7 ms·

That's not true. Let me give you an example from mobile app development. As many of you know, Amazon's CloudFront lets you make an in-app connection to cdn.exa

by declan 13y ago

That's not true. Let me give you an example from mobile app development. As many of you know, Amazon's CloudFront lets you make an in-app connection to cdn.example.com, which may be a DNS alias for something like drj6nl5tupx60.cloudfront.net. Amazon will generate a cache hit or miss and, if not cached, connect to your example.com servers. The ideal way to do this is to generate an SSL certificate for the CloudFront distribution, but Amazon charges you $7,200 per year for that privilege: http://aws.amazon.com/cloudfront/pricing/ http://aws.amazon.com/cloudfront/pricing/ So if you want to load non-private images, video, etc. content via HTTPS from cdn.example.com via SSL without giving Amazon $7,200 a year, there will be an invalid certificate chain error. Some app development environments (not pointing any fingers right now in hopes this gets fixed quickly) do not support bypassing SSL certificate checks. So in some cases the answer is not to deploy HTTPS. :(

nitrogen 13y ago
Some app development environments (not pointing any fingers right now in hopes this gets fixed quickly) do not support bypassing SSL certificate checks. So in some cases the answer is not to deploy HTTPS. :( Wouldn't it be better to be able to specify a set of accepted key fingerprints, instead of bypassing security checks altogether? Outright bypassing security checks will make MITM too easy.
6cxs2hd6 13y ago
> *The ideal way to do this is to generate an SSL certificate for the CloudFront distribution, but Amazon charges you $7,200 per year for that privilege: http://aws.amazon.com/cloudfront/pricing/ http://aws.amazon.com/cloudfront/pricing/ Maybe using SSL as an opportunity for a premium price gouge was smart business practice in the 90s. But these days, it's wrong. Charge for the actual cost. Even add your customary markup. But not some arbitrary $7200 fee. It may be legal, but it's unethical. Until they change it, Jeff Bezos and Werner Vogels should be ashamed of doing this.
rschmitty 13y ago
What's wrong with using the https on drj6nl5tupx60.cloudfront.net? Honest question.. no one is going to notice if they are getting assets on cdn.company.com vs drj6nl5tupx60.cloudfront.net, right?
- declan 13y ago
  It is a fair question. And you're right that no app user will ever notice. The problem is that it locks you into Amazon. If another company comes out with a much cheaper offering, or you want to switch to Google Cloud Storage, or (unlikely but I suppose possible) Amazon boots you for one reason or another, you're out of luck until you can get your installed base of app users to upgrade.

by declan 13y ago

nitrogen 13y ago

Some app development environments (not pointing any fingers right now in hopes this gets fixed quickly) do not support bypassing SSL certificate checks. So in some cases the answer is not to deploy HTTPS. :( Wouldn't it be better to be able to specify a set of accepted key fingerprints, instead of bypassing security checks altogether? Outright bypassing security checks will make MITM too easy.

6cxs2hd6 13y ago

> *The ideal way to do this is to generate an SSL certificate for the CloudFront distribution, but Amazon charges you $7,200 per year for that privilege: http://aws.amazon.com/cloudfront/pricing/ http://aws.amazon.com/cloudfront/pricing/ Maybe using SSL as an opportunity for a premium price gouge was smart business practice in the 90s. But these days, it's wrong. Charge for the actual cost. Even add your customary markup. But not some arbitrary $7200 fee. It may be legal, but it's unethical. Until they change it, Jeff Bezos and Werner Vogels should be ashamed of doing this.

rschmitty 13y ago

What's wrong with using the https on drj6nl5tupx60.cloudfront.net? Honest question.. no one is going to notice if they are getting assets on cdn.company.com vs drj6nl5tupx60.cloudfront.net, right?

declan 13y ago
It is a fair question. And you're right that no app user will ever notice. The problem is that it locks you into Amazon. If another company comes out with a much cheaper offering, or you want to switch to Google Cloud Storage, or (unlikely but I suppose possible) Amazon boots you for one reason or another, you're out of luck until you can get your installed base of app users to upgrade.