On 2016-08-23 15:31, Maxim Konovalov wrote:
Let me repeat: nginx.org supports HTTPS.
I don't think it adds any measurable security here but it's matter
of religion but you can use it for free if you think it does.
+1
Although it would be chique if nginx.org would advertise a HSTS-header
so that next requests are over HTTPS if a browser supports it.
You could also opt to add it to the HSTS-preload database, which works
in all major browsers. Even the initial request goes to HTTPS then.
Numerous reasons to support the unencrypted version have already been
given, and (high) encryption is offered.
In my opinion you should offer encrypted and unencrypted over the same
address, and use technologies like these to make capable browsers that
prefer encryption, use that by default through this way.
Do not simply force encryption on the main site, there's simply no need
in this day and age. A lot of companies have thought about this before,
including major browser developers.
Since those are the ones we serve websites too, it shouldn't take too
much effort to convince people that they might have a point with doing
it this way.
You can also consider enabling DNSSEC-support for nginx.org, which also
makes your recursors able to validate nginx.org (and therefore downloads
and signature validation from).
You can then also mitigate MITM attacks, without encryption enabled.
As for speed, TLS with nginx is pretty fast, especially with other
technologies to quickly push through more requests.
Not same level as unencrypted connections, but it's -certainly with
hardware AES-support in most CPU's- not that big of a deal anymore for
most sites.
Just my € 0,02
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
