Hacker News Reader

Comment by atonse | Hacker News Reader

In addition to things like Let's Encrypt, in more enterprise-y settings, I would also give credit to the slowly dying belief that SSL/TLS is too taxing on servers, and the ability to outsource your SSL/TLS termination to an extremely cheap cloud load balancer as well.

View on HN

HTTPS is also faster on the wire because intermediaries can't inspect the payload so they just forward it.

Its ironic that with Spring, NHibernate and all the other bloated enterprise libs or thread-per-request models they still worry about SSL performance.

Yes, all this. Although it drives me nuts that people consider SSL to be a deterrent to load times when the average page is as bloated as it is...

But yeah, LetsEncrypt made SSL free, and for us, AWS's free auto-renewing certificates were the thing that made it easy to not have to worry about certificates anymore and to use them gratuitously.

Edit: looking forward to all the Dreamhosts of the world making LetsEncrypt-based SSL standard on even their cheapest plans.

Agreed, the main reason most pages are slow these days is because they are slow- blaming it on SSL is pure scapegoating

AWS is what I use personally, and their certificate service is a breeze to use. Couple that with the ability to attach the certificate directly to the load balancer (one of the best features of the LB, in my mind), or to a Cloudfront distribution, and it's amazingly simple to have everything running with SSL.

We should also give credit to HTTP/2 (available only through HTTPS). People want the performance increase of HTTP/2 so they are forced to deploy HTTPS.

it's not only available through https. browser only allow http/2 over TLS thats something different. there is a insecure http/2 version just no browser implements it.

I think that's pretty much the exact definition of "available" in this context. If it just exists in a RFC somewhere, I wouldn't call it "available".

I really doubt that - support for HTTP/2 is generally still in its infancy, and web servers supporting it haven't made it into LTS releases of most distros yet.

On a talk from Daniel Stenberg earlier this year he told that over 60% of the clients already support HTTP/2. So there is a real incentive to start supporting it as it nearly always is faster and costs less connections for the server.

Eyeballing the stats at http://caniuse.com/#search=http2 I think it's more like 85% of clients support it.

I installed HTTP/2 indicator extension for my browser and I am very surprised to see how many sites are already using HTTP/2. It's easily close to a third of the sites I use frequently.

I wonder if those are mostly sites using Cloudflare and similar, which supports HTTP/2 regardless of the upstream server's support.

"Outsourcing TLS termination" is intentionally MitMing your users. Not really something to be happy about.

If you're outsourcing your TLS termination to the same people who are running your servers, you've barely made it easier for them to MITM your users. They could easily grab the private key off your server and do it anyway.

That's a big if. I was thinking about services like Cloudflare that terminate SSL close to the user, then tunnel the traffic to your servers. It cuts down on handshake latency and allows for secure distribution of cacheable content easily, but in return you are essentially handing your plaintext over to Cloudflare.

Reply on news.ycombinator.com