HTTP has a zero ongoing cost, HTTPS has a non-zero ongoing cost.

Not for me. When I set up a new domain & hosting, I checked the box which said "Enable Lets Encrypt" and it was done instantly. I haven't had to manually renew it.

That's nice for you, but that's not how it is for other people.

The tooling around Let's Encrypt is designed to make it possible to do that. If you're not dead set on using a specific web server, there are web servers with Let's Encrypt support out of the box[0].

And if you're using Apache or Nginx, Certbot[1] can configure Let's Encrypt support for them automatically. It's not the "one-click install" you'd get with some other software, but it's pretty close.

[0] https://caddyserver.com/ [1] https://certbot.eff.org/

FWIW I just tried the automatic tooling. First observation is that my email (which was already using LE) still seems to be working, which is honestly surprising but I suppose I should be pleased. My website still seems to redirect a couple of times before ending up back at the unencrypted version. TBF, nothing's conspicuously broken so far so no immediate damage. I'll go back and try to sort it out when I have some more time / enthusiasm.

Update: I got it working. I still maintain that it was largely pointless, not zero-effort, and puts the difficulty of running a webserver further into the domain of stuff that's only likely to be undertaken by professional / commercial entities, and that that's a bit of a pity.

Update2: Shit, I broke some other stuff :-(

Switch to Caddy, then. It becomes mind-numbingly easy to setup.

https://caddyserver.com/

Only if you value the security of your customers at $0.

Isn't it reasonable for me to value the security of my customers at $0? Given that a) I don't have customers as such and b) My website is just a (very out of date) blog with some innocuous nerdy stuff on it.

It's not just security, it is also privacy.

But even if it was just security, it would be irresponsible to offer something (a blog) and knowingly compromise security for anyone who is interested.

How am I compromising anybody's privacy or security by hosting information about my defunct bare metal Raspberry Pi project? What is the threat model?

The traffic can be intercepted and changed. If someone trusts you (say you gave them the link) but the content they are being served is not the content you intended to be shared, is that not a security issue?

ISPs have been known to inject ads for example.

The former is not likely to be an issue for the site I'm talking about. Ad injection is shitty but I don't think it makes my blog "irresponsible".

Meltdown/Spectre kind of vulnerability plus injecting Javascript to anything that is http only by rouge ISP employee or user on open rouge wifi. It is not about targeted attacks it is about low hanging fruit which any http site is and bots, automated hacking/injecting.

Like people saying that changing SSH port on your VPS is not security. Setup one Linux VPS and see how many bots are trying to brute force your password. Just change the port so they stop trying.

Does it have an admin interface? Without encryption, your username / password are broadcast unencrypted; if intercepted by whoever, they can hijack your blog and post spam / spread malware / subtly inject some JS to mine some dank monero.

Nope.

> HTTP has a zero ongoing cost

Only if you value your (and your users/readers) privacy at $0