Hacker News new | ask | show | jobs
by ricogallo 3980 days ago
Indeed, but you can see that a bunch of Wordpress sites are obscure, ancient and insecure by default.
1 comments
martius 3980 days ago
He's talking about a client not supporting HTTPS.

A client may have reasons to prefer HTTP over HTTPS: perfs, plaintext for debug, etc. It's hard to assume that "HTTPS should be the default" in any circumstance.

I'm not sure the wordpress sites are to blame here (for once): SSL isn't free to deploy (yet).

link
uxp 3979 days ago
SSL is free to deploy: https://www.startssl.com?app=12

If you have a site that gets enough traffic that you need a better supported or more validated certificate, then I'm sure the $40/yr for a cheapass godaddy cert is worth the money.

link
martius 3979 days ago
Assuming you have time and knowledge to do it. Assuming you own the domain or at least are able to access to its DNS records. Assuming you can use SNI (and all your visitors too) or have your own IPv4 address. Assuming $40 is free...

No, even a free certificate doesn't mean that deploying ssl is free.

link