Re:Ask HN: Are you put off building something because it alr...
by yellowapple on Tuesday April 30, 2019 @08:29PM
(#19793402)
> SSL is useless for static content.
No it ain't. The cert is at least some assurance that the static content was not altered in transit between the original server and some MITM. Non-HTTPS sites absolutely suck to browse on less-scrupulous public wi-fi hotspots that try to inject their own ads into your browsing sessions (cough cough Greyhound cough cough).
> It raises barrier for ordinary people
Let's Encrypt has existed for multiple years now. There's certainly an effort-related barrier to entry, but not a financial one.
> 20 years ago most office buildings had a caching proxy like Squid or MS ISA Server.
And they can still have that by setting up their own internal CA and installing their own root cert on company-owned machines. Hell, running an internal CA is pretty standard practice for large enterprises (and even some medium ones) specifically so that Intranet applications can use TLS without browsers whining about self-signed certs.
No it ain't. The cert is at least some assurance that the static content was not altered in transit between the original server and some MITM. Non-HTTPS sites absolutely suck to browse on less-scrupulous public wi-fi hotspots that try to inject their own ads into your browsing sessions (cough cough Greyhound cough cough).
> It raises barrier for ordinary people
Let's Encrypt has existed for multiple years now. There's certainly an effort-related barrier to entry, but not a financial one.
> 20 years ago most office buildings had a caching proxy like Squid or MS ISA Server.
And they can still have that by setting up their own internal CA and installing their own root cert on company-owned machines. Hell, running an internal CA is pretty standard practice for large enterprises (and even some medium ones) specifically so that Intranet applications can use TLS without browsers whining about self-signed certs.