5 ms·

What's the big impediment to just making all websites https, all the time? Technical? Financial? Honest question.

by plg 12y ago

monort 12y ago
For small sites it's mostly certificate and dedicated IP price. Wildcard certificates price is especially egregious. For big sites - probably their load balancers can't handle the https load.
- lorenzhs 12y ago
  Dedicated IP? I thought SNI was supported just about everywhere by now. Also, if all you need is a certificate for one subdomain (or maybe a couple of certificates for one subdomain each), a StartSSL certificate is free. It's not SuperDuperSign Extra Validation Plus Platinum, but it's accepted by all major browsers ;) EDIT: Wikipedia tells me "As of November 2012, the only major user bases whose browsers do not support SNI appear to be users of Android 2.x (default browser), Internet Explorer on Windows XP and versions of Java before 1.7 on any operating system." - a small company should be fine.
  - Perseids 12y ago
    Remember that this is not about browsers, but about the TLS libraries the calendar software uses. For instance Java only supports SNI since version 7.
    - _delirium 12y ago
      The Python SNI situation was also cleared up very recently, with commits to some of the widely used libraries only happening in mid-2013. I wouldn't be surprised if many installations haven't yet upgraded to those post-2013 versions. See e.g.: https://github.com/shazow/urllib3/pull/156 https://github.com/shazow/urllib3/pull/156
- sbarre 12y ago
  A wildcard SSL certificate is $250 per year. You can't tell me that this is a prohibitive cost for someone operating a serious business.
  - onion2k 12y ago
    For an established business that you know is going to make thousands of dollars in the next year it's trivial, but for a new business with an unknown future it's a pretty big addition. If setting up a new venture had a minimum cost of $250 (rather than being close to $0 as it is now) we'd see fewer side projects and part-time entrepreneurs.
  - mikeash 12y ago
    The question was "all website", not merely websites belonging to serious businesses.
  - blueskin_ 12y ago
    For a small site is is. SSL certs are basically a cartel. They should work more like the PGP web of trust.
  - deleted 12y ago
    [deleted]
  - ceejayoz 12y ago
    Wildcards are under $100 at Namecheap, and in most cases a business that can't afford $100/year probably doesn't need a dozen subdomains and can go with the $7/year for www.
mseebach 12y ago
It's probably technical - this is exporting to external calendar apps. I think it's perfectly plausible that a large number of broadly used calendar apps just don't support HTTPS imports, and probably fails in desperately graceless way - and so the decision is between supporting the feature insecurely, supporting the feature securely, but dealing with tons of customers, many of them both paying and technically unsophisticated experiencing a failure that they ascribe to TripIt and maybe do, maybe don't contact support about - or not supporting the feature at all.
cheald 12y ago
Advertising is the big impediment for anyone that is ad-driven. Most ad networks don't provide HTTPS for ads. Kind of infuriating in this day and age, really. There are technical considerations - until we have full SNI coverage (Android 2.x is the big hole there right now), you can't really run HTTPS on shared hosting (or any place where you have multiple domains on the same IP). And there are financial considerations - while an SSL certificate isn't expensive, if you're using a CDN or doing any kind of otherwise serious data delivery, SSL is many times more expensive per-byte than HTTP is. If there isn't financial risk mitigation gained by switching to HTTPS-only, it may not make sense from a business perspective.

What's the big impediment to just making all websites https, all the time? Technical? Financial? Honest question.

by plg 12y ago

What's the big impediment to just making all websites https, all the time? Technical? Financial? Honest question.

For small sites it's mostly certificate and dedicated IP price. Wildcard certificates price is especially egregious. For big sites - probably their load balancers can't handle the https load.

lorenzhs 12y ago
Dedicated IP? I thought SNI was supported just about everywhere by now. Also, if all you need is a certificate for one subdomain (or maybe a couple of certificates for one subdomain each), a StartSSL certificate is free. It's not SuperDuperSign Extra Validation Plus Platinum, but it's accepted by all major browsers ;) EDIT: Wikipedia tells me "As of November 2012, the only major user bases whose browsers do not support SNI appear to be users of Android 2.x (default browser), Internet Explorer on Windows XP and versions of Java before 1.7 on any operating system." - a small company should be fine.
- Perseids 12y ago
  Remember that this is not about browsers, but about the TLS libraries the calendar software uses. For instance Java only supports SNI since version 7.
  - _delirium 12y ago
    The Python SNI situation was also cleared up very recently, with commits to some of the widely used libraries only happening in mid-2013. I wouldn't be surprised if many installations haven't yet upgraded to those post-2013 versions. See e.g.: https://github.com/shazow/urllib3/pull/156 https://github.com/shazow/urllib3/pull/156
sbarre 12y ago
A wildcard SSL certificate is $250 per year. You can't tell me that this is a prohibitive cost for someone operating a serious business.
- onion2k 12y ago
  For an established business that you know is going to make thousands of dollars in the next year it's trivial, but for a new business with an unknown future it's a pretty big addition. If setting up a new venture had a minimum cost of $250 (rather than being close to $0 as it is now) we'd see fewer side projects and part-time entrepreneurs.
- mikeash 12y ago
  The question was "all website", not merely websites belonging to serious businesses.
- blueskin_ 12y ago
  For a small site is is. SSL certs are basically a cartel. They should work more like the PGP web of trust.
- deleted 12y ago
  [deleted]
- ceejayoz 12y ago
  Wildcards are under $100 at Namecheap, and in most cases a business that can't afford $100/year probably doesn't need a dozen subdomains and can go with the $7/year for www.

mseebach 12y ago

It's probably technical - this is exporting to external calendar apps. I think it's perfectly plausible that a large number of broadly used calendar apps just don't support HTTPS imports, and probably fails in desperately graceless way - and so the decision is between supporting the feature insecurely, supporting the feature securely, but dealing with tons of customers, many of them both paying and technically unsophisticated experiencing a failure that they ascribe to TripIt and maybe do, maybe don't contact support about - or not supporting the feature at all.

cheald 12y ago

Advertising is the big impediment for anyone that is ad-driven. Most ad networks don't provide HTTPS for ads. Kind of infuriating in this day and age, really. There are technical considerations - until we have full SNI coverage (Android 2.x is the big hole there right now), you can't really run HTTPS on shared hosting (or any place where you have multiple domains on the same IP). And there are financial considerations - while an SSL certificate isn't expensive, if you're using a CDN or doing any kind of otherwise serious data delivery, SSL is many times more expensive per-byte than HTTP is. If there isn't financial risk mitigation gained by switching to HTTPS-only, it may not make sense from a business perspective.