News for hackers. Stuff that matters.
Re:Strengthening HTTP: A Personal View by quicksilfer on Wednesday August 06, 2014 @07:54AM (#8141995)
That doesn't have to be the case. You could still allow self-signage, with all of the security caveats that presents.

Who knows. Maybe that arrangement could even spur a sorely needed push for a free certificate trust network and get rid of CA's entirely.

Re:Strengthening HTTP: A Personal View by rx4g on Wednesday August 06, 2014 @08:44AM (#8142157)
Self-signed certs are much harder to get browsers to accept these days. The "I know what I'm doing" button and process are becoming ever more complex, and I wouldn't be surprised if they just start going away in favor of a list of trusted root CAs, which you may or may not be able to control as a user, depending on your browser. Which sucks. But anyway.

StartSSL is one place where you can get a free cert for your website today (and yes, they charge for revocation, but revocation is pretty ineffective anyway). I got a free cert from them, but my mobile browser doesn't trust it, so I decided to shell out $10 for a cert that's more widely auto-trusted by browsers. Not a huge cost, IMO.