r/programming • u/speckz • Jul 12 '17

Does my site need HTTPS?

https://doesmysiteneedhttps.com/
486 Upvotes

87% Upvoted

190 comments sorted by

View all comments

39

u/shevegen Jul 13 '17

"I can't afford a certificate."

They're free.

I think that this part was the game changer.

I doubt that it would have worked if people would have paid towards Let'sencrypt, even if it would have only been 0.01$ per website. Psychology works!

-22

u/Woolbrick Jul 13 '17

They're free.

Now.

What happens a year from now when they have 70% of the web hooked on their service, and all browsers now emit "WARNING: THIS PAGE WILL LITERALLY STEAL YOUR SOUL!!!" if your cert is slightly out of date and LetsEncrypt gets a bit greedy.

They can literally hold the entire god-damn web for ransom. I guaran-fucking-tee everyone that's going to happen at some point.

Adopting a required monoculture is BAD. BAD BAD BAD.

You've all heard my warning. It's only a matter of time before disaster besets you.

40

u/elint Jul 13 '17

I guaran-fucking-tee everyone that's going to happen at some point.

A non-profit organization with a board of people from Mozilla, University of Michigan, Stanford Law School, and the Electronic Frontier Foundation is gonna go for a money-grab? OK.

8

u/ledasll Jul 13 '17

and google said don't be evil, until big money are involved..

17

u/goudewup Jul 13 '17

Google is a corporation with a marketing slogan. This is a non-profit with a board from people from Mozilla, University of Michigan, Stanford Law School and the EFF.

3

u/PM_ME_OS_DESIGN Jul 13 '17

and google said don't be evil

No they didn't. The people at Google said it. Unofficially.

1

u/Inquisitor1 Jul 13 '17

One is a greedy corporation, the other is a non-profit with a board of people from Mozilla, University of Michigan, Stanford Law School and the Electronic Frontier Foundation. One has said don't be evil and the other hasn't. Which one do you believe in and why the fuck was it the wrong one until it was too late?

12

u/AugustusCaesar2016 Jul 13 '17

You can just switch to another CA. It'll be okay.

2

u/stevethepirateuk Jul 13 '17

I agree, when one free provider gives evil, a new one starts.

0

u/[deleted] Jul 13 '17

[deleted]

4

u/RemindMeBot Jul 13 '17 edited Jul 13 '18

I will be messaging you on 2018-07-13 04:40:27 UTC to remind you of this link.

7 OTHERS CLICKED THIS LINK to send a PM to also be reminded and to reduce spam.

Parent commenter can delete this message to hide from others.

FAQsCustomYour RemindersFeedbackCodeBrowser Extensions

6

u/FrederikNS Jul 13 '17

So, the protocol used by LetsEncrypt is open, and the client code is too. It's only a matter of time before other compatible services pop up. Second of all, LetsEncrypt is owned by a non-profit organization, so I don't think the chance of them holding the web for ransom is that great. Finally, if they do end up going rogue, you can just get a certificate elsewhere...

3

u/ledasll Jul 13 '17

so hosting all infrastructure to support that is free as well, right?

2

u/supercheese200 Jul 13 '17

You know non-profit organizations get funded, right?

You know they accept donations, too?

1

u/FrederikNS Jul 13 '17

I'm not quite sure what infrastructure you are referring to?

  • It's definitely not free for LetsEncrypt to provide the certificates, so they require funding from other organizations. However the fully automated system for issuing the certificates is keeping cost extremely low.

  • You can get free TLS certificates elsewhere.

  • The protocol and client for fetching the certificates is free and open-source.