Building a fast, secured and free static site in less than three hours

Re:Building a fast, secured and free static site in less tha... by schrodinger on Tuesday September 12, 2017 @08:38AM (#15226757)

Wouldn't SSL via GitHub's cert protect that part?

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by xxdesmus on Tuesday September 12, 2017 @09:05AM (#15226930)

Yes. It will.

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by icebraining on Tuesday September 12, 2017 @09:55AM (#15227260)

Not really. They have two options for protecting the "back" connection: Full SSL and Full SSL (Strict).

Full SSL doesn't really protect you since Cloudflare won't check if the certificate is valid, an attacker could make their own self-signed cert and MITM you.

Full SSL (Strict) requires a valid cert for the domain being requested. If you had that, you wouldn't need Cloudflare in the first place.

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by schrodinger on Tuesday September 12, 2017 @06:13PM (#15233406)

But the domain is github.com, which has a valid ssl cert. You only need cloudflare to get it on your own domain.

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by icebraining on Wednesday September 13, 2017 @04:31AM (#15236497)

Right, but Cloudflare doesn't actually check if the cert is valid, unless you enable Strict mode, which you can't because you'd need Github to serve a cert for your own domain.

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by schrodinger on Wednesday September 13, 2017 @11:45AM (#15239392)

Are you sure? Wouldn't it check to see that the cert is valid for github.com, not for your own domain, since that's the origin?

Edit: Looks like you're correct. Sorry!

[ Parent | on HN ]