<story><title>Moving forward on improving HTTP&apos;s security</title><url>http://lists.w3.org/Archives/Public/ietf-http-wg/2013OctDec/0625.html</url></story><parent_chain><item><author>sigzero</author><text>I am sure it happens but you should not be exposing your printer to the Internet. That is just asking for trouble. You would not need HTTPS on an internal network.</text></item><item><author>sophacles</author><text>Right - embedded devices, one off toy apps, a lot of internal organization pages, and a lot of hobbiest projects make up a huge part of the &amp;quot;web space&amp;quot;. These will all suffer for more reasons than cost of certs - it adds a new hurdle and a barrier for entry.&lt;p&gt;Think about printers for a moment: now all the printers providing http interfaces need to include a way to install an organizational cert on them (at least for a lot of organizations). That means that there needs to be an out of band step in setup (and maintenance) to add the cert, or a way to do so from an http interface. The later just screams &amp;quot;giant security risk&amp;quot; for a dozen reasons.</text></item><item><author>danielweber</author><text>What about embedded devices.&lt;p&gt;Not everything on the web is sitting on a well-known server.</text></item><item><author>kijin</author><text>I recently bought a PositiveSSL certificate for less than $3 per year at gogetssl.com. That&amp;#x27;s less than one third of what I paid for the domain to use it on. If you can afford a domain, you can afford to put a SSL certificate on it.&lt;p&gt;Low-cost SSL brands like PositiveSSL and RapidSSL are so cheap nowadays, some registrars hand them out for free if you buy a domain. And they&amp;#x27;re compatible with every version of IE on Windows XP, unlike those free certs from StartSSL.</text></item><item><author>kristofferR</author><text>This is a dumb idea unless CAs becomes automatic and free or are completely replaced by something better.&lt;p&gt;The reason why HTTPS isn&amp;#x27;t used more is because it&amp;#x27;s a major hassle and it&amp;#x27;s quite expensive (can easily double the yearly cost for smaller sites).&lt;p&gt;If using HTTP 2.0 requires buying SSL certificates, the smaller sites currently not using SSL will just be stuck on HTTP 1.1 forever.</text></item></parent_chain><comment><author>munificent</author><text>&amp;gt; You would not need HTTPS on an internal network.&lt;p&gt;Oh, really?&lt;p&gt;&lt;a href=&quot;http://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.washingtonpost.com&amp;#x2F;world&amp;#x2F;national-security&amp;#x2F;nsa-in...&lt;/a&gt;</text></comment>
<story><title>Moving forward on improving HTTP&apos;s security</title><url>http://lists.w3.org/Archives/Public/ietf-http-wg/2013OctDec/0625.html</url></story><parent_chain><item><author>sigzero</author><text>I am sure it happens but you should not be exposing your printer to the Internet. That is just asking for trouble. You would not need HTTPS on an internal network.</text></item><item><author>sophacles</author><text>Right - embedded devices, one off toy apps, a lot of internal organization pages, and a lot of hobbiest projects make up a huge part of the &amp;quot;web space&amp;quot;. These will all suffer for more reasons than cost of certs - it adds a new hurdle and a barrier for entry.&lt;p&gt;Think about printers for a moment: now all the printers providing http interfaces need to include a way to install an organizational cert on them (at least for a lot of organizations). That means that there needs to be an out of band step in setup (and maintenance) to add the cert, or a way to do so from an http interface. The later just screams &amp;quot;giant security risk&amp;quot; for a dozen reasons.</text></item><item><author>danielweber</author><text>What about embedded devices.&lt;p&gt;Not everything on the web is sitting on a well-known server.</text></item><item><author>kijin</author><text>I recently bought a PositiveSSL certificate for less than $3 per year at gogetssl.com. That&amp;#x27;s less than one third of what I paid for the domain to use it on. If you can afford a domain, you can afford to put a SSL certificate on it.&lt;p&gt;Low-cost SSL brands like PositiveSSL and RapidSSL are so cheap nowadays, some registrars hand them out for free if you buy a domain. And they&amp;#x27;re compatible with every version of IE on Windows XP, unlike those free certs from StartSSL.</text></item><item><author>kristofferR</author><text>This is a dumb idea unless CAs becomes automatic and free or are completely replaced by something better.&lt;p&gt;The reason why HTTPS isn&amp;#x27;t used more is because it&amp;#x27;s a major hassle and it&amp;#x27;s quite expensive (can easily double the yearly cost for smaller sites).&lt;p&gt;If using HTTP 2.0 requires buying SSL certificates, the smaller sites currently not using SSL will just be stuck on HTTP 1.1 forever.</text></item></parent_chain><comment><author>avens19</author><text>So you require a cert for personal projects. That doesn&amp;#x27;t mean a cert that chains to a public trust. You could easily cut your own cert and trust it on whatever device you wish to access the site on</text></comment>