[ThreeFx]

I think this post misses the point of HTTPS completely. It makes HTTPS sound like some new technology, even though the HTTP protocol is still used, the difference being that the connection is encrypted and integrity protected.

And that said integrity protection is what is important in today's world: advertising is being injected into HTTP content by third parties which is a very bad thing IMO.

If updating your servers once-in-a-while is too much for you, maybe running a webserver isn't for you at all - there are certainly enough hosting providers which handle that for you.

[hedora]

The point of the article is that the web ecosystem is breaking compatibility with “old” servers every six months or so these days.

First certbot broke. Now, older tls. Next, they’ll probably deprecate tls 1.2.

I imagine http 1 or 2 will be on the chopping block in the next few years.

They can’t kill both http 1 and http 2 because http 3 needs to use at least one of them as a signaling protocol to establish connections. I’m guessing that means there will be an http 4 that breaks with http 3, but doesn’t need a separate session establishment protocol. (Http 3 partially breaks TCP, and replaces it with userspace stuff. Http 4 would complete that process.)

The web was a success precisely because it was simple and stable enough to let everyone escape from the old hosting providers. They heavily censored content, charged high fees and so on.

Now, hosting is unnecessarily complicated, and the providers are consolidating back into a handful of players like facebook YouTube and cloudflare. Censorship and mass surveillance are on the rise. Since more people use computers than before, these players are helping kill the free press.

Telling people that operating a static web page should be a full time job, because it’s (been made) really hard is just accelerating these trends.

[ThreeFx]

I completely agree on the breaking issues, it is a _lot_ of work to maintain a website these days. In 99% of the cases I'd also agree with you that there should be _no_ reason ever to break e.g. a library used or something.

But the thing about certbot and TLS is that these things are security-relevant, and IMO security one of the only (if not the only) reason to break compatibility these days. TLS ciphers break, heck even the TLS protocol itself may reveal flaws later (see POODLE, BEAST, FREAK, etc.). That's why SSLv2, SSLv3 and TLS1.0 are deprecated: Not because there is a better protocol out there, but because the protocols are inherently insecure. (There is no huge flaw in TLS1.1 I am aware of, it uses MD5 and SHA1 under the hood for master secret derivation, but that's about the only thing).

I'm with you that maintenance is a big chunk of work, but that's IMO a price you pay for being in control. I've got a few services running myself, and honestly I forget about the boxes after setup and enabling auto-upgrades, so it isn't too breaking, at least for me.