I posted this in a separate comment and I will post it again.
https://certbot.eff.org/hosting_providers
HTTPS adoption is hard enough that the wast majority of shared hosting providers haven't automated cert provisioning and are delegating this process to their users.
The push towards forced HTTPS has significant costs, which most people in this filter bubble don't want to honestly discuss.
I agree, but I'll push back by saying that delaying HTTPS adoption and getting lax about it has a much higher cost -- and that is similarly a cost that most people pushing back against HTTPS either downplay or refuse to acknowledge.
And more than that, those critics have shown that they're not interested in solving the problems that they bring up or in finding ways to mitigate them. So it's not like we can wait a year and adoption will suddenly get easier. The critics of HTTPS aren't moving forward. They don't want HTTPS adoption to slow down while they catch up, they want it to stop so that they don't need to move forward at all.
We've seen significant improvements in usability for HTTPS for ordinary people, from LetsEncrypt, to Cloudflare, to Netlify. Holdouts like Gitlab and Github don't provide an easy way to provision certs by default. A lot of other smaller hosting providers are ignoring the problem entirely. This will get better over time as more hosting providers realize that this is a feature they have to provide to be competitive.
But that's the thing. Smaller hosts are ignoring the problem and they will continue to ignore the problem until they're forced to upgrade their infrastructure to support solutions like Certbot. Because MITM attacks aren't their problem, client privacy isn't their problem. They are not going to get better support until they literally don't have any other option.
That changes our calculations; where a decade or two ago we might honestly argue that immediate, harsh incentives to switch to HTTPS had too many downsides, we're now in a position where we realize that harsh incentives are the only way that HTTPS infrastructure is going to improve at all.
And that has significant implications for people's privacy and security online. We're at the point where even though it's a barrier of entry for some people, everyone should still be using HTTPS on any public site that they build, period. Honestly, I'm in the process of trying to find good HTTPS schemes for intranet sites too. We need to move forward on security.
This weekend I watched a bunch of scam bait calls. Very amusing to watch them get taken down. But there are people out there mailing 20k in fedex boxes to scammers. All because their browser said 'your balance is 20000 and I transferred too much to the account, could you mail that back to me so I do not get in trouble?'. It is a very human attack using a combination manipulation, fear and compassion. The bottom line is these people unknowingly allowed people to open the debug console in their browser to change things.
What I have been trying to figure out in my head is how do we do a digital watermark on data presented to the user? How do we at a minimum tell the user their data has been manipulated? You can have all the TLS on every level but at one of the most important ones there is nothing. A scammer can open a debug console on a https presented page just as much as a http page.
An explicit caching server that I integrate into my site on purpose is a totally different category of device from a random router sitting in an airport.
This is like arguing that because Linode can log into my server and examine/edit my files, then we might as well stop requiring a password when random people online try to SSH onto the machine. Trusted agents and untrusted agents are not the same.
We're in a thread about Google making changes to Chrome. The irony of trying to somehow tie this to user privacy is hilarious.
The overwhelming consensus in the security industry is that end-to-end encryption increases security and privacy. Overwhelmingly, security professionals recommend using HTTPS.
Of course it's tied to user privacy, there are multiple examples of not just malware authors but also corporations like Verizon, public wifi administrators for large establishments, doing sniffing and MITM attacks on non-HTTPS traffic. It's absurd that E2E encryption in the browser has to be defended to people, it is absolutely a privacy and security issue.
I dislike Google's privacy stances too; I'm regularly on the Google hate train. But if you're leaving your Internet traffic unencrypted just because Google is one of the companies telling you to encrypt, then you are pointlessly cutting off your nose to spite your face.
HTTPS is old tech. "Let's Encrypt" is free.
Traditional shared hosts got their lunch eaten starting almost a decade ago with a combination of site builders like Weebly on the user friendly side and AWS on the technical side.
In 2013 most of my social group was friends I made in the shared hosting industry. Now I don't know a single person still working for any MSP as they've all needed to find greener pastures as the companies get bought up by conglomerate vampires that will milk the remaining customers (there aren't many new ones) for what they're worth until the companies finally die.
Looking to shared web hosts for guidance is like looking to 2005 to decide what's cutting edge.
They're done for. Shared hosting is over. RIP cPanel, Plesk, and the whole lot
Shared hosting is awful, I don't know why anyone would ever want to go back. Here's an Apache server we set up, it's got every module under the sun enabled along with the associated security holes. You get one PHP version that we upgrade at our leisure, and a shared MySQL server that you pay per database for. Eugh.
Depends on your use case.
For my use case, I upload a bunch of HTML files via SFTP, and it just keeps working. I don't have to deal with the server software, someone who can dedicate a lot more time does that for me for a nominal cost (because keeping the server for 10000 people updated is only marginally more difficult than me keeping my own server updated).
I pay the same or less than I'd pay for a small server, and someone who provides the benefit of a managed platform gets some profit for the value (hassle free website) they created. In exchange, I save an hour or two of fiddling with the server per year, which makes this a great deal. You're not paying for infrastructure, you're paying for the "managed" part of a managed service.
Could I just use a storage bucket? Probably. But I'd have to figure out how to make Let's Encrypt work with that, and if someone decides they hate me and downloads my site with a million bots several times per second, I'm getting a bill that costs me more than a lifetime of shared hosting.
If I were to use PHP and MySQL... they'd probably still update it more diligently than I would after a year when I get busy with other things.
Actually, I've come to respect it as an offering because I don't need to patch security vulnerabilities.
I don't need to do backup, etc.
If/when I do eventually migrate to a VPS I'll be responsible for a LOT more.
I'm tempted to move to a PaaS or go serverless, but cost management with serverless is more complicated.
My dreamhost setup has been going fine for almost a decade by now. With minimal maintenance from me.
Not every business needs to hire developers and devops to run their services on AWS.
Actually, I have seen several domain registrars that want to advertise "free SSL" implementing some sort of basic Let's Encrypt provisioning tool that automatically updates the TXT records to get them.