Hacker News Reader

I like it, but I'd probably put that on 443 with TLS. The threat model and attacks developed since web 1.0 have increased in complexity and sophistication and better to be safe than sorry.

View on HN

As an option that's fine but it brings in a big dependency stack and lots of moving parts. acme2 might not look like it from the user end but internally there's a lot that's going on those acme programs are hiding. HTTP+HTTPS assures a site doesn't die just because of a cert renewal or CA problem (like LE's root cert expiring a couple years back, the switch from acme 1 to acme 2, your particular acme client having a dep that breaks on update, etc).

While commercial and institutional sites do have to operate with a different security model these days, human people not involved in monetary exchange or private information have the same requirements as ever. HTTPS is optional. A nice add-on but not vital. And definitely not HTTPS only if you want your site to last more than a few years without active manual mantainance.

You could also self sign - It's going to be grating for users, but your still afforded the protections against any hop on the path.

Reply on news.ycombinator.com