Ask HN: Why Paul Graham’s Website Isn’t Using HTTPS?
45 comments
Honestly I used to think the same, until adding HTTPS support because as simple as a button, and now there's no reason not too. Specifically for websites hosted on GitHub and AppEngine which most my sites are, it's little one button with LetsEncrypt. Beforehand, getting SSL cert was honestly a PITA and not worth it for a simple static website.
Many ISPs are bad these days. They insert or replace javascripts in it is plain http.
I face this problem in India with mainstream ISP.
I face this problem in India with mainstream ISP.
What do they insert? Ads?
Yes, I’ve experienced it personally while doing my undergrad in india
Practically, you don't do a cert for your site, you do it to protect visitors to your site getting compromised by a MITM attack.
A site without a cert is basically telling its users "I don't care about you."
A site without a cert is basically telling its users "I don't care about you."
I hear this all the time and I'm not sure if people saying that actually tried performing a MitM attack. First of all, a meaningful attack of this kind would occur when some data is uploaded - if it's just uploaded, you can basically do stupid pranks like replacing words and graphics. But more importantly, in order to actually perform a MitM attack, you need to have access to some parts of the infrastructure of the victim that you normally have not. For example, if you can perform the MitM attack by hijacking DNS (on a local machine or local network level), you can perform much worse attacks than MiTM, and HTTPS cannot stop you. In such cases HSTS can be helpful, although in itself is not without issues.
Or, a local ISP or the coffee shop you are visiting has an appliance that injects ads into http web sites. And those ads come from an ad network, that doesn't do a good job of policing malware that gets into the ad's javascript. (Malware-laced ad networks is actually the #1 reason I use an ad blocker, since that is the only times I've ever got computer viruses).
What ISPs are doing in the USA is beyond me - how on Earth people can tolerate inserting or messing with the traffic in similar ways?
As for coffee shops and other public access points, people really need to understand the consequences of what are doing when connecting to any of these. Using HSTS is just an antidote to one particular problem. But when you connect to a hostile AP, many worse things can happen.
As for coffee shops and other public access points, people really need to understand the consequences of what are doing when connecting to any of these. Using HSTS is just an antidote to one particular problem. But when you connect to a hostile AP, many worse things can happen.
Access to the infrastructure is pretty easy - e.g. a WiFi Pineapple is $99. https://shop.hak5.org/products/wifi-pineapple
There is no absolute protection against compromise, but it would be polite for every web site to implement https and hsts to at least make it harder for visitors to be compromised. It costs them very little.
Maybe the analogy is soap in the bathroom at a coffee shop - most customers will not get cholera if the soap is missing, but is it moral for the shop owners to take the risk when the cost is so low and the downside is so high?
There is no absolute protection against compromise, but it would be polite for every web site to implement https and hsts to at least make it harder for visitors to be compromised. It costs them very little.
Maybe the analogy is soap in the bathroom at a coffee shop - most customers will not get cholera if the soap is missing, but is it moral for the shop owners to take the risk when the cost is so low and the downside is so high?
> Access to the infrastructure is pretty easy - e.g. a WiFi Pineapple is $99. https://shop.hak5.org/products/wifi-pineapple
Even though there are buggy WPA2 implementations, in general it's pretty difficult to get in unless a trivial passphrase is used in WPA2-Personal. With WPA2-Enterprise, it depends on the method used, but breaking properly implemented EAP-TLS is really difficult. Your best bet is to look for bugs in routers etc.
But this basically proves my point: if the attacker can get into your network, messing with the output from Paul Graham's HTTP server should be the least of your worries.
Even though there are buggy WPA2 implementations, in general it's pretty difficult to get in unless a trivial passphrase is used in WPA2-Personal. With WPA2-Enterprise, it depends on the method used, but breaking properly implemented EAP-TLS is really difficult. Your best bet is to look for bugs in routers etc.
But this basically proves my point: if the attacker can get into your network, messing with the output from Paul Graham's HTTP server should be the least of your worries.
It's just a plain website that doesn't do anything besides give you some text and images. This is technology that has functioned just fine for decades. I don't understand why it needs SSL at all - where's the private information that might be intercepted by someone in the middle?
The intention isn’t about private information. What if essay text is modified in transit/injected with advertisements?
The consensus among young devs these days is such a situation would be an abomination, that it's a sign of disrespect towards the visitor and that you should be publicly shamed for this.
Dunno, try it!
Rather than go to all that effort of doing something illegal for an individual, it's far simpler to find prior work.
https://www.google.com/search?q=javascript+injection+by+isps
https://www.google.com/search?q=javascript+injection+by+isps
Or QUANTUM INSERT/man-on-the-side attacks.
If I lived in a country where all ISPs are allowed to inject my traffic with ads, I probably wouldn't use the Internet without a decent VPN.
SSL (well, TLS now) serves three purposes.
1. Ensuring you are getting the information the website author intends for you to get. i.e. data can’t be manipulated in transit.
2. Ensuring the information you are getting is in fact coming from the domain you are requesting it from.
3. Preventing others between you and the website from seeing the information sent back and forth.
I think you questioned the need for TLS here assuming 3 was the only purpose of TLS?
1. Ensuring you are getting the information the website author intends for you to get. i.e. data can’t be manipulated in transit.
2. Ensuring the information you are getting is in fact coming from the domain you are requesting it from.
3. Preventing others between you and the website from seeing the information sent back and forth.
I think you questioned the need for TLS here assuming 3 was the only purpose of TLS?
Agree that website is simple, but it can be promotional on his end- it's good to show best practices. And his website clearly has a lot of traffic, a lot of engineers read it.
Who does he need to impress with his web skills?
It’s not about impressing but it ensures that it’s safe for everyone and it’s clear that his website gets huge traffic.
The only thing that could be "unsafe" is your network connection, not his website.
>Agree that website is simple, but it can be promotional on his end
If you have enough money, you don't need to promote yourself or impress anyone...
If you have enough money, you don't need to promote yourself or impress anyone...
scripting.com doesn't use https either (went through a list of some older blog sites I could think of but most are https now.)
The following was written years ago, but it is a lot easier to use https now. http://scripting.com/2014/08/08/myBlogDoesntNeedHttps.html
The following was written years ago, but it is a lot easier to use https now. http://scripting.com/2014/08/08/myBlogDoesntNeedHttps.html
His main complain is that it costs money, which it no longer does. I think the rest of his argument really falls apart because of that.
I'm surprised by the number of responses in this thread from people not understanding the purpose of HTTPS, even for static sites.
This is a good summary of why you should use HTTPS: https://doesmysiteneedhttps.com/
This is a good summary of why you should use HTTPS: https://doesmysiteneedhttps.com/
> what makes paul stick to old plain website?
It requires no effort to stick with HTTP. Yes, it's not rocket science to use HTTPS, but it requires a non-zero amount of time to enable it. He probably has better things to do with his time.
Besides, it's his personal website... He can do whatever he wants with it.
It requires no effort to stick with HTTP. Yes, it's not rocket science to use HTTPS, but it requires a non-zero amount of time to enable it. He probably has better things to do with his time.
Besides, it's his personal website... He can do whatever he wants with it.
Because it's a hassle, people have limited time and it doesn't appear to provide much value.
Given that HTTPS is required for HTTP2 to work in current browsers and it's easy to get a letsencrypt certificate this is a reasonable question. On the other hand, I guess it doesn't really matter for his simple purpose of distributing public information.
His website works fine without it, what's the issue here?
Any website works just fine without TLS. Not necessarily a good point
But is it urgent? doesn't seem like it is though.
There are millions of sites without HTTPS that should have it, why specifically his site / blog?
He isn't thinking about starting a account or a bank on his site is he?
There are millions of sites without HTTPS that should have it, why specifically his site / blog?
He isn't thinking about starting a account or a bank on his site is he?
Your argument demonstrates a lack of understanding of websites with/without HTTPS. I assume PG's website is popular which gives weight to the argument that it should have HTTPS.
> Your argument demonstrates a lack of understanding of websites with/without HTTPS. I assume PG's website is popular which gives weight to the argument that it should have HTTPS.
Except that you've missed that this is an extra overhead for some people and they don't want to deal with it. (if it ain't broke don't fix it). x.com is popular (because Elon) but there isn't https on there. I don't see anyone complaining except tech folk.
You can also apply this to PG himself, as he actively tells people to directly go to non-https, that shouldn't be an issue for his audience.
It takes less time for you to go to a non-https than it is for him to set HTTPS up and maintain it, if you're so concerned you can mirror his content to a https site.
Except that you've missed that this is an extra overhead for some people and they don't want to deal with it. (if it ain't broke don't fix it). x.com is popular (because Elon) but there isn't https on there. I don't see anyone complaining except tech folk.
You can also apply this to PG himself, as he actively tells people to directly go to non-https, that shouldn't be an issue for his audience.
It takes less time for you to go to a non-https than it is for him to set HTTPS up and maintain it, if you're so concerned you can mirror his content to a https site.
> as he actively tells people to directly go to non-https, that shouldn't be an issue for his audience
Actually it should be but they are uneducated.
> if you're so concerned you can mirror his content to a https site.
That is a poor attitude. In a scenario where that fixed things it would only fix them for one person.
Actually it should be but they are uneducated.
> if you're so concerned you can mirror his content to a https site.
That is a poor attitude. In a scenario where that fixed things it would only fix them for one person.
> Actually it should be but they are uneducated.
Or maybe they are educated and they realise it is a non-issue and not worth the effort to put into.
> That is a poor attitude. In a scenario where that fixed things it would only fix them for one person.
No it isn't, it would benefit anyone who cares about that specific issue, you can host it on a secure webpage if you care so much about it.
Or maybe they are educated and they realise it is a non-issue and not worth the effort to put into.
> That is a poor attitude. In a scenario where that fixed things it would only fix them for one person.
No it isn't, it would benefit anyone who cares about that specific issue, you can host it on a secure webpage if you care so much about it.
I think both our premises differ so much this conversation can't continue.
I reckon that static sites that don't require JS can stay just fine using HTTP (provided you turn off JS in the browser, which is the best default you should be having anyway)
Please do correct me if I'm wrong, but I think a whole lot of trouble can come if you enable running scripts over unsecured connections. From malicious DOM manipulations to exploiting CPU vulnerabilities. All of this of course if you assume the website you're visiting isn't itself doing malicious things :)
Please do correct me if I'm wrong, but I think a whole lot of trouble can come if you enable running scripts over unsecured connections. From malicious DOM manipulations to exploiting CPU vulnerabilities. All of this of course if you assume the website you're visiting isn't itself doing malicious things :)
if there is no sensitive data input(like login) https is just a waste of time. being cool just for sake of being cool is not cool.
The opposite take, delivered with humor [need to hide HN referrer]: http://n-gate.com/software/2017/07/12/0/
It makes no sense to provide direct links to n-gate from HN, it will just confuse people. Use this one instead:
https://outline.com/jBgZ3E
https://outline.com/jBgZ3E
Why bother? What value would it provide to him?
This is the hacker spirit. Doing something short of the way it's supposed to be done(Not adding SSL), to make another point(I hate overengineering).
Please don’t answer that it’s not in your top 100 to-do list.