25 ms·

I must announce the immediate end of service of SSLPing

641 points by WelcomeShorty 5y ago

DesktopECHO 5y ago
https://sslping.com/ https://sslping.com/ This site can’t provide a secure connection sslping.com sent an invalid response. ERR_SSL_PROTOCOL_ERROR /Ironic
- spzb 5y ago
  Works for me, FWIW
- silverfox17 5y ago
  Did you ever update your root certificates after some of the LetsEncrypt certificates expired in September?
6510 5y ago
Everything improved until nothing worked anymore.
rmw24 4y ago
Respect to Chris for not only keeping it going for so long, but closing things with an explanation instead of just vanishing like most services. I know that pain of debugging a Docker swarm, and it's not fun!
- weddpros 4y ago
  Thank you man! I'm Chris, the creator of SSLPing, and this goes straight to my heart
dan1234 5y ago
What features did SSLPing have that forced it to rely so heavily on old versions of OpenSSL?
- fxtentacle 5y ago
  It's also blocked by AdGuard.
  - lapser 5y ago
    Yeah I was trying to figure out what was going on here. Is it blocked cos it's closing or was it blocked from before?
- capableweb 5y ago
  From https://web.archive.org/web/20220328120435/https://sslping.com/ https://web.archive.org/web/20220328120435/https://sslping.c... > SSLPing needs less than 5 seconds to check your server and tell you what's wrong with your SSL/TLS security. So I guess it used OpenSSL to figure out what was wrong with people's certificates. Not sure what it used that relied on internals so heavily it was hard to upgrade, or if the public interface just changed a lot. Even with that, seems there was multiple issues that "prevented" ("made it harder than justifiable" rather) the author from keeping the project up, not just regarding OpenSSL.
  - dan1234 5y ago
    Ah ok, so it sounds like an automated (though probably cutdown) version of the SSLLabs server test.
    - WelcomeShorty 5y ago
      It does a little more and little less. More: Enter a list of (sub-) domains and get informed via email when "SSL things" change (for better or for worst), or your https certificate is about to expire. Less: No fancy pansy "report" Personally I prefer https://hardenize.com https://hardenize.com nowadays, over ssllabs for these kind of queries.
      - dan1234 5y ago
        https://hardenize.com https://hardenize.com is quite pretty, but there's nowhere near $999/mo of value in it for me!
gjs278 5y ago
arciini 5y ago
This seems like a perfectly reasonable way to end a service. The server died, and the effort to bring it back up seems high. This is a reminder to pay for services you depend on. Per the Pinboard founder's post: > I love free software and could not have built my site without it. But free web services are not like free software. If your free software project suddenly gets popular, you gain resources: testers, developers and people willing to pitch in. If your free website takes off, you lose resources. Your time is spent firefighting and your money all goes to the nice people at Linode. > Like a service? Make them charge you or show you ads. If they won't do it, clone them and do it yourself. Soon you'll be the only game in town! https://blog.pinboard.in/2011/12/don_t_be_a_free_user/ https://blog.pinboard.in/2011/12/don_t_be_a_free_user/
- rozenmd 5y ago
  100% - I'm less and less inclined to build free tiers into my products these days, it's just not sustainable.
  - indigochill 5y ago
    Free tiers are/should be a marketing tactic that gets people comfortable enough with your product that when it comes time to put money down, they put it on your thing rather than the competitor. It's when free tiers don't have a sufficient draw into a paid tier that you run into problems. Microsoft figured this out relatively early on during their monopoly lawsuit which they cleverly settled by donating a bunch of Microsoft products to schools so that the next generation of the workforce would grow up on Microsoft products and become commercial Microsoft users in the workforce (and I've seen Apple use this same approach since then). What was ostensibly seen as a punishment by the legal system simply entrenched their position further. And in gaming, there's an entire industry around "free to play" games that make billions of dollars, although I sincerely hope B2B tech doesn't take marketing inspiration from them.
    - zeepzeep 5y ago
      Pay-to-win web services, right...
kome 5y ago
It's just me or SSLPing used an incredibly complex set of tools? Simplicity always pays of. But I guess real simplicity is harder to implement, and a lot of those tools make life easier for developers.
- dijit 5y ago
  I think it's just you, the advice in 2016 was "just throw it up on something using docker compose", "you can later expand it with Swarm". NodeJS was a common choice too. The real problem was their lack of an upgrade path I suppose, not the tech stack itself. I'm also guilty of doing this and I'm an ops person, if you can't keep upgrading at a decent pace then the cost of all the upgrades becomes too great to take in one chunk.
  - kome 5y ago
    > I think it's just you, the advice in 2016 was "just throw it up on something using docker compose", "you can later expand it with Swarm". > NodeJS was a common choice too. I agree it was common and perhaps fashionable, and perhaps it made life easier, but it also added so many level of complexity and technical debt, that now are a burden. That why I say simplicity is hard, but then it pays of (perhaps).
    - dijit 5y ago
      Compared to the standard deployment stack these days: what SSLPing was using seems extremely simple though honestly.
- hsn915 5y ago
  It is, but the people realizing this are very small in number. It's not just SSLPing, it's the entire industry. SSLPing is aruably a lot simpler (comparitavely speaking) than many other products.
- hotpotamus 5y ago
  By today's standards, Docker Swarm on dedicated servers is very simple. Complexity would be putting this into cloud with auto-scaling and probably half a dozen cloud services stitched together.
nixcraft 5y ago
I use testssl[1], and it saved me quite a few times with Nginx and other TLS issues. Give it a try. It is written bash (the only requirement) and works for Linux, macOS, *BSD and WSL. [1] https://testssl.sh/ https://testssl.sh/
- nigma1337 5y ago
  I use testssl too, the dockerfile has saved me countless times, as having an image to run and test old SSL versions is godlike.
- contravariant 5y ago
  For reference what are the advantages of something like this vs. something like openssl?
  - zufallsheld 5y ago
    One advantage is the easier usage. Openssl Syntax is quite hard.
buro9 5y ago
I'm waiting for my services to die in a similar way. I too will shutter it when it does. 250k monthly users, but all the time and a lot of the costs are borne by me and where I'm at now I don't have the time (the money I could afford, but it's the time that is more valuable). I'm glad to see this, I'm glad to see someone else also conclude that they don't have to take an onerous responsibility for something created lightly and that gained traction. This is what OSS needs too. If the project gets too much, just give it up. Even if others depends on what you've done, you're not compelled to do anything if you're not in a contract and no one is directly paying for your time. Not a donation, but payment to reserve time. Time is the thing. It ticks by, and technical debt and bit rot eventually make it cost too much.
- caffeine 5y ago
  I don’t know what your service is but that’s enough traffic that you likely find a willing buyer? I recently discovered that there is a pretty active market in people buying/selling smaller businesses and websites like this. Whether you like what the buyer does with it is a different issue…
  - patio11 5y ago
    True regarding the active market, but generally speaking for your offering to be attractive to that market it has to be already successfully generating income above its costs. There is far less of a market for loss-leaders. (The exception to that, by the way, is that if anyone here ever builds anything so useful to a particular company that their sales engineers or developer evangelists are routinely using it or writing blog posts about how to use it you should absolutely get in touch with them and ask them to buy it.)
  - TheCowboy 5y ago
    Another option would be to just communicate the limits of their commitment to the site to their users. Maybe people would step up to takeover/assist, or another solution would be found. At least users would know that it's on the way out in advance.
- jeeva 5y ago
WelcomeShorty 5y ago
Happy user here. I am going to miss your service. It saved my day a couple of times and I loved the no nonsense site, service & notifications. Thanks for all the fish and I wish you a great time developing your next service!
- weddpros 4y ago
  thanks man! This goes straight to my heart (yeah, I'm chris, I amended the message on sslping.com to show my HN profile). I surely didn't expect SSLPing to END its life on the first page of HN. I'm sad today, really sad :( but my users were the best!
lloydatkinson 5y ago
Seems that running this in a container to start with would have guaranteed certain libraries and OS settings were consistent…
- KronisLV 5y ago
  It was run in a container, though: - it was using Docker Swarm, which fell out of favour (Kubernetes won after all) Docker Swarm is the built in Docker orchestrator, so it was running as a Docker container. It still doesn't protect you from anything around it breaking, such as the actual servers that the orchestrator runs on. Something like Ansible could have been useful (or even VMs with snapshots) for more easily reproducing the setup in case of failure, but it's perfectly fine not to want to do that if it wasn't financially viable.
qwertox 5y ago
I can absolutely comprehend how he feels. Congratulations for recognizing that it's the best for it to be over. Feel relieved and enjoy the newly gained freedom.
vdjuri 5y ago
[flagged]
- huhtenberg 5y ago
  You feel like plugging your service, you should disclose it's yours.
- YPPH 5y ago
  >I use [service] for SSL monitoring The /about page of this service confirms, read with your previous comments on this site, that you have an undisclosed affiliation with this service. Namely, you were the person who launched it. You should disclose that fact and not purport to simply be a user of the service.
mattbee 5y ago
For an alternative, I get great service - not free but very cheap - from updown.io.
- iso1210 5y ago
  I saw updown.io here on HN some time ago, it's a great service, cheap enough I don't notice, and quiet enough I only notice when there's a problem.
deleted 5y ago
[deleted]
FreeHugs 5y ago
He says he had hundreds of users and hosting costs were a problem. This made me curious how this could be. Testing SSL for a few hundred users should pretty much free these days. He said Patreon pledges paid for 25% of hosting. So I looked up his Patreon. Turns out he has 3 (!) patreons, together paying $9 per month. The web is a strange place. Here comes a fun fact I can add: He is doing better than me. I have a website with about 500000 monthly users and 5 (!) patreons. So while he only had 1% paying users, I only have 0.001% :) Did I say the web is a strange place? Will this ever change?
- rmbyrro 5y ago
  I think this is natural, not strange. Not saying to criticize, I mean as a friendly heads up... You're acting like a tree in the forest offering fruits for free. People pass by, take a couple fruits and move on. You put a shy sign "if you drop a dollar on the floor it won't hurt". 0.001% dollars is what you get out of this behavior. It's strange to expect something different. You need to tell people you expect a LOT of them to pay. Otherwise they don't know. You tell them that by restricting access and saying: pay or go away. Offer a limited time free trial. Then charge.
- lnxg33k1 5y ago
  The web is a strange place indeed, and maybe I misunderstood your reply, but my take after reading it was like: You are freely and independently offering a service to others for free and are complaining to us that you don't get enough donations to keep it? Kill it, it's not that anyone is entitled to your service for free, or charge for it, so yeah I think it will change when people stop putting free stuff online?
- Bilal_io 5y ago
  > Turns out he has 3 (!) patreons, together paying $9 per month. It is possible that he already informed his patreons and they canceled their pledges except 3 of them.
- lbriner 5y ago
  I don't think it's strange that to many people, some service are useful but not always seen as useful enough to commit to X dollars per month, especially if their own use is for free stuff as well. Also, many businesses are not setup to make multiple small(ish) payments to library maintainers even though imho, this should become a normal pattern. Imagine if all the people who used OpenSSL, PHP, Linux, etc. x 1000 were paid even $1 per month per business use. I think there is a whole PhD around this since there are psychological factors to people charging up-front vs freemium with upgrades etc. Sometimes if I am trying to find a service to do X and find that one charges, I might immediately reject even if it is really amazing and would save me that much in time. I guess if it was easy, there wouldn't be a problem!
privacyonsec 5y ago
open source it man, we will figure out how to fix it !
nonrandomstring 5y ago
This project was killed by invisible complexity. I felt a little sad reading about it. There are lots of comments talking about the sustainability of projects with respect to money and burnout, the need to pay for services etc. I get that and agree. But I also get the impression that wouldn't have helped here. When we reach a situation where some unknown person pushes an upstream update, which causes a cascade of problems that even someone with deep technical knowledge and daily connection to the project cannot unpick, that's a breakdown in modularity/dependency. It's what we faced in the 1990s and from it evolved package managers, version control, dependency management and all the good things. I think in 2022 we're back in a similar situation again. Virtualisation, containers, cloud services and whatnot have regressed development reliability. I predict the day when a really major service provider comes out and says; "Sorry everyone. It's been 10 days downtime. We've put our 1000 top engineers on the problem and nobody knows what's wrong. We just can't fix it."
- ehnto 5y ago
  Excellent comment and I can't speak directly for the author, but that's what I read too. Incidental Complexity is a term related to this. Incidental Complexity is any complexity that is not part of solving the core domain problem and has been introduced by the tooling or approach you chose instead. The most common example I see is using enterprise tooling for small teams and projects, and then those projects getting snowed under by the weight of the hidden and incidental complexity they had built without noticing.
  - Sharlin 5y ago
    Essential vs incidental complexity is one of those concepts everybody who wants to call themselves a software engineer should be intimately familiar with. As they say, anyone can design a bridge, but it takes an engineer to just barely design a bridge.
  - ignoramous 5y ago
    Incidental Complexity pushes me towards serverless offerings. Of course, serverless brings with it its own test/deploy quagmire, but I'd argue for personal projects, it doesn't matter as much.
KronisLV 5y ago
> it was using Docker Swarm, which fell out of favour (Kubernetes won after all) As someone who is still running all of their homelab stuff (well, almost) on Docker Swarm, i dread the day when the eventual switch to Kubernetes will be inevitable. Maybe Nomad will save me. Or something like K3s or even Rancher - even though the former has some ingress weirdness with Traefik and default wildcard SSL/TLS certificates since not everyone uses Let's Encrypt or wants DNS challenge for private stuff and the latter needs a lot of resources to even run. Still, when things go wrong with Docker Swarm, they're generally pretty easy to debug and solve - it's like adding just a little bit more on top of Docker Compose. Worst issues i've had were related to networking and kernel updates breaking something, though purging the node and carrying over all of the bind mount data as well as re-deploying the stacks solved that.
- toyg 5y ago
  Shit like this is why I never warmed up to Docker. The benefits for a single-man semi-hobbyist working on simple sites, often static, are heavily offset by the busywork these tools constantly generate. They move almost as fast as the JS world, add more and more things to track and update, and risk becoming another point of failure.
  - KronisLV 5y ago
    > The benefits for a single-man semi-hobbyist working on simple sites, often static, are heavily offset by the busywork these tools constantly generate. They move almost as fast as the JS world, add more and more things to track and update, and risk becoming another point of failure. In regards to something like Kubernetes, i largely agree. However, there is (currently) certainly some merit to just using Docker, Docker Compose or even Docker Swarm, all of which are relatively boring and stable. Those essentially solved the problems of environments, configuration, as well as backups for me. Most *nix distros have humiliatingly failed at having a single directory for everything an application needs to run, which horribly complicates figuring out where your data actually lives and how you could re-create everything from 0 in case of a failure or migration. The same goes for different system packages and even sometimes pinning versions. The same goes for networking being weird and is especially applicable in situations where you would want different versions of the same package running on the same server (e.g. MySQL 5.7 for one project, MySQL 8 for another). A lot of that was already solved by VMs and tools like Vagrant, but it was a bit heavy and never caught on - Docker essentially solved that problem by allowing you to reason about your applications like applications on a phone - just a package of stuff that you care about, adding some resiliency and load balancing capabilities on top. And then things like Kubernetes came along and addressed more enterprise concerns that are applicable at scale and inadvertently pulled along a bunch of people for the ride, when they have neither the need nor the capacity to work on such complicated software. I actually talked more about my experiences with this in my blog post, "My journey from ad hoc chaos to order (a tale of legacy code, services and containers)": https://blog.kronis.dev/articles/my-journey-from-ad-hoc-chaos-to-order-a-tale-of-legacy-code-services-and-containers https://blog.kronis.dev/articles/my-journey-from-ad-hoc-chao... That said, it's nice if you don't need to solve the problems that containers do. Alternatively, if you have other ways of solving them (e.g. the ansible + systemd setup), then go ahead and use that until your needs expand!
rozenmd 5y ago
PS: I'm not a user of SSLPing, but I built OnlineOrNot and we have a basic SSL verification feature that'll alert you when your SSL certificate is no longer valid: https://onlineornot.com/docs/ssl-verification https://onlineornot.com/docs/ssl-verification Looking at building out this feature further (with expiry warnings 3/7/14/x days before cert expiry), let me know if you're interested.
tqkxzugoaupvwqr 5y ago
This announcement illustrates the amount of breakage in the software world very well. After just six years the product is beyond repair because the programs on which it relies changed too much.
th0th 5y ago
That unstyled short message on a default, white background is touching. I felt Chris reading those technical debt bullets. Kudos to him and good riddance!
binarymax 5y ago
I had to kill a free service that I absolutely loved due to similar issues. Couldn’t find a way to monetize, running an old version of node. Upstart vs Systemd, a niche database (rethinkdb) that fell out of favor and upgrading was too painful. It wasn’t nearly as popular as SSLPing, but it was mine and had a following. Thanks for writing this note: it’s OK to shut something down if it causes you agony.
- exikyut 4y ago
  What was the service? Getting broken things going again can be kinda fun...
  - binarymax 4y ago
    It was a game called Kriegspiel hosted at krgspl.com More info on the game here: https://en.m.wikipedia.org/wiki/Kriegspiel_(chess) https://en.m.wikipedia.org/wiki/Kriegspiel_(chess) It worked really well at first, but didn’t scale due to some tech decisions. Maybe at some point I’ll fix it and rerelease it :)
- shakezula 4y ago
  RethinkDB. What a blast from the past. They were such a compelling product, but they just never got the attention they deserved. Mongo by comparison was strictly worse, but they never got out from under Mongos shadow.
- weddpros 4y ago
  Hey! SSLPing creator here... I feel your pain, deeply, inside me at the moment!
arnaudsm 5y ago
It's crazy that 5 years of updates can break most systems. It's long in internet time, but nothing compared to other industries. Maybe we should settle down a bit and have longer LTS
mcculley 5y ago
Damn. Sorry to see that this service was running at a loss. I have a service that, among other things, checks SSL certificates: DomainProactive (https://domainproactive.com https://domainproactive.com). Please try it out if you have this need.
jdrc 5y ago
Make the web monetizable again
vachina 5y ago
forgotmypw17 5y ago
What a mess of incompatibility ssl has become, and all to provide questionable amounts of privacy and security along with a monopoly on eavesdropping to those who have the means.
dt3ft 5y ago
Kudos to Chris Hartwig for throwing in the towel and shutting it down. Here, read this blog where the author suggests that the service is free and that free account has no limitations and allows you to scan thousands of websites... appalling: https://www.ctrl.blog/entry/review-sslping.html https://www.ctrl.blog/entry/review-sslping.html
- weddpros 4y ago
  thank you man, straight to my heart it goes (SSLPing creator here)
  - dt3ft 4y ago
    You have my utmost respect. I hope you get to spend the time on other things that bring you joy.
f0e4c2f7 5y ago
If the owner of the site reads this, I'm unfamiliar with your project but I've spent my career untangling especially tricky problems of the kind you're describing. If I'm being honest I find it to be fun. Based on upvotes this is clearly a project some people cared about. If you would like, comment and I'll add a way of contacting me and do free consulting to take a look and see if I can fix it. I can't make any promises but from what you described it sounds savable.
rmrf100 5y ago
Thanks Chris
turing_complete 4y ago
Quite concerning that the lifetime of modern software, even for a trivial tool, is so short. We have to do something about that.
josephcsible 4y ago
> - it was using Docker Swarm, which fell out of favour (Kubernetes won after all) This feels like saying to stop supporting Firefox because Chrome won after all. Kubernetes is far from perfect, so we shouldn't try to eradicate all of its competitors for it.
nullbytesmatter 4y ago
I have been running a product since 2015 and I feel the author's pain. The original tech I used was Ruby on Rails, and it was great (back in Rails 5). However, with Rails 7 and all the other changes since 2015, the debt was pretty overwhelming. Updating dependencies became difficult. Deploying a new server felt impossible. It felt like it was held together with toothpicks and glue. Afraid to update X because Y would break. I couldn't update Y or Z would break. Unlike the author, my product was making actual money ($XXX,000). I ended up completely rewriting the product from scratch (took ~3 months). I just swapped the old Rails service out for the new service on April 1st. I stuck to "simple and boring" tech for the new stack. No more Rails, etc.
- asvitkine 4y ago
  What was the new tech stack?
- binarymax 4y ago
  Lol I thought the appeal of rails was that it is “simple and boring”! Congrats on having the gumption to do a rewrite. I’m curious what are the more detailed decisions you took to better future proof? Given how often things shift in our world, I feel like anything I choose now will just end up being obsolete and annoying to maintain in a 5+ year timeframe.
  - nullbytesmatter 4y ago
    Great question-- and may be worth a detailed/thought out blog post some day! To future proof the service I wanted to use tech that was based on the fundamentals. This boiled down to no special tooling, no special build process, etc. Furthermore I cut out all dependencies I could. I got my third party dependencies down to two (postgres + nginx). Practically speaking this meant: no node, no yarn, no ruby, no webpack, no sidekiq, no redis, etc. The entire service is now Nginx, Postgres and a single binary that has html/css/js/assets embedded inside of it. The entire product is a single Go binary that connects to postgres-- that's it. I could probably do without Nginx, but it has been nice for a variety of reasons and has never given me a headache. My tech/decisions may not be for everyone (that is why I didn't share them initially) but it works incredibly well for me and most products I build.
didip 4y ago
Can’t he just spawn an EKS, configure his servers there, and flip the DNS?
pnathan 4y ago
These sorts of issues are why I moved my personal systems over to Kubernetes years ago for infra, and for code I focus on language ecosystesm with longer horizons. very sad, but, also, yeah. :-/
eimrine 4y ago
> Docker refuses to run after attempting an OS update which broke too many things (upstart vs. systemd being one, FS drivers, etc...). So all of that cathedral has been fallen down w\o ability to recovery after mistakenly update && upgrade with no backups? And all of that code stack was open-source?
tppiotrowski 4y ago
Reminds me of a decision I made long ago to use a 32-bit instead of 64-bit Linode server because I read somewhere that 32-bit was slightly faster. Nodejs stopped providing 32-bit binaries at version 8 or 9? and now I’m stuck with the risk of migrating my working cron, php, mysql, node spaghetti or being constrained by apis/packages available in an ancient version of Node. Edit: I thought of slowly migrating everything to Docker, but the official Docker binaries are also 64-bit only.
1970-01-01 4y ago
This entire service ended because there weren't backups.
- weddpros 4y ago
  SSLPing creator here. There are backups, the db is safe. But you can't easily fix a Docker Swarm cluster when Docker refuses to run, systemd tries to replace upstart, etc. The message I wrote tells the whole story, and backups were not the problem (I even had a redundant 3 way database cluster which most commercial companies don't have).
  - exikyut 4y ago
    It seems that posts stay floated near the top of https://news.ycombinator.com/best https://news.ycombinator.com/best for a max of maybe ~5-6 days. This has been up for 1-2 days and from a conservative engineering perspective I'd probably be comfortable relying on it staying there for at least 2 more. So you have a one-shot opportunity for the next day or two to consider changing the webpage to say something different. Reading the sentiment amongst the comments and the perspective you've also shared, some significant points emerge for me: - This is a side project you were really invested in and you're really sad to see it go - It wasn't generating very much money, but you weren't in it for the money - A few people definitely used and appreciated it - so it had a decent bit of mindshare IMHO this could easily either go the open source route, or a small private team of assistants could help contribute to getting this going again and maybe contribute toward maintaining it in as people have spare time available. - You appear to have some level of one-step-beyond-MVP mindshare, and a catchy name. Not only would this make it tricky for forks to take off in an open-source setting, but I can also see full-clone attempts being promptly chased away with pitchforks as well. This is the scenario where open source shines I think - the risk of wholesale copying seems interestingly low. - You aren't interested in this for the money, so opening the codebase doesn't really let especially novel cats out of any bags - There is enough clear interest that people will definitely show up to help Some other considerations: - Instead of committing to open-sourcing immediately you could also build a team out of all the people expressing interest in contributing spare time. I honestly wonder if the energy level would be lower than a traditional open source project. In this case I can see enough interest coming to the table to help unravel the existing codebase, and enough people might even stick around long-term to help out with simple maintenance hitches and fixes as they come up. - If there were any concerns about forks/clones the exceptionally restrictive AGPLv3 would probably take care of those sufficiently well (perhaps this is a good question for the theoretical team mentioned above) TL;DR, my opinion is that if you maybe want to take a break for a while but dive back into this in the future CHANGE THE WEBPAGE NOW while eyeballs are still looking at it. Point people at a Discord server or empty GitHub repository (lots of closed-source stuff uses GitHub for issues) to pin or star so they get pinged when there's activity in the future. Of course the caveat is that I can only respond to the context I can see, and this may not be useful advice. Kind of an on-the-spot "uhhhhh....", good luck :P
p0d 4y ago
I'm an older guy Chris and I'm guessing you are in your 20/30s? I was just musing today how my home networking hobby shaped my work life. I'm sure the journey you have been on will shape your life too. Keep doing the stuff :-)
- weddpros 4y ago
  Hey! I'm 50 actually :-) I'll keep doing the stuff nonetheless! Cheers
thomastay 4y ago
Sorry, but since the about page of sslping is down, what is it? From what i can tell from the scant information on the internet, it's a monitoring tool that tells you when your websites have a SSL vulnerability?
Jenda_ 4y ago
I'm not sure about exact features of this service (I didn't know about it), but I'm using: - https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/ - nmap --script ssl-enum-ciphers news.ycombinator.com -p 443 The nmap one works with various non-HTTP protocols, such as IMAPS and FTPS. The Qualys service is much more detailed, including hints about certificate chain problems etc.
- archon810 4y ago
  According to the OP, ssllabs takes much longer to run a similar check https://news.ycombinator.com/item?id=30993593 https://news.ycombinator.com/item?id=30993593.
sweatC 4y ago
Hey Chris, please don't kill the project. Instead, give it a chance to live by selling to another founder willing to take on SSLPing. I'd be happy to help you find this person through my site called Microns(https://www.microns.io https://www.microns.io). I have an audience of entrepreneurs and founders who will like your project. Just let me know if you would like to be featured.
edumucelli 4y ago
I have a service with hundreds of requests per day, thousands of users, it is an old RoR app that is impossible to update now, 3 major versions behind latest, several dependencies that can't be built on newer Ruby versions. Even the Ruby version it is using can't be build anymore on more recent OSs because of OpenSSL incompatibilities. It will take hundreds of hours to be updated, which at some point will be almost (or even less) than building it again from scratch. As I do not have this time, it will probably die a slow death.

641 points by WelcomeShorty 5y ago

https://sslping.com/ https://sslping.com/ This site can’t provide a secure connection sslping.com sent an invalid response. ERR_SSL_PROTOCOL_ERROR /Ironic

spzb 5y ago
Works for me, FWIW
silverfox17 5y ago
Did you ever update your root certificates after some of the LetsEncrypt certificates expired in September?

6510 5y ago

Everything improved until nothing worked anymore.

rmw24 4y ago

Respect to Chris for not only keeping it going for so long, but closing things with an explanation instead of just vanishing like most services. I know that pain of debugging a Docker swarm, and it's not fun!

weddpros 4y ago
Thank you man! I'm Chris, the creator of SSLPing, and this goes straight to my heart

dan1234 5y ago

What features did SSLPing have that forced it to rely so heavily on old versions of OpenSSL?

fxtentacle 5y ago
It's also blocked by AdGuard.
- lapser 5y ago
  Yeah I was trying to figure out what was going on here. Is it blocked cos it's closing or was it blocked from before?
capableweb 5y ago
From https://web.archive.org/web/20220328120435/https://sslping.com/ https://web.archive.org/web/20220328120435/https://sslping.c... > SSLPing needs less than 5 seconds to check your server and tell you what's wrong with your SSL/TLS security. So I guess it used OpenSSL to figure out what was wrong with people's certificates. Not sure what it used that relied on internals so heavily it was hard to upgrade, or if the public interface just changed a lot. Even with that, seems there was multiple issues that "prevented" ("made it harder than justifiable" rather) the author from keeping the project up, not just regarding OpenSSL.
- dan1234 5y ago
  Ah ok, so it sounds like an automated (though probably cutdown) version of the SSLLabs server test.
  - WelcomeShorty 5y ago
    It does a little more and little less. More: Enter a list of (sub-) domains and get informed via email when "SSL things" change (for better or for worst), or your https certificate is about to expire. Less: No fancy pansy "report" Personally I prefer https://hardenize.com https://hardenize.com nowadays, over ssllabs for these kind of queries.
    - dan1234 5y ago
      https://hardenize.com https://hardenize.com is quite pretty, but there's nowhere near $999/mo of value in it for me!

gjs278 5y ago

arciini 5y ago

This seems like a perfectly reasonable way to end a service. The server died, and the effort to bring it back up seems high. This is a reminder to pay for services you depend on. Per the Pinboard founder's post: > I love free software and could not have built my site without it. But free web services are not like free software. If your free software project suddenly gets popular, you gain resources: testers, developers and people willing to pitch in. If your free website takes off, you lose resources. Your time is spent firefighting and your money all goes to the nice people at Linode. > Like a service? Make them charge you or show you ads. If they won't do it, clone them and do it yourself. Soon you'll be the only game in town! https://blog.pinboard.in/2011/12/don_t_be_a_free_user/ https://blog.pinboard.in/2011/12/don_t_be_a_free_user/

rozenmd 5y ago
100% - I'm less and less inclined to build free tiers into my products these days, it's just not sustainable.
- indigochill 5y ago
  Free tiers are/should be a marketing tactic that gets people comfortable enough with your product that when it comes time to put money down, they put it on your thing rather than the competitor. It's when free tiers don't have a sufficient draw into a paid tier that you run into problems. Microsoft figured this out relatively early on during their monopoly lawsuit which they cleverly settled by donating a bunch of Microsoft products to schools so that the next generation of the workforce would grow up on Microsoft products and become commercial Microsoft users in the workforce (and I've seen Apple use this same approach since then). What was ostensibly seen as a punishment by the legal system simply entrenched their position further. And in gaming, there's an entire industry around "free to play" games that make billions of dollars, although I sincerely hope B2B tech doesn't take marketing inspiration from them.
  - zeepzeep 5y ago
    Pay-to-win web services, right...

kome 5y ago

It's just me or SSLPing used an incredibly complex set of tools? Simplicity always pays of. But I guess real simplicity is harder to implement, and a lot of those tools make life easier for developers.

dijit 5y ago
I think it's just you, the advice in 2016 was "just throw it up on something using docker compose", "you can later expand it with Swarm". NodeJS was a common choice too. The real problem was their lack of an upgrade path I suppose, not the tech stack itself. I'm also guilty of doing this and I'm an ops person, if you can't keep upgrading at a decent pace then the cost of all the upgrades becomes too great to take in one chunk.
- kome 5y ago
  > I think it's just you, the advice in 2016 was "just throw it up on something using docker compose", "you can later expand it with Swarm". > NodeJS was a common choice too. I agree it was common and perhaps fashionable, and perhaps it made life easier, but it also added so many level of complexity and technical debt, that now are a burden. That why I say simplicity is hard, but then it pays of (perhaps).
  - dijit 5y ago
    Compared to the standard deployment stack these days: what SSLPing was using seems extremely simple though honestly.
hsn915 5y ago
It is, but the people realizing this are very small in number. It's not just SSLPing, it's the entire industry. SSLPing is aruably a lot simpler (comparitavely speaking) than many other products.
hotpotamus 5y ago
By today's standards, Docker Swarm on dedicated servers is very simple. Complexity would be putting this into cloud with auto-scaling and probably half a dozen cloud services stitched together.

nixcraft 5y ago

I use testssl[1], and it saved me quite a few times with Nginx and other TLS issues. Give it a try. It is written bash (the only requirement) and works for Linux, macOS, *BSD and WSL. [1] https://testssl.sh/ https://testssl.sh/

nigma1337 5y ago
I use testssl too, the dockerfile has saved me countless times, as having an image to run and test old SSL versions is godlike.
contravariant 5y ago
For reference what are the advantages of something like this vs. something like openssl?
- zufallsheld 5y ago
  One advantage is the easier usage. Openssl Syntax is quite hard.

buro9 5y ago

I'm waiting for my services to die in a similar way. I too will shutter it when it does. 250k monthly users, but all the time and a lot of the costs are borne by me and where I'm at now I don't have the time (the money I could afford, but it's the time that is more valuable). I'm glad to see this, I'm glad to see someone else also conclude that they don't have to take an onerous responsibility for something created lightly and that gained traction. This is what OSS needs too. If the project gets too much, just give it up. Even if others depends on what you've done, you're not compelled to do anything if you're not in a contract and no one is directly paying for your time. Not a donation, but payment to reserve time. Time is the thing. It ticks by, and technical debt and bit rot eventually make it cost too much.

caffeine 5y ago
I don’t know what your service is but that’s enough traffic that you likely find a willing buyer? I recently discovered that there is a pretty active market in people buying/selling smaller businesses and websites like this. Whether you like what the buyer does with it is a different issue…
- patio11 5y ago
  True regarding the active market, but generally speaking for your offering to be attractive to that market it has to be already successfully generating income above its costs. There is far less of a market for loss-leaders. (The exception to that, by the way, is that if anyone here ever builds anything so useful to a particular company that their sales engineers or developer evangelists are routinely using it or writing blog posts about how to use it you should absolutely get in touch with them and ask them to buy it.)
- TheCowboy 5y ago
  Another option would be to just communicate the limits of their commitment to the site to their users. Maybe people would step up to takeover/assist, or another solution would be found. At least users would know that it's on the way out in advance.
jeeva 5y ago

WelcomeShorty 5y ago

Happy user here. I am going to miss your service. It saved my day a couple of times and I loved the no nonsense site, service & notifications. Thanks for all the fish and I wish you a great time developing your next service!

weddpros 4y ago
thanks man! This goes straight to my heart (yeah, I'm chris, I amended the message on sslping.com to show my HN profile). I surely didn't expect SSLPing to END its life on the first page of HN. I'm sad today, really sad :( but my users were the best!

lloydatkinson 5y ago

Seems that running this in a container to start with would have guaranteed certain libraries and OS settings were consistent…

KronisLV 5y ago
It was run in a container, though: - it was using Docker Swarm, which fell out of favour (Kubernetes won after all) Docker Swarm is the built in Docker orchestrator, so it was running as a Docker container. It still doesn't protect you from anything around it breaking, such as the actual servers that the orchestrator runs on. Something like Ansible could have been useful (or even VMs with snapshots) for more easily reproducing the setup in case of failure, but it's perfectly fine not to want to do that if it wasn't financially viable.

qwertox 5y ago

I can absolutely comprehend how he feels. Congratulations for recognizing that it's the best for it to be over. Feel relieved and enjoy the newly gained freedom.

vdjuri 5y ago

[flagged]

huhtenberg 5y ago
You feel like plugging your service, you should disclose it's yours.
YPPH 5y ago
>I use [service] for SSL monitoring The /about page of this service confirms, read with your previous comments on this site, that you have an undisclosed affiliation with this service. Namely, you were the person who launched it. You should disclose that fact and not purport to simply be a user of the service.

mattbee 5y ago

For an alternative, I get great service - not free but very cheap - from updown.io.

iso1210 5y ago
I saw updown.io here on HN some time ago, it's a great service, cheap enough I don't notice, and quiet enough I only notice when there's a problem.

deleted 5y ago

[deleted]

FreeHugs 5y ago

He says he had hundreds of users and hosting costs were a problem. This made me curious how this could be. Testing SSL for a few hundred users should pretty much free these days. He said Patreon pledges paid for 25% of hosting. So I looked up his Patreon. Turns out he has 3 (!) patreons, together paying $9 per month. The web is a strange place. Here comes a fun fact I can add: He is doing better than me. I have a website with about 500000 monthly users and 5 (!) patreons. So while he only had 1% paying users, I only have 0.001% :) Did I say the web is a strange place? Will this ever change?

rmbyrro 5y ago
I think this is natural, not strange. Not saying to criticize, I mean as a friendly heads up... You're acting like a tree in the forest offering fruits for free. People pass by, take a couple fruits and move on. You put a shy sign "if you drop a dollar on the floor it won't hurt". 0.001% dollars is what you get out of this behavior. It's strange to expect something different. You need to tell people you expect a LOT of them to pay. Otherwise they don't know. You tell them that by restricting access and saying: pay or go away. Offer a limited time free trial. Then charge.
lnxg33k1 5y ago
The web is a strange place indeed, and maybe I misunderstood your reply, but my take after reading it was like: You are freely and independently offering a service to others for free and are complaining to us that you don't get enough donations to keep it? Kill it, it's not that anyone is entitled to your service for free, or charge for it, so yeah I think it will change when people stop putting free stuff online?
Bilal_io 5y ago
> Turns out he has 3 (!) patreons, together paying $9 per month. It is possible that he already informed his patreons and they canceled their pledges except 3 of them.
lbriner 5y ago
I don't think it's strange that to many people, some service are useful but not always seen as useful enough to commit to X dollars per month, especially if their own use is for free stuff as well. Also, many businesses are not setup to make multiple small(ish) payments to library maintainers even though imho, this should become a normal pattern. Imagine if all the people who used OpenSSL, PHP, Linux, etc. x 1000 were paid even $1 per month per business use. I think there is a whole PhD around this since there are psychological factors to people charging up-front vs freemium with upgrades etc. Sometimes if I am trying to find a service to do X and find that one charges, I might immediately reject even if it is really amazing and would save me that much in time. I guess if it was easy, there wouldn't be a problem!

privacyonsec 5y ago

open source it man, we will figure out how to fix it !

nonrandomstring 5y ago

This project was killed by invisible complexity. I felt a little sad reading about it. There are lots of comments talking about the sustainability of projects with respect to money and burnout, the need to pay for services etc. I get that and agree. But I also get the impression that wouldn't have helped here. When we reach a situation where some unknown person pushes an upstream update, which causes a cascade of problems that even someone with deep technical knowledge and daily connection to the project cannot unpick, that's a breakdown in modularity/dependency. It's what we faced in the 1990s and from it evolved package managers, version control, dependency management and all the good things. I think in 2022 we're back in a similar situation again. Virtualisation, containers, cloud services and whatnot have regressed development reliability. I predict the day when a really major service provider comes out and says; "Sorry everyone. It's been 10 days downtime. We've put our 1000 top engineers on the problem and nobody knows what's wrong. We just can't fix it."

ehnto 5y ago
Excellent comment and I can't speak directly for the author, but that's what I read too. Incidental Complexity is a term related to this. Incidental Complexity is any complexity that is not part of solving the core domain problem and has been introduced by the tooling or approach you chose instead. The most common example I see is using enterprise tooling for small teams and projects, and then those projects getting snowed under by the weight of the hidden and incidental complexity they had built without noticing.
- Sharlin 5y ago
  Essential vs incidental complexity is one of those concepts everybody who wants to call themselves a software engineer should be intimately familiar with. As they say, anyone can design a bridge, but it takes an engineer to just barely design a bridge.
- ignoramous 5y ago
  Incidental Complexity pushes me towards serverless offerings. Of course, serverless brings with it its own test/deploy quagmire, but I'd argue for personal projects, it doesn't matter as much.

KronisLV 5y ago

> it was using Docker Swarm, which fell out of favour (Kubernetes won after all) As someone who is still running all of their homelab stuff (well, almost) on Docker Swarm, i dread the day when the eventual switch to Kubernetes will be inevitable. Maybe Nomad will save me. Or something like K3s or even Rancher - even though the former has some ingress weirdness with Traefik and default wildcard SSL/TLS certificates since not everyone uses Let's Encrypt or wants DNS challenge for private stuff and the latter needs a lot of resources to even run. Still, when things go wrong with Docker Swarm, they're generally pretty easy to debug and solve - it's like adding just a little bit more on top of Docker Compose. Worst issues i've had were related to networking and kernel updates breaking something, though purging the node and carrying over all of the bind mount data as well as re-deploying the stacks solved that.

toyg 5y ago
Shit like this is why I never warmed up to Docker. The benefits for a single-man semi-hobbyist working on simple sites, often static, are heavily offset by the busywork these tools constantly generate. They move almost as fast as the JS world, add more and more things to track and update, and risk becoming another point of failure.
- KronisLV 5y ago
  > The benefits for a single-man semi-hobbyist working on simple sites, often static, are heavily offset by the busywork these tools constantly generate. They move almost as fast as the JS world, add more and more things to track and update, and risk becoming another point of failure. In regards to something like Kubernetes, i largely agree. However, there is (currently) certainly some merit to just using Docker, Docker Compose or even Docker Swarm, all of which are relatively boring and stable. Those essentially solved the problems of environments, configuration, as well as backups for me. Most *nix distros have humiliatingly failed at having a single directory for everything an application needs to run, which horribly complicates figuring out where your data actually lives and how you could re-create everything from 0 in case of a failure or migration. The same goes for different system packages and even sometimes pinning versions. The same goes for networking being weird and is especially applicable in situations where you would want different versions of the same package running on the same server (e.g. MySQL 5.7 for one project, MySQL 8 for another). A lot of that was already solved by VMs and tools like Vagrant, but it was a bit heavy and never caught on - Docker essentially solved that problem by allowing you to reason about your applications like applications on a phone - just a package of stuff that you care about, adding some resiliency and load balancing capabilities on top. And then things like Kubernetes came along and addressed more enterprise concerns that are applicable at scale and inadvertently pulled along a bunch of people for the ride, when they have neither the need nor the capacity to work on such complicated software. I actually talked more about my experiences with this in my blog post, "My journey from ad hoc chaos to order (a tale of legacy code, services and containers)": https://blog.kronis.dev/articles/my-journey-from-ad-hoc-chaos-to-order-a-tale-of-legacy-code-services-and-containers https://blog.kronis.dev/articles/my-journey-from-ad-hoc-chao... That said, it's nice if you don't need to solve the problems that containers do. Alternatively, if you have other ways of solving them (e.g. the ansible + systemd setup), then go ahead and use that until your needs expand!

rozenmd 5y ago

PS: I'm not a user of SSLPing, but I built OnlineOrNot and we have a basic SSL verification feature that'll alert you when your SSL certificate is no longer valid: https://onlineornot.com/docs/ssl-verification https://onlineornot.com/docs/ssl-verification Looking at building out this feature further (with expiry warnings 3/7/14/x days before cert expiry), let me know if you're interested.

tqkxzugoaupvwqr 5y ago

This announcement illustrates the amount of breakage in the software world very well. After just six years the product is beyond repair because the programs on which it relies changed too much.

th0th 5y ago

That unstyled short message on a default, white background is touching. I felt Chris reading those technical debt bullets. Kudos to him and good riddance!

binarymax 5y ago

I had to kill a free service that I absolutely loved due to similar issues. Couldn’t find a way to monetize, running an old version of node. Upstart vs Systemd, a niche database (rethinkdb) that fell out of favor and upgrading was too painful. It wasn’t nearly as popular as SSLPing, but it was mine and had a following. Thanks for writing this note: it’s OK to shut something down if it causes you agony.

exikyut 4y ago
What was the service? Getting broken things going again can be kinda fun...
- binarymax 4y ago
  It was a game called Kriegspiel hosted at krgspl.com More info on the game here: https://en.m.wikipedia.org/wiki/Kriegspiel_(chess) https://en.m.wikipedia.org/wiki/Kriegspiel_(chess) It worked really well at first, but didn’t scale due to some tech decisions. Maybe at some point I’ll fix it and rerelease it :)
shakezula 4y ago
RethinkDB. What a blast from the past. They were such a compelling product, but they just never got the attention they deserved. Mongo by comparison was strictly worse, but they never got out from under Mongos shadow.
weddpros 4y ago
Hey! SSLPing creator here... I feel your pain, deeply, inside me at the moment!

arnaudsm 5y ago

It's crazy that 5 years of updates can break most systems. It's long in internet time, but nothing compared to other industries. Maybe we should settle down a bit and have longer LTS

mcculley 5y ago

Damn. Sorry to see that this service was running at a loss. I have a service that, among other things, checks SSL certificates: DomainProactive (https://domainproactive.com https://domainproactive.com). Please try it out if you have this need.

jdrc 5y ago

Make the web monetizable again

vachina 5y ago

forgotmypw17 5y ago

What a mess of incompatibility ssl has become, and all to provide questionable amounts of privacy and security along with a monopoly on eavesdropping to those who have the means.

dt3ft 5y ago

Kudos to Chris Hartwig for throwing in the towel and shutting it down. Here, read this blog where the author suggests that the service is free and that free account has no limitations and allows you to scan thousands of websites... appalling: https://www.ctrl.blog/entry/review-sslping.html https://www.ctrl.blog/entry/review-sslping.html

weddpros 4y ago
thank you man, straight to my heart it goes (SSLPing creator here)
- dt3ft 4y ago
  You have my utmost respect. I hope you get to spend the time on other things that bring you joy.

f0e4c2f7 5y ago

If the owner of the site reads this, I'm unfamiliar with your project but I've spent my career untangling especially tricky problems of the kind you're describing. If I'm being honest I find it to be fun. Based on upvotes this is clearly a project some people cared about. If you would like, comment and I'll add a way of contacting me and do free consulting to take a look and see if I can fix it. I can't make any promises but from what you described it sounds savable.

rmrf100 5y ago

Thanks Chris

turing_complete 4y ago

Quite concerning that the lifetime of modern software, even for a trivial tool, is so short. We have to do something about that.

josephcsible 4y ago

> - it was using Docker Swarm, which fell out of favour (Kubernetes won after all) This feels like saying to stop supporting Firefox because Chrome won after all. Kubernetes is far from perfect, so we shouldn't try to eradicate all of its competitors for it.

nullbytesmatter 4y ago

I have been running a product since 2015 and I feel the author's pain. The original tech I used was Ruby on Rails, and it was great (back in Rails 5). However, with Rails 7 and all the other changes since 2015, the debt was pretty overwhelming. Updating dependencies became difficult. Deploying a new server felt impossible. It felt like it was held together with toothpicks and glue. Afraid to update X because Y would break. I couldn't update Y or Z would break. Unlike the author, my product was making actual money ($XXX,000). I ended up completely rewriting the product from scratch (took ~3 months). I just swapped the old Rails service out for the new service on April 1st. I stuck to "simple and boring" tech for the new stack. No more Rails, etc.

asvitkine 4y ago
What was the new tech stack?
binarymax 4y ago
Lol I thought the appeal of rails was that it is “simple and boring”! Congrats on having the gumption to do a rewrite. I’m curious what are the more detailed decisions you took to better future proof? Given how often things shift in our world, I feel like anything I choose now will just end up being obsolete and annoying to maintain in a 5+ year timeframe.
- nullbytesmatter 4y ago
  Great question-- and may be worth a detailed/thought out blog post some day! To future proof the service I wanted to use tech that was based on the fundamentals. This boiled down to no special tooling, no special build process, etc. Furthermore I cut out all dependencies I could. I got my third party dependencies down to two (postgres + nginx). Practically speaking this meant: no node, no yarn, no ruby, no webpack, no sidekiq, no redis, etc. The entire service is now Nginx, Postgres and a single binary that has html/css/js/assets embedded inside of it. The entire product is a single Go binary that connects to postgres-- that's it. I could probably do without Nginx, but it has been nice for a variety of reasons and has never given me a headache. My tech/decisions may not be for everyone (that is why I didn't share them initially) but it works incredibly well for me and most products I build.

didip 4y ago

Can’t he just spawn an EKS, configure his servers there, and flip the DNS?

pnathan 4y ago

These sorts of issues are why I moved my personal systems over to Kubernetes years ago for infra, and for code I focus on language ecosystesm with longer horizons. very sad, but, also, yeah. :-/

eimrine 4y ago

> Docker refuses to run after attempting an OS update which broke too many things (upstart vs. systemd being one, FS drivers, etc...). So all of that cathedral has been fallen down w\o ability to recovery after mistakenly update && upgrade with no backups? And all of that code stack was open-source?

tppiotrowski 4y ago

Reminds me of a decision I made long ago to use a 32-bit instead of 64-bit Linode server because I read somewhere that 32-bit was slightly faster. Nodejs stopped providing 32-bit binaries at version 8 or 9? and now I’m stuck with the risk of migrating my working cron, php, mysql, node spaghetti or being constrained by apis/packages available in an ancient version of Node. Edit: I thought of slowly migrating everything to Docker, but the official Docker binaries are also 64-bit only.

1970-01-01 4y ago

This entire service ended because there weren't backups.

weddpros 4y ago
SSLPing creator here. There are backups, the db is safe. But you can't easily fix a Docker Swarm cluster when Docker refuses to run, systemd tries to replace upstart, etc. The message I wrote tells the whole story, and backups were not the problem (I even had a redundant 3 way database cluster which most commercial companies don't have).
- exikyut 4y ago
  It seems that posts stay floated near the top of https://news.ycombinator.com/best https://news.ycombinator.com/best for a max of maybe ~5-6 days. This has been up for 1-2 days and from a conservative engineering perspective I'd probably be comfortable relying on it staying there for at least 2 more. So you have a one-shot opportunity for the next day or two to consider changing the webpage to say something different. Reading the sentiment amongst the comments and the perspective you've also shared, some significant points emerge for me: - This is a side project you were really invested in and you're really sad to see it go - It wasn't generating very much money, but you weren't in it for the money - A few people definitely used and appreciated it - so it had a decent bit of mindshare IMHO this could easily either go the open source route, or a small private team of assistants could help contribute to getting this going again and maybe contribute toward maintaining it in as people have spare time available. - You appear to have some level of one-step-beyond-MVP mindshare, and a catchy name. Not only would this make it tricky for forks to take off in an open-source setting, but I can also see full-clone attempts being promptly chased away with pitchforks as well. This is the scenario where open source shines I think - the risk of wholesale copying seems interestingly low. - You aren't interested in this for the money, so opening the codebase doesn't really let especially novel cats out of any bags - There is enough clear interest that people will definitely show up to help Some other considerations: - Instead of committing to open-sourcing immediately you could also build a team out of all the people expressing interest in contributing spare time. I honestly wonder if the energy level would be lower than a traditional open source project. In this case I can see enough interest coming to the table to help unravel the existing codebase, and enough people might even stick around long-term to help out with simple maintenance hitches and fixes as they come up. - If there were any concerns about forks/clones the exceptionally restrictive AGPLv3 would probably take care of those sufficiently well (perhaps this is a good question for the theoretical team mentioned above) TL;DR, my opinion is that if you maybe want to take a break for a while but dive back into this in the future CHANGE THE WEBPAGE NOW while eyeballs are still looking at it. Point people at a Discord server or empty GitHub repository (lots of closed-source stuff uses GitHub for issues) to pin or star so they get pinged when there's activity in the future. Of course the caveat is that I can only respond to the context I can see, and this may not be useful advice. Kind of an on-the-spot "uhhhhh....", good luck :P

p0d 4y ago

I'm an older guy Chris and I'm guessing you are in your 20/30s? I was just musing today how my home networking hobby shaped my work life. I'm sure the journey you have been on will shape your life too. Keep doing the stuff :-)

weddpros 4y ago
Hey! I'm 50 actually :-) I'll keep doing the stuff nonetheless! Cheers

thomastay 4y ago

Sorry, but since the about page of sslping is down, what is it? From what i can tell from the scant information on the internet, it's a monitoring tool that tells you when your websites have a SSL vulnerability?

Jenda_ 4y ago

I'm not sure about exact features of this service (I didn't know about it), but I'm using: - https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/ - nmap --script ssl-enum-ciphers news.ycombinator.com -p 443 The nmap one works with various non-HTTP protocols, such as IMAPS and FTPS. The Qualys service is much more detailed, including hints about certificate chain problems etc.

archon810 4y ago
According to the OP, ssllabs takes much longer to run a similar check https://news.ycombinator.com/item?id=30993593 https://news.ycombinator.com/item?id=30993593.

sweatC 4y ago

Hey Chris, please don't kill the project. Instead, give it a chance to live by selling to another founder willing to take on SSLPing. I'd be happy to help you find this person through my site called Microns(https://www.microns.io https://www.microns.io). I have an audience of entrepreneurs and founders who will like your project. Just let me know if you would like to be featured.

edumucelli 4y ago

I have a service with hundreds of requests per day, thousands of users, it is an old RoR app that is impossible to update now, 3 major versions behind latest, several dependencies that can't be built on newer Ruby versions. Even the Ruby version it is using can't be build anymore on more recent OSs because of OpenSSL incompatibilities. It will take hundreds of hours to be updated, which at some point will be almost (or even less) than building it again from scratch. As I do not have this time, it will probably die a slow death.