22 ms·

After 10 years, HTTPS is truly everywhere

67 points by riffic 5y ago

Spivak 5y ago
This is genuinely a huge win for the EFF. While I’m sure haters will point out that the EFF did almost none of the lifting the much much harder problem is coordinating millions of people to focus on a specific goal and the EFF made “HTTPs Everywhere” a thing that got honest to god real mindshare across the whole industry. Coordination problems like this are capital H hard. It’s why almost all boycotts, petitions, union formations, vote with you feet/wallet don’t go anywhere because it’s trying to herd cats. Encrypting the web became an inevitability because of the EFF’s work. So sincerely, amazing job to everyone who worked on the initiative. You crazy fools actually did it!
- BayAreaEscapee 5y ago
  The EFF really makes a contribution to the world way out of size with their budget. The EFF's budget in 2019 was only $10 million dollars. Kudos for them. https://apps.irs.gov/pub/epostcard/cor/043091431_202006_990_2021052018152795.pdf https://apps.irs.gov/pub/epostcard/cor/043091431_202006_990_...
kgeist 5y ago
>2021 was the year the other major browsers followed suit, starting with Chrome introducing an HTTPS default for navigation when a user types in the name of a URL without specifying insecure HTTP or secure HTTPS. Is it enabled on Android? Last week a few links on HN resolved to HTTP for me, even though HTTPS was available for those sites (I checked). I noticed it because my provider injects ads in unencrypted traffic.
- fomine3 5y ago
  It means that when you type "example.com" and go, Chrome tries "https://example.com https://example.com" first then tries "http://example.com http://example.com". Explicit link to "http://example.com http://example.com" is different story.
  - kgeist 5y ago
    That's exactly what I meant: clicking on what appeared to be "example.com" directed me to "http://example.com http://example.com", but maybe those links had explicit "http:// http://" in them indeed, I'm not sure now.
shric 5y ago
The only relatively mainstream site I can think of that doesn't use https is the Australian Bureau of Meteorology [1]. The weather isn't exactly sensitive info but I don't see any excuse not to just set this up. [1] https://www.bom.gov.au/ https://www.bom.gov.au/
- CrimsonRain 5y ago
  I think they should support both and not automatically redirect from http to https. The comment just above you: > Admittedly a small problem, but for microcontrollers that don't support https and just want to get some publically available data like weather-- it is an issue. So lots of hobbiest projects are basically turned off because of this.
vital_beach 5y ago
I guess it's time to uninstall their HTTPS Everywhere extension https://www.eff.org/deeplinks/2021/09/https-actually-everywhere https://www.eff.org/deeplinks/2021/09/https-actually-everywh...
greatgib 5y ago
... and it is an nightmare... The web is centralized as it never was before. We have to constantly (every 3 months) renew letsencrypt certificates. They do breaking changes to the tools and protocols to do that with the same periodicity. Now you need this shitty snap to do that. And private networks devices are still an unsolved problem no one talk about...
- watermelon0 5y ago
  They claim [1] that they won't be making breaking changes to the protocol, unless absolutely necessary. Many web servers/reverse proxies such as Caddy and Traefik have build-in ACME handling, so as long as you keep them up to date, your certificates should be correctly renewed. From my experience, configuration of ACME with either of them is a breeze. I'm not sure why nginx and Apache don't implement this, considering they are the most popular servers. [1] https://letsencrypt.org/docs/acme-protocol-updates/ https://letsencrypt.org/docs/acme-protocol-updates/
  - greatgib 5y ago
    There is no legitimate reason why you would need to keep all your servers updated all the time just because you want to have your cert continuing working. On my case, I was annoyed with an old vps for example because impossible to use docker or snap because you need kernels modules that you don't control in such a setup.
- vital_beach 5y ago
  I've had several instances of ACME bot deciding to randomly fail behind Cloudflare, so I've switched to using CF Origin certs on a few hosts. It's not ideal, but it works for my public needs. I'm still running PiHole locally with no certs, which I dislike.
- glandium 5y ago
  I am not using the official tools, but for the one I'm using, I have had to change something exactly once in several years.
- 5y ago
vital_beach 5y ago
fun fact: even neverssl.com has https now, which it promises to never have lol
watermelon0 5y ago
Safari still cannot connect to a server exposing only 443/https, and apparently tries to reach port 80. Chrome/Firefox support this without an issue.
vladstudio 5y ago
I'm curious, are there any ~~competitors~~ alternatives for Letsencrypt?
- riffic 5y ago
  There was a list of all known ACME servers, but it's now defunct (boo!): https://news.ycombinator.com/from?site=https.dev https://news.ycombinator.com/from?site=https.dev its last snapshot: https://web.archive.org/web/20210126194059/https://docs.https.dev/list-of-acme-servers https://web.archive.org/web/20210126194059/https://docs.http... source: https://github.com/https-dev/docs/blob/master/list-of-acme-servers.md https://github.com/https-dev/docs/blob/master/list-of-acme-s...
- benjojo12 5y ago
  Yes. ZeroSSL.com (Aka Comodo), BuyPass.com, SSL.com All offer 90 days or more free SSL certs
hungryforcodes 5y ago
Admittedly a small problem, but for microcontrollers that don't support https and just want to get some publically available data like weather-- it is an issue. So lots of hobbiest projects are basically turned off because of this.
freyir 5y ago
Almost everywhere [1]. [1] http://www.paulgraham.com/ http://www.paulgraham.com/

67 points by riffic 5y ago

This is genuinely a huge win for the EFF. While I’m sure haters will point out that the EFF did almost none of the lifting the much much harder problem is coordinating millions of people to focus on a specific goal and the EFF made “HTTPs Everywhere” a thing that got honest to god real mindshare across the whole industry. Coordination problems like this are capital H hard. It’s why almost all boycotts, petitions, union formations, vote with you feet/wallet don’t go anywhere because it’s trying to herd cats. Encrypting the web became an inevitability because of the EFF’s work. So sincerely, amazing job to everyone who worked on the initiative. You crazy fools actually did it!

BayAreaEscapee 5y ago
The EFF really makes a contribution to the world way out of size with their budget. The EFF's budget in 2019 was only $10 million dollars. Kudos for them. https://apps.irs.gov/pub/epostcard/cor/043091431_202006_990_2021052018152795.pdf https://apps.irs.gov/pub/epostcard/cor/043091431_202006_990_...

kgeist 5y ago

>2021 was the year the other major browsers followed suit, starting with Chrome introducing an HTTPS default for navigation when a user types in the name of a URL without specifying insecure HTTP or secure HTTPS. Is it enabled on Android? Last week a few links on HN resolved to HTTP for me, even though HTTPS was available for those sites (I checked). I noticed it because my provider injects ads in unencrypted traffic.

fomine3 5y ago
It means that when you type "example.com" and go, Chrome tries "https://example.com https://example.com" first then tries "http://example.com http://example.com". Explicit link to "http://example.com http://example.com" is different story.
- kgeist 5y ago
  That's exactly what I meant: clicking on what appeared to be "example.com" directed me to "http://example.com http://example.com", but maybe those links had explicit "http:// http://" in them indeed, I'm not sure now.

shric 5y ago

The only relatively mainstream site I can think of that doesn't use https is the Australian Bureau of Meteorology [1]. The weather isn't exactly sensitive info but I don't see any excuse not to just set this up. [1] https://www.bom.gov.au/ https://www.bom.gov.au/

CrimsonRain 5y ago
I think they should support both and not automatically redirect from http to https. The comment just above you: > Admittedly a small problem, but for microcontrollers that don't support https and just want to get some publically available data like weather-- it is an issue. So lots of hobbiest projects are basically turned off because of this.

vital_beach 5y ago

I guess it's time to uninstall their HTTPS Everywhere extension https://www.eff.org/deeplinks/2021/09/https-actually-everywhere https://www.eff.org/deeplinks/2021/09/https-actually-everywh...

greatgib 5y ago

... and it is an nightmare... The web is centralized as it never was before. We have to constantly (every 3 months) renew letsencrypt certificates. They do breaking changes to the tools and protocols to do that with the same periodicity. Now you need this shitty snap to do that. And private networks devices are still an unsolved problem no one talk about...

watermelon0 5y ago
They claim [1] that they won't be making breaking changes to the protocol, unless absolutely necessary. Many web servers/reverse proxies such as Caddy and Traefik have build-in ACME handling, so as long as you keep them up to date, your certificates should be correctly renewed. From my experience, configuration of ACME with either of them is a breeze. I'm not sure why nginx and Apache don't implement this, considering they are the most popular servers. [1] https://letsencrypt.org/docs/acme-protocol-updates/ https://letsencrypt.org/docs/acme-protocol-updates/
- greatgib 5y ago
  There is no legitimate reason why you would need to keep all your servers updated all the time just because you want to have your cert continuing working. On my case, I was annoyed with an old vps for example because impossible to use docker or snap because you need kernels modules that you don't control in such a setup.
vital_beach 5y ago
I've had several instances of ACME bot deciding to randomly fail behind Cloudflare, so I've switched to using CF Origin certs on a few hosts. It's not ideal, but it works for my public needs. I'm still running PiHole locally with no certs, which I dislike.
glandium 5y ago
I am not using the official tools, but for the one I'm using, I have had to change something exactly once in several years.
5y ago

vital_beach 5y ago

fun fact: even neverssl.com has https now, which it promises to never have lol

watermelon0 5y ago

Safari still cannot connect to a server exposing only 443/https, and apparently tries to reach port 80. Chrome/Firefox support this without an issue.

vladstudio 5y ago

I'm curious, are there any ~~competitors~~ alternatives for Letsencrypt?

riffic 5y ago
There was a list of all known ACME servers, but it's now defunct (boo!): https://news.ycombinator.com/from?site=https.dev https://news.ycombinator.com/from?site=https.dev its last snapshot: https://web.archive.org/web/20210126194059/https://docs.https.dev/list-of-acme-servers https://web.archive.org/web/20210126194059/https://docs.http... source: https://github.com/https-dev/docs/blob/master/list-of-acme-servers.md https://github.com/https-dev/docs/blob/master/list-of-acme-s...
benjojo12 5y ago
Yes. ZeroSSL.com (Aka Comodo), BuyPass.com, SSL.com All offer 90 days or more free SSL certs

hungryforcodes 5y ago

Admittedly a small problem, but for microcontrollers that don't support https and just want to get some publically available data like weather-- it is an issue. So lots of hobbiest projects are basically turned off because of this.

freyir 5y ago

Almost everywhere [1]. [1] http://www.paulgraham.com/ http://www.paulgraham.com/