4 ms·

I like it, but I'd probably put that on 443 with TLS. The threat model and attacks developed since web 1.0 have increased in complexity and sophistication and

• superkuh 3y ago
  As an option that's fine but it brings in a big dependency stack and lots of moving parts. acme2 might not look like it from the user end but internally there's a lot that's going on those acme programs are hiding. HTTP+HTTPS assures a site doesn't die just because of a cert renewal or CA problem (like LE's root cert expiring a couple years back, the switch from acme 1 to acme 2, your particular acme client having a dep that breaks on update, etc). While commercial and institutional sites do have to operate with a different security model these days, human people not involved in monetary exchange or private information have the same requirements as ever. HTTPS is optional. A nice add-on but not vital. And definitely not HTTPS only if you want your site to last more than a few years without active manual mantainance.
  • clwg 3y ago
    You could also self sign - It's going to be grating for users, but your still afforded the protections against any hop on the path.