3 ms·

> StartSSL offers free class 1 certificates. Don't know if that's any use to you. No, that doesn't work. 0. Once you go https, you're basically hooked. Wha

by cnst 12y ago

> StartSSL offers free class 1 certificates. Don't know if that's any use to you. No, that doesn't work. 0. Once you go https, you're basically hooked. What if StartSSL stops offering free certs tomorrow? They've been offering free certs for ages now, yet still have no competition! So much for the free market. 1. What if you have a good dozen of different domains? The cheapest multidomain certificates seem to start 50$+/domain/year, that's a pretty hefty price tag for non-commercial projects. We need something like STARTTLS in smtp/xmpp/etc for http, which just protects the traffic from eavesdropping and passive attacks. Because right now as it is, from the user's experience, having a self-signed https is WORSE than not having any https at all. Do you get any warnings on http web-sites? What about self-signed https? WTF? I don't live in Iran, but I completely agree with the OP that TLS is not ready yet, by not being affordable and dependable. I'll adopt TLS for http as soon as, (1), I can guarantee that existing users won't suffer, (2), I won't be required to update certificates all the time (when was the last time you've updated your ssh certs?), (3), I won't be required to pay hundreds/thousands of dollars (per year) to secure all my domains.

Alupis 12y ago
You do know TLS and SSL can be on the same server? In fact, if you are on a modern browser, look at the SSL cert HN is using -- it should show you are using TLS 1.2. -- so no users "suffer". Some SSL certs have become bloated in price (without good reason), such as the VeriSign certs, etc. No SSL cert should cost $300 a year... that's absurd. However, they can't be free... someone has to pay for the infrastructure that not only signs certs, but provides the trust backbone that SSL rides on.
- cnst 12y ago
  > In fact, if you are on a modern browser, look at the SSL cert HN is using -- it should show you are using TLS 1.2. -- so no users "suffer". No, once you go SNI and people start sharing https links, you basically cut off all users who have older browsers. Which is complete bullshit -- they should just be getting the non-encrypted web-site, just like what happens with smtp and STARTTLS. > No SSL cert should cost $300 a year Yet you won't find a cert for a dozen different domains cheaper than 600$/year. And what if you want to wildcard each of those domains, too? > someone has to pay for the infrastructure that not only signs certs, but provides the trust backbone that SSL rides on. And I should care about the trust backbone for my personal web-site and non-commercial projects why exactly?
  - gaadd33 12y ago
    > And I should care about the trust backbone for my personal web-site and non-commercial projects why exactly? You don't have to. Issue a self signed cert and provide instructions to add it to the browser as a trusted certificate authority. The fact that no one trusts you by default becomes your problem, the alternative is caring about the trust backbone (or I suppose, paying Microsoft, Apple, Google and Mozilla to add your CA, but I would guess that will run a bit more than $600/year.)
    - cnst 12y ago
      > You don't have to. Issue a self signed cert and provide instructions to add it to the browser as a trusted certificate authority. The fact that no one trusts you by default becomes your problem, the alternative is caring about the trust backbone (or I suppose, paying Microsoft, Apple, Google and Mozilla to add your CA, but I would guess that will run a bit more than $600/year.) The issue everyone seems to be ignoring is that PEOPLE ALREADY TRUST HTTP! They ALREADY trust my http web-site! All of them, on all domain names, and through all redirects! Why should I take extra steps for them to lose such trust through adopting https? Why? There is no economic benefit for me to add https. None. As much as I'd like to contribute to encrypting the whole internet, the whole https concept (with no backwards compatibility with http) is just too much trouble to deal with.
      - gaadd33 12y ago
        How do they know they are getting your website? Do you care if their ISP is injecting banner ads and messing with your layout? If you are just serving up hobby projects and personal stuff, there's probably no economic benefit to hosting it yourself anyway.
        cnst 12y ago
        > How do they know they are getting your website? Do you care if their ISP is injecting banner ads and messing with your layout? If their ISP is injecting banner ads, then all bets are off! Nothing I can do about it! They should change ISPs, or browse through a proxy. Or are you supporting the concept of fast lanes in the net neutrality debate? I should pay up to the CAs to get treated more preferentially by the ISPs? > If you are just serving up hobby projects and personal stuff, there's probably no economic benefit to hosting it yourself anyway. Yeah, right! Now I'm suddenly guilty of hosting my personal stuff myself! Maybe I should ask Comcast or AT&T to host it for 3x the price I pay by hosting myself on a cheapo dedi? https://comcast.net https://comcast.net What? They don't offer https, either?!

by cnst 12y ago

Alupis 12y ago

You do know TLS and SSL can be on the same server? In fact, if you are on a modern browser, look at the SSL cert HN is using -- it should show you are using TLS 1.2. -- so no users "suffer". Some SSL certs have become bloated in price (without good reason), such as the VeriSign certs, etc. No SSL cert should cost $300 a year... that's absurd. However, they can't be free... someone has to pay for the infrastructure that not only signs certs, but provides the trust backbone that SSL rides on.

cnst 12y ago
> In fact, if you are on a modern browser, look at the SSL cert HN is using -- it should show you are using TLS 1.2. -- so no users "suffer". No, once you go SNI and people start sharing https links, you basically cut off all users who have older browsers. Which is complete bullshit -- they should just be getting the non-encrypted web-site, just like what happens with smtp and STARTTLS. > No SSL cert should cost $300 a year Yet you won't find a cert for a dozen different domains cheaper than 600$/year. And what if you want to wildcard each of those domains, too? > someone has to pay for the infrastructure that not only signs certs, but provides the trust backbone that SSL rides on. And I should care about the trust backbone for my personal web-site and non-commercial projects why exactly?
- gaadd33 12y ago
  > And I should care about the trust backbone for my personal web-site and non-commercial projects why exactly? You don't have to. Issue a self signed cert and provide instructions to add it to the browser as a trusted certificate authority. The fact that no one trusts you by default becomes your problem, the alternative is caring about the trust backbone (or I suppose, paying Microsoft, Apple, Google and Mozilla to add your CA, but I would guess that will run a bit more than $600/year.)
  - cnst 12y ago
    > You don't have to. Issue a self signed cert and provide instructions to add it to the browser as a trusted certificate authority. The fact that no one trusts you by default becomes your problem, the alternative is caring about the trust backbone (or I suppose, paying Microsoft, Apple, Google and Mozilla to add your CA, but I would guess that will run a bit more than $600/year.) The issue everyone seems to be ignoring is that PEOPLE ALREADY TRUST HTTP! They ALREADY trust my http web-site! All of them, on all domain names, and through all redirects! Why should I take extra steps for them to lose such trust through adopting https? Why? There is no economic benefit for me to add https. None. As much as I'd like to contribute to encrypting the whole internet, the whole https concept (with no backwards compatibility with http) is just too much trouble to deal with.
    - gaadd33 12y ago
      How do they know they are getting your website? Do you care if their ISP is injecting banner ads and messing with your layout? If you are just serving up hobby projects and personal stuff, there's probably no economic benefit to hosting it yourself anyway.
      - cnst 12y ago
        > How do they know they are getting your website? Do you care if their ISP is injecting banner ads and messing with your layout? If their ISP is injecting banner ads, then all bets are off! Nothing I can do about it! They should change ISPs, or browse through a proxy. Or are you supporting the concept of fast lanes in the net neutrality debate? I should pay up to the CAs to get treated more preferentially by the ISPs? > If you are just serving up hobby projects and personal stuff, there's probably no economic benefit to hosting it yourself anyway. Yeah, right! Now I'm suddenly guilty of hosting my personal stuff myself! Maybe I should ask Comcast or AT&T to host it for 3x the price I pay by hosting myself on a cheapo dedi? https://comcast.net https://comcast.net What? They don't offer https, either?!