Hacker News Reader

Comment by copperx | Hacker News Reader

Same applies to GitHub pages.

GHP means you're subject to github's downtime, which tends towards more frequent than s3 (outside us-east-1). Worse, you can't run HTTPS with GHP and a custom domain.

You could use CloudFlare's flexible TLS, but it's unsecured from their system to your site, which has resulted in carrier level content being injected[0].

[0]: https://news.ycombinator.com/item?id=12091900

That's what got me to host my Jekyll sites on my own too (lack of proper end-to-end SSL on a custom domain).

Also, if you're not using S3 / CloudFront you can use Let's Encrypt to issue free SSL certificates on any cloud hosting provider.

It's an awesome set up once you know how to get everything up and running.

I even recently released a course[0] that explains how to do it step by step (setting up a custom domain, hosting multiple sites on 1 DigitalOcean server, A+ SSL ratings for both nginx and Apache, etc.).

It takes less than 1 minute to deploy and protect any custom site (or web app), since the course comes with ready to go configs and scripts too.

[0]: https://httpswithletsencrypt.com/

You can run GHP over HTTPS through services like e.g. Cloudflare.

I originally tried github pages, but had issues with getting an SSL cert working with Cloudflare. I ended up using AWS Certificate Manager to add an auto updating cert to CloudFront.

Do you have a login? Or why would you need SSL on a static page?

You can use HTTPS to secure many things, not only login details. Not least of all, the privacy of your users/readers.

There's also integrity of your site, and many more future proof reasons. These days, there's no reason _not_ to use HTTPS, really.

https://developers.google.com/web/fundamentals/security/encr...

Except for the difficulty of managing and keeping up to date with TLS (I'd have to upgrade my RPi's OS for example, to do it well), and the fact that it actually reduces performance for small simple sites with local readership, even with HTTP/2 for example.

http://www.earth.org.uk/note-on-carbon-cost-of-CDN.html

Edit: I note that I got downvoted, though no reply with reasons. I accept that it is currently widespread dogma/fashion that everything should be HTTPS, and there are some good reasons for it, but as someone that has worked in what might be called 'real' security in on-line finance for example, I fear that HTTPS-everywhere is as much security theatre or cargo cult as taking your belt off at the airport scanners...

The one thing that HTTPS provides on non-sensitive, or even non-interactive sites is privacy; it hides the request URI from prying eyes (ISP, government etc.) That's worth a lot to me.

My sites are totally anodyne and not going to cause anyone any embarrassment; bank auditors tell me to relax a bit. The Chinese government was happy to grant me a site 'licence'.

That's not worth a slow-to-load or even failing-to-load page.

If all inoffensive sites ditched HTTPS, merely making an HTTPS request would justifiably arouse suspicion.

It's important to make sure that inoffensive sites are behind the same barrier, to make that a poor signal.

We have to hurt everyone to attempt to mask this weak signal?

For most sites, the Google organic search penalty for not having https is reason enough.

I have run side-by-side tests with the same site exposed both over http and https from a very performant CDN, and right now Google showed the http site on a simple search, not https, for example.

I don't believe that any penalty is currently significant, nor likely to be soon. There's plenty of good historic sites which SEs don't want to exclude just because someone doesn't have the resources to rework them and keep them maintained with the latest TLS. (Note issues like embedded http resources that would all have to transitively converted to avoid warnings.)

I don't think I would trust your data point of 1. Google has officially announced that it will factor in and many other sites with many data points have confirmed the effect.

https://webmasters.googleblog.com/2014/08/https-as-ranking-s...

I believe Chrome, along with other browsers mark http sites as not secure, which is obviously undesirable.

Only when submitting forms.

Because everything has to be SSL these days. Static content, open content, everything. Google, among others, say so.

Reply on news.ycombinator.com