Hacker News Reader

Comment by fiatjaf | Hacker News Reader

It is still expensive and cumbersome to implement HTTPS. Everybody seems to be neglecting the small websites deployed by hand, which are probably 99% of all the internet websites.

View on HN

Cumbersome? For most non-professionals running a small site, absolutely. That's where hosting providers need to step up to make it as easy as possible.

Expensive? How?

Thanks to Let's encrypt and others, certificates are now free.

Free is not the same as 'automatic' - until the process of obtaining a certificate and installing it on all the popular web hosting platforms is invisible to the site-owner then there will always be a barrier to implementation.

cPanel, which runs most of the cheap web hosting platforms, now includes a Lets Encrypt plugin. In the coming update, it will be a plugin enabled by default.

I'm sorry but I wouldn't call certificates with a lifetime of 90 days practical and I'm a developer.

Let's Encrypt is still far from being convenient and usable for small companies or individuals that don't want to manage infrastructures and administration like writing a cron job that refreshes your certificate.

Yes that one liner takes so much effort to write [EDIT: copy from one of the bazillion articles that have already done it for you]. That's why we can't have security. It takes too much effort.

For fun, next time you are on public transport, or sitting in an airport lounge, stand up and ask loudly 'Does anyone know what cron is?"

The lack of raised hands, should answer for you why LetsEncrypt is not ready for mainstream use.

Until Cert renewal is baked into all the hosting apps/platforms - HTTPs will never be ubiquitous.

Most of those people don't host their own websites, either.

But there are some who do.

Not that they host it with their own computers, but they rent some space online and host it there.

uMatrix offers a feature to randomly pick a UA every 5 minutes from a set of known UAs. This works, although GMail might complain about the UA being too old. Reloading GMail resolves that.

EDIT: Replied to the wrong parent, please ignore in this context.

I'm pretty sure you replied to the wrong comment. Or I'm more lost than I thought...

EDIT: You can't delete comments with replies anymore. It's very annoying.

I did, sorry. And I cannot delete it, will amend the comment and find and comment in the right context.

I would counter that small web sites deployed by hand are a lot less than 99% of all internet sites, because hand-deployed sites tend to go to down and never come back up.

Most of those smaller sites are deployed using cPanel, and most cPanel providers have/will have a LetsEncrypt plugin to make automated HTTPS setup easy.

Ok, so we are good for all websites written in PHP (?)

I build a lot of "small sites" and you're correct - implementing SSL for them on a typical shared host is not drop dead easy (also not free).

I also host with WPEngine, a more progressive WordPress only host - which has made SSL implementation extremely simple. They're an example of a modern approach to web hosting.

It's the low cost, shared (LAMP) hosting providers that need to implement it into their sales process and make switching existing non-encrypted sites smooth. Unfortunately, I don't see them moving to "free SSL for everyone!" anytime soon as it's a revenue generator for most.

You could also use something like Laravel Forge to spin up a LEMP server which has lets encrypt support built in.

https://forge.laravel.com

(it's not exclusive to just laravel apps)

Reply on news.ycombinator.com