Hacker News Reader

Comment by francis-io | Hacker News Reader

I originally tried github pages, but had issues with getting an SSL cert working with Cloudflare. I ended up using AWS Certificate Manager to add an auto updating cert to CloudFront.

View on HN

Do you have a login? Or why would you need SSL on a static page?

You can use HTTPS to secure many things, not only login details. Not least of all, the privacy of your users/readers.

There's also integrity of your site, and many more future proof reasons. These days, there's no reason _not_ to use HTTPS, really.

https://developers.google.com/web/fundamentals/security/encr...

Except for the difficulty of managing and keeping up to date with TLS (I'd have to upgrade my RPi's OS for example, to do it well), and the fact that it actually reduces performance for small simple sites with local readership, even with HTTP/2 for example.

http://www.earth.org.uk/note-on-carbon-cost-of-CDN.html

Edit: I note that I got downvoted, though no reply with reasons. I accept that it is currently widespread dogma/fashion that everything should be HTTPS, and there are some good reasons for it, but as someone that has worked in what might be called 'real' security in on-line finance for example, I fear that HTTPS-everywhere is as much security theatre or cargo cult as taking your belt off at the airport scanners...

The one thing that HTTPS provides on non-sensitive, or even non-interactive sites is privacy; it hides the request URI from prying eyes (ISP, government etc.) That's worth a lot to me.

My sites are totally anodyne and not going to cause anyone any embarrassment; bank auditors tell me to relax a bit. The Chinese government was happy to grant me a site 'licence'.

That's not worth a slow-to-load or even failing-to-load page.

If all inoffensive sites ditched HTTPS, merely making an HTTPS request would justifiably arouse suspicion.

It's important to make sure that inoffensive sites are behind the same barrier, to make that a poor signal.

We have to hurt everyone to attempt to mask this weak signal?

For most sites, the Google organic search penalty for not having https is reason enough.

I have run side-by-side tests with the same site exposed both over http and https from a very performant CDN, and right now Google showed the http site on a simple search, not https, for example.

I don't believe that any penalty is currently significant, nor likely to be soon. There's plenty of good historic sites which SEs don't want to exclude just because someone doesn't have the resources to rework them and keep them maintained with the latest TLS. (Note issues like embedded http resources that would all have to transitively converted to avoid warnings.)

I don't think I would trust your data point of 1. Google has officially announced that it will factor in and many other sites with many data points have confirmed the effect.

https://webmasters.googleblog.com/2014/08/https-as-ranking-s...

Because everything has to be SSL these days. Static content, open content, everything. Google, among others, say so.

I believe Chrome, along with other browsers mark http sites as not secure, which is obviously undesirable.

Only when submitting forms.

Reply on news.ycombinator.com