.com https://use.typekit.com. How are you going to fix that? It takes a village.
- tptacek 15y agoJust do be clear: WWW.MATASANO.COM is a static brochure site and we don't do any HTTPS on it at all.