Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yes, you gotta automate a whole bunch of things if you need HTTPS, you have to update the protocols every few years, certificates as often as every few months, OpenSSL versions on a moment's notice.

Or, you could decide to just go HTTP-only for your blog, and never bother doing any of the above, never worry about any automation failing for any reason, never worry about any expired or revoked certificates, never worry about the extra compatibility issues that TLS brings. There's no benefit for HTTPS for a personal blog. It's only there to restrict the access, increase attack surface, and cause compatibility issues.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: