HTTPS Turned On By Default For Premium Members

[Michael]

I'm about 99.999% certain that you've got some seriously bad code running on this. Forget about the people who say you shouldn't be running PHP, for what this site appears to be doing *WITH* PHP, and the kind of loads that this site can reasonably be assumed to receive, that kind of hardware is massively overkill... ***FOR A PHP SITE***.

The problem is that there is a VAST difference between somebody who can whip off a few "cool features", and somebody who actually understands how code runs.

I manage a number of people of all different skill levels, who work on different kinds of projects in different kinds of languages, including some very dynamic php/sql sites that certainly handle a much greater amount of traffic than phoronix, no offense. The PHP people are *by far* the worst, when it comes to optimizing code. One lousy script that does something (really) stupid, like a nested loop that iterates over a list several times instead of letting the sql server select the result from a properly indexed table, can make the difference between the server's CPU load being an easy 5-10%, and being on its knees.

It just isn't Phoronix.com but on this same server is OpenBenchmarking.org and other parts of the PTS infrastructure as well, which can get upwards of a million queries per day from PTS client interactions, etc.

[liamdawe]

It just isn't Phoronix.com but on this same server is OpenBenchmarking.org and other parts of the PTS infrastructure as well, which can get upwards of a million queries per day from PTS client interactions, etc.

That's a really bad idea, I guess that's why quite often Phoronix is terribly slow to load.

You should really give Phoronix a cheap scalable cloud server by itself, it would solve a lot of issues for you.

[starcrossed]

Use of Cloudflare essentially makes HTTPS pointless. With non-HTTPS, you just risk getting MITM'd. With Cloudflare, you're always MITM'd and get to deal with Tor users (and as I hear, even VPN users) getting hassled with captcha.

There's a big difference between letting anyone MITM your users, and picking a technology partner that has access to some of your data (CloudFlare, EC2, Papertrail, Digital Ocean, etc...). Give me a break.

[Guest]

There's a big difference between letting anyone MITM your users, and picking a technology partner that has access to some of your data (CloudFlare, EC2, Papertrail, Digital Ocean, etc...). Give me a break.

What makes Cloudflare any different than some random people? I have no idea who handles what data over at Cloudflare, but it's ok to just hand them my SSL keys, let them MITM me, and trust them just because they're a popular company?

In the case of Phoronix though, it's already been made clear user privacy isn't that significant, so the above doesn't exactly mean too much. But I'm assuming there was more than enough complaints from other people to reverse the decision to use it in the past.

[castlefox]

It is great to hear Https has been turned on

[Michael]

In the case of Phoronix though, it's already been made clear user privacy isn't that significant, so the above doesn't exactly mean too much. But I'm assuming there was more than enough complaints from other people to reverse the decision to use it in the past.

I care about user privacy, I am just reasonable and realistic about things. But yes temporarily using CloudFlare -- when my original plan was to use it for CDN to relieve server load but had the HTTPS benefit -- there were a lot of people complaining about CF for the different reasons that I decided to abandon them entirely.

For what it's worth for those still upset about the decision, in the next month or two I hope to roll out OpenBenchmarking.org to a different server and at that time can re-evaluate the possibility of HTTPS for everyone by default.

[damentz]

That's a really bad idea, I guess that's why quite often Phoronix is terribly slow to load.

You should really give Phoronix a cheap scalable cloud server by itself, it would solve a lot of issues for you.

Yes, that would be a good solution, but it's also a very expensive solution. Scalable cloud servers, like with AWS, are expensive if you don't take advantage of the ability to dynamically shut off or destroy web instances. Plus, one aspect of cloud computing that people don't specifically mention is their poor performance. If you're already strapped for performance, get ready to empty your bank account - performance is expensive in cloud, especially on AWS.

I think what Michael is doing is probably the most affordable thing he could do right now - run his website from one powerful server blade or rack and share all the other costs, including bandwidth, among his other machines. Most people don't or can't do that though, so they end up going with sites like Linode for monolithic servers or Digital Ocean / AWS for scalable websites that _do_ have steep peaks and troughs in their activity.

[SystemCrasher]

Whatever, but Cloudflare and some few other CDNs do NOT respect privacy. They hijack HTTPS traffic, making it essentially pointless. If CDN sees traffic, it can share it with hell knows whom, and whole point of HTTPS is lost. So cloudflare is so great in marketing their ... snake oil thing. False sense of security is even worse than none security at all. Because you expect security while there is none. Browser shows it is HTTPS. But it is not. Cloudflare can spy on all traffic. And even dares to hijack it. By e.g. popups.

So I see little point in using cloudflare's "so called HTTPS" which isn't much better than plain HTTP because it DOES NOT offers any traffic protection.

[liamdawe]

Yes, that would be a good solution, but it's also a very expensive solution. Scalable cloud servers, like with AWS, are expensive if you don't take advantage of the ability to dynamically shut off or destroy web instances. Plus, one aspect of cloud computing that people don't specifically mention is their poor performance. If you're already strapped for performance, get ready to empty your bank account - performance is expensive in cloud, especially on AWS.

I think what Michael is doing is probably the most affordable thing he could do right now - run his website from one powerful server blade or rack and share all the other costs, including bandwidth, among his other machines. Most people don't or can't do that though, so they end up going with sites like Linode for monolithic servers or Digital Ocean / AWS for scalable websites that _do_ have steep peaks and troughs in their activity.

Digital Ocean are rather cheap, you can boot up a new server in a few minutes, and adjust the size of a current one just as easily. They are more like what I meant, we use them for GamingOnLinux, and they work out perfectly.

I can't see Phoronix (the main site and forum) using all that many resources, certainly not much more than GOL uses.

The main issue here is having heavier stuff on the same server.

How slow to load Phoronix is at times is yet another reason I am put off by it, please sort it out and give it a different server.

[Kano]

If you want to use ads then those should be using https otherwise every recent browser will ask to block unencrypted content. But of couse https would be a good idea, especially if you are using not your own WLAN. Lots of possible sniffers around. Same applies to all Tor users, endpoints could be manipulated.