Hacker News Reader

Comment by joelrunyon | Hacker News Reader

Seriously, SSLs basically 2x the hosting cost for low end hosting packages.

Not great for people running small websites.

SSL should be a universally available free resource. I expect that it will be in the near future. That said, it is still very cheap for small sites too:

$9 - $11 / year for perfectly good certs. Less than $1 per month is a small burden.

https://www.namecheap.com/security/ssl-certificates/domain-v...

I understand what you're saying, requiring SSL doesn't seem like too much of a burden superficially. But it's magnitudes harder and more frustration inducing than simply buying a domain. My website is protected by the cheapest certificate on that list, and it was a gigantic pain to set up. Also, only the root subdomain on my site is protected -- I have things on other subdomains which I can't encrypt because $10 dollars a year quickly adds up.

but you have to get a dedicated IP as well, which means you can host less sites on a small server - something bad for smaller biz.

All modern browsers support SNI [1]. I guess if you need to support IE8 on WinXP you'll have problems. And IIRC, wget on Ubuntu 12.04 doesn't support it (while curl does). But it's picked up a lot in recent years, which thankfully eases the dedicated IP requirement in many cases.

[1] -- http://en.wikipedia.org/wiki/Server_Name_Indication

Absolutely no need for a dedicated IP unless you want to support very old versions of Windows or very old versions of Android. I haven't allocated a dedicated IP solely for SSL in years.

"hosting package" =/= "cert[ificate]"

That's not the cost. You have to pay someone to re-sign your cert every (other) year. This is a largely manual process. It's also going to cost you, if you want any compensation at all when they forget. Which they will, no matter how well you prepare.

>$9 - $11 / year for perfectly good certs

So long as you don't need any subdomains, right?

That is today's prices, based past demand. As demand for SSL hosting goes up, gradually replacing plaintext hosting, the price will come down.

I actually expect the price of plaintext HTTP hosting to go up a bit; partly due to reduced demand, but also due to increased risk/liability. With SSL being the "industry best practice", I expect at least a few bean counters will view the risk of private information leaks or hypothetical legal liability for enabling DDOS (similar to the "attractive nuisance" doctrine).

There will be a turbulent transition period, of course. As someone currently living at the poverty line, I have argued against the CA system many times. A SSL cert (and anual renewal) may be an insignificant cost to some people, but it is a real barrier when tha cost represents days/weeks of food. Unfortunately, none of this removes the need for encryption or the risks of plaintext. This is why I'm very excited about Let’s Encrypt; It might solve the cost problem, and it might avoid the StartSSL "no second-source" problem because it is a protocol first.

Internet use is only going up, so these transition costs are only going to go up. We can pay it now, or pay even more in the future.

Demand going up does not always mean that pricing goes down. Especially when supply is limited

Obviously. What's your point? That the price of SSL hosting will stay the same? Go up? I never claimed it would equalize perfectly, just that it would get cheaper in the future.

Also, why do you think the supply of SSL hosting services is necessarily limited any more than traditional plaintext hosting would be?

Reply on news.ycombinator.com