undefined | Better HN

0 pointsmajewsky6y ago0 comments

Even with a static HTTP-only website, there's tons of stuff that you have to update anyway. Hardware gets outdated and needs replacing, at which point you cannot postpone the kernel update anymore because you need the new device drivers, etc. etc. You also don't want to stop updating your HTTP server, CVEs get discovered quite frequently. You can of course draw a line between that churn and the churn of updating your TLS config every few years, but it's more arbitrary than you think.

0 comments

UserIsUnused6y ago

> Hardware gets outdated and needs replacing

Irrelevant. Low traffic static website.

> at which point you cannot postpone the kernel update anymore because you need the new device drivers, etc. etc

Irrelevant as I didn't upgrade the hardware

>You also don't want to stop updating your HTTP server, CVEs get discovered quite frequently

it's a server for serving a single static page from 1998, nothing bad will happen if that machine is compromised, well, nothing worse that what could be done for not having HTTPs

theandrewbailey6y ago

> it's a server for serving a single static page from 1998, nothing bad will happen if that machine is compromised, well, nothing worse that what could be done for not having HTTPs

Here's one: the server has a remote code execution vulnerability, which is exploited to gain root permissions, and your server is serving child porn. The cops are knocking on your door.

Granted, this isn't a pro-HTTPS argument, but you do need to keep your stuff updated, even if it is only a static site.

j / k navigate · click thread line to collapse