5 ms·

Kind of tangential: I recently wanted to move the hosting of my hobby/side gig site to an S3 static site (site generated by me). Thought it would be a few confi

Kind of tangential: I recently wanted to move the hosting of my hobby/side gig site to an S3 static site (site generated by me). Thought it would be a few configuration details in s3 and good to go. A full day later just to be usable in Chrome (since it defaults to https) I had to get a cert and standup a CDN just to make sure your average dingus web user wouldn’t try to navigate to my page and hit nothing. To be clear, my site doesn’t even have Javascript, and certainly no form submission. HTTPS is complete overkill and now it’s even more overkill overkill since I could be bombarded by half the world population and my site would likely stand up to it. In a way, they killed the hobbyist website with that bullshit.

bruce511 3y ago
So firstly, I agree - browsers should default to https not http if the protocol is not specified. It's a pain that they do http because it means I have to open port 80 and issue a redirect. That in itself is no big deal, since I usually have port 80 open anyway (for LetsEncrypt support.) That said, you raise a point I see a lot - your site is too "plain" to need https. Personally I think this argument is outdated. The key issue with plain sites being HTTP is that -additional- content can be injected into them. In others people might be reading text, or seeing images, that are not what you built. Advertising, sure. ISPs have fine that, but that's the least problem. What about injecting a political endorsement? What about altering any links to include (not your) affiliate id? Once you start thinking about the value of HTTP sites in this way you start to appreciate the many ways unencrypted sites can be exploited. Back in the day "amateur" meant better (because the creator had time to do it right) not worse. Being "professional" was code for "you get what you pay for, no more than that". I encourage all "hobbyist" Web producers to embrace that, to make it excellent, rather than to simply treat it as a "waste of time".
- beachy 3y ago
  > That said, you raise a point I see a lot - your site is too "plain" to need https. Personally I think this argument is outdated. In the early days, sites would often be mainly http, then the payment part would switch to https. That soon died and I think you are correct.
- dclowd9901 3y ago
  I don’t post affiliate links, I don’t blog and I don’t really care about some shitty ISP injecting shitty ads on my site, truth told. However if it means that it makes the user experience of browsing my site better, I can get with that.
yjftsjthsd-h 3y ago
> To be clear, my site doesn’t even have Javascript, and certainly no form submission. And when Comcast injects their own JavaScript into your site, what good will that do?
- dclowd9901 3y ago
  Let them? If the user has an unscrupulous ISP, there’s fat little I can do to guard against that anyway.
  - yjftsjthsd-h 3y ago
    > If the user has an unscrupulous ISP, there’s fat little I can do to guard against that anyway. Well, you could use HTTPS, which trivially defeats this attack.
Dylan16807 3y ago
That's a failure on S3's behalf. It should only take a few clicks to add a certificate, not setting up a separate CDN.
- dclowd9901 3y ago
  Fair point. It really shouldn’t be a hassle at the end of the day.

bruce511 3y ago

So firstly, I agree - browsers should default to https not http if the protocol is not specified. It's a pain that they do http because it means I have to open port 80 and issue a redirect. That in itself is no big deal, since I usually have port 80 open anyway (for LetsEncrypt support.) That said, you raise a point I see a lot - your site is too "plain" to need https. Personally I think this argument is outdated. The key issue with plain sites being HTTP is that -additional- content can be injected into them. In others people might be reading text, or seeing images, that are not what you built. Advertising, sure. ISPs have fine that, but that's the least problem. What about injecting a political endorsement? What about altering any links to include (not your) affiliate id? Once you start thinking about the value of HTTP sites in this way you start to appreciate the many ways unencrypted sites can be exploited. Back in the day "amateur" meant better (because the creator had time to do it right) not worse. Being "professional" was code for "you get what you pay for, no more than that". I encourage all "hobbyist" Web producers to embrace that, to make it excellent, rather than to simply treat it as a "waste of time".

beachy 3y ago
> That said, you raise a point I see a lot - your site is too "plain" to need https. Personally I think this argument is outdated. In the early days, sites would often be mainly http, then the payment part would switch to https. That soon died and I think you are correct.
dclowd9901 3y ago
I don’t post affiliate links, I don’t blog and I don’t really care about some shitty ISP injecting shitty ads on my site, truth told. However if it means that it makes the user experience of browsing my site better, I can get with that.

yjftsjthsd-h 3y ago

> To be clear, my site doesn’t even have Javascript, and certainly no form submission. And when Comcast injects their own JavaScript into your site, what good will that do?

dclowd9901 3y ago
Let them? If the user has an unscrupulous ISP, there’s fat little I can do to guard against that anyway.
- yjftsjthsd-h 3y ago
  > If the user has an unscrupulous ISP, there’s fat little I can do to guard against that anyway. Well, you could use HTTPS, which trivially defeats this attack.

Dylan16807 3y ago

That's a failure on S3's behalf. It should only take a few clicks to add a certificate, not setting up a separate CDN.

dclowd9901 3y ago
Fair point. It really shouldn’t be a hassle at the end of the day.