Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Probably because for static text sites the compute cost of TLS is negligible (and we're largely talking about either small personal blogs or the long tail of historic content, so traffic is already assumed to be minimal). In your case, TLS is rather unfortunate since you can just include a crypto hash (or merkle tree or whatever) of the payload in your HTTPS control connection, then just load your video payloads over HTTP and check for a mismatch client-side. Basically, Google is saying they don't trust "you" to get it right.

The bigger problem with TLS is that it adds so much brittleness and complexity (do you know how many times I've broken ACME/LE python dependencies by accident?) and increases the time-to-first-byte for so many sites, especially if you're not getting your hands dirty with nginx and OpenSSL internals.

(Even if you are tuning all the right knobs, one thing we didn't realize was that at some point using an EV SSL certificate (before Chrome removed the UI benefits of doing so) began causing a massive increase in TTFB that there doesn't (didn't?) seem to be any way to avoid, so we ended up moving to regular TLS/SSL certs w/ Let's Encrypt not for the free cost of entry but for the reduced initial connection time. I can't remember the exact details now as it's been some years, but I think with EV SSL there's a secondary cert or revocation lookup to a remote url even if you have correctly configured ocsp stapling.)



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: