Hacker News Reader

Comment by callmeed | Hacker News Reader

Consider this:

- Squarespace doesn't support SSL (other than on their ecommerce checkout pages) [1]

- Weebly only allows it on their $25/mo business plan [2]

- Wordpress.com doesn't support SSL for sites with custom domains [3]

- If you've never experienced the process of requesting, purchasing, and then installing an SSL certificate using a hosting control panel like Plesk or cPanel, let me tell you–it's a nightmare.

All that to say, this is an interesting development that will leave a large % of small business websites with a red mark in their browser.

[1] https://support.squarespace.com/hc/en-us/articles/205815898-...

[2] http://www.weebly.com/pricing

[3] https://en.forums.wordpress.com/topic/support-for-https-for-...

View on HN

Then maybe those platforms will finally implement it. In any case, there's an alternative: putting Cloudflare in front of the site. In fact, Google shows me a guide to do so when I search for "squarespace ssl".

Of course, that's hardly as secure as end-to-end HTTPS, but still, I trust the path between CF and SquareSpace much more than between the user's browser and SquareSpace.

Please do not put Cloudflare in front of your site. It makes it impossible for tor and VPN users to view your site since they have to solve an impossible captcha to even see the static content.

It's possible to turn off security in the CloudFlare control panel. I think the bigger issue is that CloudFlare has become a single point of interception for MITM'ing huge portions of web traffic.

I'm not sure, but I think CloudFlare will still hit Tor users with (unsolvable) captchas even with the lowest security settings.

But yeah, this NSA slide is extremely relevant to cloudflare: http://cdn01.androidauthority.net/wp-content/uploads/2014/06...

> I think CloudFlare will still hit Tor users with (unsolvable) captchas even with the lowest security settings.

That is correct. I have not been able to get passed a Cloudflare captcha over tor for any website.

I wonder how it's even allowed for CF to do this. "your site" <--- http ---> CF <--- https ---> clients is a poor solution and it only hides that the connection is actually not secure. Isn't this a misuse of many CA's TOS and should result in certificate revocation? Maybe I'm wrong though.

Well, at least for several threat models, "your site to CF" is at least slightly better than "CF to clients". It's not vulnerable to things like unsecured wi-fi sniffing. Then again, neither are self-signed certs and for some reason all browsers consider them even worse than no cert.

On the other hand, it doesn't protect against government spying, but then again, I think some governments straight-up MitM HTTPS traffic anyway. For instance:

https://news.ycombinator.com/item?id=10663843

But putting CloudFlare in front of your site makes mass surveillance even easier than it would be for plaintext traffic without CloudFlare.

Yeah I'm all for SSL shaming but my personal site with SquareSpace is about to look like shit for me since I'm a web developer. I mean as a web developer it's not going to look good if your portfolio is shown with a security warning.

I wonder if SquareSpace is going to finally fix their shit or if I'm going to have to move elsewhere which is going to be a pain (I went with SquareSpace because I didn't want to be assed with dealing with much of anything for a personal site).

No offense intended with this, but, as a web developer, what the heck are you doing creating your site on SquareSpace? Shouldn't you...I dunno...develop your own web site?

No offense intended, but as a web developer, why the heck would I waste my time coding things from scratch, setting up tooling, deployment infrastructure and managing yet another server when I could use a service that does all of that for me? For certain contexts it is far superior. Right tool for the right job, and all that.

Because they don't get paid to build their own stuff. They get paid to do work for clients. A variation on the "shoemaker has no shoes."

With that argument, there should be no marketing departments.

...no, the marketing department's job is to market the company and keep it in the public eye. Perhaps you're thinking of an advertising agency. And I've observed they have the same problem.

If a web developer was large enough to have its own marketing department it could maintain its own site.

In any event, I'm busy developing apps for clients all day - I don't get paid to work on my own stuff so it has lower priority.

I would much rather spend my time creating cool shit to share on GitHub and my site rather than maintain and pay bandwidth, CPU usage, etc bills just so I have a very basic blog and portfolio. Any web developer can write their own blog and website so who cares about that?

Why not just put your SquareSpace site behind Cloudflare? Then you get free SSL.

Good point! I might look into doing just that.

DreamHost now supports Let's Encrypt through their admin panel. The only instructions, however, are a community-maintained wiki page that is already outdated, referring to panel menus that no longer exist. I successfully obtained my certificate, but it was not easy.

Based on your comment, I went over to see if I could obtain a certificate.

It took all of 5 seconds for me to do - it's all automated via the admin panel now. Just tick the box to make your site secure. Looks like DH has resolved any initial issues they had.

Plesk built a Let's Encrypt extension: https://devblog.plesk.com/2015/12/lets-encrypt-plesk/

I've managed to get Let's Encrypt working on a shared hosting environment using letsencrypt-nosudo in less than half an hour from the time I started cloning the repo to finally pasting the cert into cPanel. And every step in that process except the final one of installing the cert using cPanel can be automated.

The --webroot module for LetsEncrypt is as easy as pointing to /var/www.

Reply on news.ycombinator.com