<story><title>Marking HTTP as Non-Secure</title><url>https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure</url></story><parent_chain><item><author>jedberg</author><text>&amp;gt; There&amp;#x27;s no more good reason not to have HTTPS&lt;p&gt;Cost.  Today I host my website for 6 cents a month as a static page on Amazon S3.&lt;p&gt;To go https, I&amp;#x27;d have to first acquire a certificate (lucky that &lt;i&gt;can&lt;/i&gt; be free and with Let&amp;#x27;s Encrypt will be).  Then I have to find someone to host that certificate.  I can pay someone hundreds to thousands of dollars in setup and monthly fees.&lt;p&gt;Or, the cheapest option I&amp;#x27;ve found is to get a $6&amp;#x2F;mo VPS as a frontend, put nginx on it, and put my cert there.  The problem is that costs &lt;i&gt;100 times&lt;/i&gt; as much as what I pay now, &lt;i&gt;and&lt;/i&gt; I have to maintain a server &lt;i&gt;and&lt;/i&gt; it&amp;#x27;s not served from multiple redundant servers like my site is now.&lt;p&gt;Or I can use Amazon&amp;#x27;s free SNI support, making it so that older browsers can&amp;#x27;t see my site and I have no way of blocking people from using http or redirecting them.&lt;p&gt;There is currently no good, cheap option to do SSL only that is viewable by everyone.&lt;p&gt;That&amp;#x27;s why I haven&amp;#x27;t switched yet.</text></item><item><author>andrewstuart2</author><text>I think the best time to do this would be soon after the Let&amp;#x27;s Encrpyt free CA [1] starts handing out certificates.  There&amp;#x27;s no more good reason not to have HTTPS, so that&amp;#x27;s a good time to start applying a little pressure and adding the incentive for website authors.&lt;p&gt;Does google already reward secure sites with higher search rankings? I can&amp;#x27;t decide if I think that&amp;#x27;s a good idea or not, but if they want to push for a more secure and free web, that&amp;#x27;s definitely another avenue.&lt;p&gt;[1] &lt;a href=&quot;https://www.eff.org/press/releases/new-free-certificate-authority-dramatically-increase-encrypted-internet-traffic&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.eff.org&amp;#x2F;press&amp;#x2F;releases&amp;#x2F;new-free-certificate-auth...&lt;/a&gt;</text></item></parent_chain><comment><author>unethical_ban</author><text>I understand the principle, but let&amp;#x27;s not get to philosophical about this: You ran reddit&amp;#x27;s servers and worked at netflix in their availability department. Cut out a morning coffee and you have enough money to run SSL.&lt;p&gt;SNI works with anyone on Windows &amp;gt; XP, and any mobile &amp;#x2F; Apple &amp;#x2F; Linux OS you&amp;#x27;ll find visiting your site. How many IE6&amp;#x2F;XP hits does your site get per month?</text></comment>
<story><title>Marking HTTP as Non-Secure</title><url>https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure</url></story><parent_chain><item><author>jedberg</author><text>&amp;gt; There&amp;#x27;s no more good reason not to have HTTPS&lt;p&gt;Cost.  Today I host my website for 6 cents a month as a static page on Amazon S3.&lt;p&gt;To go https, I&amp;#x27;d have to first acquire a certificate (lucky that &lt;i&gt;can&lt;/i&gt; be free and with Let&amp;#x27;s Encrypt will be).  Then I have to find someone to host that certificate.  I can pay someone hundreds to thousands of dollars in setup and monthly fees.&lt;p&gt;Or, the cheapest option I&amp;#x27;ve found is to get a $6&amp;#x2F;mo VPS as a frontend, put nginx on it, and put my cert there.  The problem is that costs &lt;i&gt;100 times&lt;/i&gt; as much as what I pay now, &lt;i&gt;and&lt;/i&gt; I have to maintain a server &lt;i&gt;and&lt;/i&gt; it&amp;#x27;s not served from multiple redundant servers like my site is now.&lt;p&gt;Or I can use Amazon&amp;#x27;s free SNI support, making it so that older browsers can&amp;#x27;t see my site and I have no way of blocking people from using http or redirecting them.&lt;p&gt;There is currently no good, cheap option to do SSL only that is viewable by everyone.&lt;p&gt;That&amp;#x27;s why I haven&amp;#x27;t switched yet.</text></item><item><author>andrewstuart2</author><text>I think the best time to do this would be soon after the Let&amp;#x27;s Encrpyt free CA [1] starts handing out certificates.  There&amp;#x27;s no more good reason not to have HTTPS, so that&amp;#x27;s a good time to start applying a little pressure and adding the incentive for website authors.&lt;p&gt;Does google already reward secure sites with higher search rankings? I can&amp;#x27;t decide if I think that&amp;#x27;s a good idea or not, but if they want to push for a more secure and free web, that&amp;#x27;s definitely another avenue.&lt;p&gt;[1] &lt;a href=&quot;https://www.eff.org/press/releases/new-free-certificate-authority-dramatically-increase-encrypted-internet-traffic&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.eff.org&amp;#x2F;press&amp;#x2F;releases&amp;#x2F;new-free-certificate-auth...&lt;/a&gt;</text></item></parent_chain><comment><author>jonny_eh</author><text>Cloudflare provides a free ssl service.</text></comment>