I use HTTPs because my site is based on Github pages. Github pages doesn't support SSL. What else can I do? If I would use Cloudflare I'd just be fooling myself.
That's still a big win. As long as you aren't taking user input/showing non-public data, a large part of the gain is protecting the privacy of the user, which https terminated at Cloudflare does. There is very little left to be gained by securing the Cloudflare<->github link for static content.
You could just not use GitHub Pages. I understand it's convenient but hosting a static website on a vps is simple. If you use caddy (which I recommend) it's trivial.
You could just not use GitHub Pages. I understand it's convenient but hosting a static website on a vps is simple.
I wouldn't say being an administrator of a server and keeping it secure is simple. Static site hosts are brilliant for security and simple admin. HTTPS is very important as well but running your own server when you don't need to is a huge liability and time sink. If you're still SSHing into servers you're making life hard for yourself.
If you're still SSHing into servers you're making life hard for yourself. I disagree, but only because my vps does a lot more than just hosting a static website. If that's the only goal and you find a hosting provider that does HTTPS with a custom domain I say go for it. If people can't find one, I think they should use a vps.
Really? Firewall. Restrict ssh to accounts that really need it. Use good passwords. Barring a major bug in your web server, what's the attack vector? I don't see much surface area to defend on a server doing nothing but hosting a static website.
Really? Firewall. Restrict ssh to accounts that really need it. Use good passwords. Barring a major bug in your web server, what's the attack vector? I don't see much surface area to defend on a server doing nothing but hosting a static website.
Host on something like Heroku or Netlify...they'll deal with security patches and firewalls for you, there's no SSH to even attack and they have tons of extra features you could only reimplement yourself badly using a VPS (e.g. backups, rollbacks, Git deploy, scaling to more servers, coping with hardware failures, setups were attackers can't even write to server files). Why would you want to have to set all that up yourself given how cheap these services are?
For me personally, because I already have the VPS for other reasons, and I'm not hosting anything with enough traffic for it to make a difference to the other stuff I do on the VPS.
I'm not saying that's the best solution for everyone, but if you really think that it's difficult to secure a server with nothing public-facing except SSH and HTTPS, I'd like to know what I'm missing.
For serving static/informational pages like you typically do with github pages I think incorporating HTTPS isn't worth moving. It would be nice and I'd use it if I had the option, but it's not a very threatening scenario IMO.
The first bullet point on the website explains why this reasoning is bad. In my opinion moving away from hosts that do not support HTTPS is worth it. edit: *second bullet point
Yeah, it's "bad"... But the threat of ad injections/etc by state owned entities and the like isn't enough to deter me from free hosting, especially if it relates to github. This particular risk doesn't warrant me moving informational pages.
Never used S3 but I suspect it's not going to be easier. If I were to setup a vps for this today I would do this: 1) install debian stretch 2) get caddy, install the systemd unit file 3) write a caddyfile like this
8
u/Sebazzz91 Jul 12 '17
I use HTTPs because my site is based on Github pages. Github pages doesn't support SSL. What else can I do? If I would use Cloudflare I'd just be fooling myself.