At what point is it okay to depend on a feature?
> not leashing themselves to some TLS cert feudal lord
Really?
You can get one free and change at any time.
> not leashing themselves to some TLS cert feudal lord
Really?
You can get one free and change at any time.
>Sustainability is also the one of the many reasons why my web site is served over HTTP and not HTTPS. The problem with HTTPS is that you need to get a certificate from a trusted authority, which either costs money or is free but needs to be updated every month, and even if you pay for it, you need to renew the certificate every year or so. If the operation of your blog depends on a monthly certificate renewal from Let's Encrypt – even if the renewal is set up to be automatic – it is less sustainable than serving your site over HTTP. HTTP will always be around, will always be supported and will never require a certificate.
>Another problem with HTTPS is that it is very difficult to revert back to HTTP once you have started using HTTPS. Every outside link to your web site will be incorrect, and you can't redirect HTTPS traffic to HTTP without a valid certificate. In other words, once you start using HTTPS, you will be forever dependent on the certificate renewal process.
This is the reason why i fear that if we dont act fast for some things, younger generations without the proper historical context, will only follow through a path that treat them like human cattle, only to serve the feudal FAANG rulers.
The cloud + dumb web/app clients duo is really dangerous to us all, and unfortunately this is the path we are heading to.
No control, no freedom, no power, no voice, working as a dumb colony of mere tech consumers.
Centralization should be the enemy of anyone who fight for those values.
If you're really that worried about Let's Encrypt turning evil, you could stop having one when that actually happens. Or get a free one from many DNS providers. Or pay $5 for one. There is zero lock-in, and keeping traffic encrypted is a good thing.
Obviously that doesn't work for the web, but "TLS cert feudal lord" doesn't track for me at all.
But browsers are getting more and more restrictive about what they will allow their users to see. Right now technically ignorant people will be so confused and frightened by warnings they click away. That's okay, I don't care about those people. But for many it's a deal breaker. I give it about 3 years before the big corporate browsers stop allowing HTTP at all. Search engines already deprioritize HTTP and eventually they'll just delist. And it won't hurt their income one bit.
The number of sites that don't HTTP and just 304 to HTTPS is already frightening.
For a non-expert setting up a website from scratch, they can get the whole stack set up automatically and it won't make a difference to them. Especially since they're probably on shared hosting; shared hosting is much closer to the ideal of having the website be a folder of html than running an entire server.