Probably not a good person to piss off.
Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox shouldn’t tell users it’s insecure. Within hours his database was pwned.
Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox shouldn’t tell users it’s insecure. Within hours his database was pwned.
I remember a few years ago when there was no way you could do it for side projects because certs were 100/yr., now they're free.
For anyone interested :
I'm only a customer for small niche sites, not associated in any other way, works fine enough for my needs.
Only annoyance (at least with webfaction) is that they don't currently support letsencrypt auto-renewal, so you have to remember to update your cert manually every 12 weeks.
Besides, if the DB was pwned, it is unlikely that http -> https would have any real bearing anyway. There was probably a XSS exploit or whatever.
If you don't think HTTPS is important you're probably not worried about SQL injection either.
The problem is not pissing off Troy Hunt; but more that they are advertising that their website is vulnerable and that they don't care.
everyone = Hacker News
Mostly likely not their customers; whom they have a vested interest in keeping money with.
My care factor is probably very different to most non techies, by assumption. Then again, there's probably a bunch of things I do that would annoy(?) {them} greatly - that I'm not even aware of.
> We have our own security system, and it has never been breached in more than 15 years.
Which leads me to believe that their system was built by scratch, in PHP, 15 years ago, and hasn't been updated since.