4 ms·

the smaller sites currently not using SSL will just be stuck on HTTP 1.1 forever Is it a problem?

by dchest 13y ago

esolyt 13y ago
I don't think so. We are also "stuck" on IPv4 which hasn't been a problem.
josteink 13y ago
Saying that you can only use this new technology if you are willing to hand out $100 a year to some third party provider which you really don't see the need for is a major hindrance to adoption. Imagine if every former "free" technology (tcp/ip, email, http, c-compiler, whatever) demanded you pay $100 annually to use it. How many hackers creating things which we now take for granted do you think would have been discouraged from doing just so? Security is nice, but that doesn't mean it's worth it or required all over, at any cost. De-facto requiring a paid "license" to operate on the internet is not the right way to go.
- hrktb 13y ago
  If you think it as something similar to DNS it's not so shocking. Right now we are handing cash to get a usable domain name, or ask some other entity to share a space on their domains. Now you'll also pay for you SSL certificate or ask some other entity to let you share a piece of theirs.
- dchest 13y ago
  There's nothing in this technology that demands payment. You can distribute your own root certificate to clients, or create a free certification authority (or join http://www.cacert.org/ http://www.cacert.org/), if you'd like.
- pilif 13y ago
  What are you running your web servers on? How do you connect these web servers to the internet? How do you register your domain? I would assume that you pay more than $100/y (which is expensive for a domain validated SSL cert, btw) unless you're using a free hosting provider at which point it's not your decision what protocol to use anyways.
  - josteink 13y ago
    I have 10mbps upstream connection. I have a Raspberry pi and a Linux-powered NAS. I have lots of equipment which costs me nothing to use, which I can use to host or create new internet services. And I do. No, it wont let me run a multi-million user site, but that's not my aim, nor should it be needed to let people new at the game fool around. Putting the bar higher and higher to just being able to fool around is so utterly the wrong way to go. I wonder if anyone on this site remembers what is was like to be 8 years old and already being able to program your first program on your TRS-80 or Commodore 64. No money needing to be spent, no need to seek permission. Just hack. Get immediate, direct feedback. Instantly gratifying. That appraoch gave us a generation of computer-professionals unlike any other. Why are we so eager to put the road-blocks on now?
    - dchest 13y ago
      Get immediate, direct feedback. Instantly gratifying. That appraoch gave us a generation of computer-professionals unlike any other. Are you kidding? Just a few decades ago you would need to pay a lot for machine time to be able to use computer. Today you can sit near a cafe with a $200 netbook and have a free internet access. In the 90's a .com domain cost ~$100. Just a few years ago TLS certificate cost close to the hundred, today you can buy one at around $10 per year or sometimes get it for free. You have 10mbps connection! At your home! How much do you pay for it?
      - josteink 13y ago
        Get over my connection. Some places it's quite common. The thing is you are both missing the point: The tech landscape is growing increasingly complex. We shouldn't be adding more obstacles to getting involved than we already have. That's how horrible Legacy-things get built. We don't need to do that to our internet.
        ugexe 13y ago
        It's only a barrier to entry if you insist on using http 2.0 which is a CHOICE you make. Don't use http 2.0, just like you can choose to use your internet connection for whatever.
- stephen_g 13y ago
  You can get free SSL certificates from StartSSL. There are also domain registrars who give you a certificate with domains you buy for no extra cost, and other CAs which are less than $10 a year. And if none of those float your boat, you can always self sign if your willing to put up with the warning messages. Your argument seems extremely hyperbolic.
- guilloche 13y ago
  Cannot agree more. Besides $100 annually, a CA certificate is harder to manage (considering cloud hosting etc.), and it is not worth doing for many casual sites. I predict that https only http/2 will be doomed.

the smaller sites currently not using SSL will just be stuck on HTTP 1.1 forever Is it a problem?

by dchest 13y ago

the smaller sites currently not using SSL will just be stuck on HTTP 1.1 forever Is it a problem?

esolyt 13y ago

I don't think so. We are also "stuck" on IPv4 which hasn't been a problem.

josteink 13y ago

Saying that you can only use this new technology if you are willing to hand out $100 a year to some third party provider which you really don't see the need for is a major hindrance to adoption. Imagine if every former "free" technology (tcp/ip, email, http, c-compiler, whatever) demanded you pay $100 annually to use it. How many hackers creating things which we now take for granted do you think would have been discouraged from doing just so? Security is nice, but that doesn't mean it's worth it or required all over, at any cost. De-facto requiring a paid "license" to operate on the internet is not the right way to go.

hrktb 13y ago
If you think it as something similar to DNS it's not so shocking. Right now we are handing cash to get a usable domain name, or ask some other entity to share a space on their domains. Now you'll also pay for you SSL certificate or ask some other entity to let you share a piece of theirs.
dchest 13y ago
There's nothing in this technology that demands payment. You can distribute your own root certificate to clients, or create a free certification authority (or join http://www.cacert.org/ http://www.cacert.org/), if you'd like.
pilif 13y ago
What are you running your web servers on? How do you connect these web servers to the internet? How do you register your domain? I would assume that you pay more than $100/y (which is expensive for a domain validated SSL cert, btw) unless you're using a free hosting provider at which point it's not your decision what protocol to use anyways.
- josteink 13y ago
  I have 10mbps upstream connection. I have a Raspberry pi and a Linux-powered NAS. I have lots of equipment which costs me nothing to use, which I can use to host or create new internet services. And I do. No, it wont let me run a multi-million user site, but that's not my aim, nor should it be needed to let people new at the game fool around. Putting the bar higher and higher to just being able to fool around is so utterly the wrong way to go. I wonder if anyone on this site remembers what is was like to be 8 years old and already being able to program your first program on your TRS-80 or Commodore 64. No money needing to be spent, no need to seek permission. Just hack. Get immediate, direct feedback. Instantly gratifying. That appraoch gave us a generation of computer-professionals unlike any other. Why are we so eager to put the road-blocks on now?
  - dchest 13y ago
    Get immediate, direct feedback. Instantly gratifying. That appraoch gave us a generation of computer-professionals unlike any other. Are you kidding? Just a few decades ago you would need to pay a lot for machine time to be able to use computer. Today you can sit near a cafe with a $200 netbook and have a free internet access. In the 90's a .com domain cost ~$100. Just a few years ago TLS certificate cost close to the hundred, today you can buy one at around $10 per year or sometimes get it for free. You have 10mbps connection! At your home! How much do you pay for it?
    - josteink 13y ago
      Get over my connection. Some places it's quite common. The thing is you are both missing the point: The tech landscape is growing increasingly complex. We shouldn't be adding more obstacles to getting involved than we already have. That's how horrible Legacy-things get built. We don't need to do that to our internet.
      - ugexe 13y ago
        It's only a barrier to entry if you insist on using http 2.0 which is a CHOICE you make. Don't use http 2.0, just like you can choose to use your internet connection for whatever.
stephen_g 13y ago
You can get free SSL certificates from StartSSL. There are also domain registrars who give you a certificate with domains you buy for no extra cost, and other CAs which are less than $10 a year. And if none of those float your boat, you can always self sign if your willing to put up with the warning messages. Your argument seems extremely hyperbolic.
guilloche 13y ago
Cannot agree more. Besides $100 annually, a CA certificate is harder to manage (considering cloud hosting etc.), and it is not worth doing for many casual sites. I predict that https only http/2 will be doomed.