Hacker News Reader

Comment by zelly | Hacker News Reader

S3 is nice but it's really the wrong tool for the job here. The problem with hosting a site on S3 is there's no way to use TLS.

"You don't need TLS for a static site"

blow me

View on HN

> The problem with hosting a site on S3 is there's no way to use TLS.

The standard solution for having TLS on sites hosted on S3 is to use CloudFront.

If you load the site again it should be using tls. I opted to separate concerns and threw Cloudflare(free tier) in front of it. You might be wondering, well okay its encrypted between my browser and Cloudflare but what about the connection between the Cloudflare proxy server and s3? To solve that I used the s3 api endpoint instead of the website endpoint which supports tls. I turned Cloudflare's tls setting to full which uses tls between proxy and origin but allows for a self-signed cert from the origin. So its encrypted from browser to proxy to s3 api. As long as no one poisons the s3 api dns we should be good.

The standard solution for any issue on AWS is to add another service.

Separation of concerns: https://en.wikipedia.org/wiki/Separation_of_concerns

I, for one, greatly appreciate having CDN features cleanly separated from object storage. It makes sense, since they are completely different things.

The standard solution for any issue on Unix is to pipe the output to another service but very few people complain about POSIX.

The UNIX philosophy would call for a service that does one thing well. CloudFront is a CDN among other things and, in this case, a TLS termination proxy. I should be able to stack something onto S3 that just does the latter, because I may not need the costs or the hassle (to invalidate caches) of a CDN. But hey, it's a free county with lots of competition and Netlify and I think Azure lets you do this.

Because they aren't incrementally charged for each one in according to an arcane and opaque costing schedule.

No, they just pay for the entire server whether they're using it to its full potential or not. Amazon's option is almost always cheaper.

Put CloudFront in front?

Reply on news.ycombinator.com