News for hackers. Stuff that matters.
Re:Identifying Airtel middleboxes that censor HTTPS traffic by Kaknut on Tuesday September 29, 2020 @10:23AM (#24628179)
Really loved your article buy why no SSL/HTTPS? It's free afterall.
Re:Identifying Airtel middleboxes that censor HTTPS traffic by cnst on Tuesday September 29, 2020 @03:33PM (#24631942)
HTTPS is not free. It has a very significant management/maintenance and compatibility overhead, which is unavoidable by the very nature of HTTPS.
Re:Identifying Airtel middleboxes that censor HTTPS traffic by ac29 on Tuesday September 29, 2020 @06:07PM (#24633597)
On the scale of a personal blog, its approximately 0 minutes per year to maintain HTTPS certificates using Lets Encrypt with something like certbot (or use Caddy, which handles it on it own).
Re:Identifying Airtel middleboxes that censor HTTPS traffic by cnst on Tuesday September 29, 2020 @06:16PM (#24633675)
Absolutely false. On the scale of a personal blog, the cost of HTTPS is enormous, but the benefit is approximately 0.
Re:Identifying Airtel middleboxes that censor HTTPS traffic by sroussey on Tuesday September 29, 2020 @05:03PM (#24632954)
Which can be automated.
Re:Identifying Airtel middleboxes that censor HTTPS traffic by cnst on Tuesday September 29, 2020 @06:19PM (#24633703)
Yes, you gotta automate a whole bunch of things if you need HTTPS, you have to update the protocols every few years, certificates as often as every few months, OpenSSL versions on a moment's notice.

Or, you could decide to just go HTTP-only for your blog, and never bother doing any of the above, never worry about any automation failing for any reason, never worry about any expired or revoked certificates, never worry about the extra compatibility issues that TLS brings. There's no benefit for HTTPS for a personal blog. It's only there to restrict the access, increase attack surface, and cause compatibility issues.