<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.30.3">
</HEAD>
<BODY>
Here's my quick feedback on HTTPS-everywhere, from a service providers' perspective.<BR>
<BR>
On our service, we only have certain sensitive pages linked under HTTPS. The vast majority are linked under HTTP. You can get to them with HTTPS, but they won't work well.<BR>
<BR>
Why? Because HTTPS is costly. Tricks that we use to spread lots of hits over many cheap servers don't work with HTTPS. If we were to use HTTPS for all pages, say, we'd probably need twice as many Web servers.<BR>
<BR>
Our software's Open Source and federated, so if someone wants to run it on their own server with SSL enabled all the time (we support that), they can.<BR>
<BR>
But if everyone used HTTPS-everywhere to access our servers, it would mean we'd have to shut down our service for everyone.<BR>
<BR>
-Evan<BR>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
<BR>
<HR NOSHADE SIZE="1">
<BR>
Evan Prodromou, CEO<BR>
StatusNet Inc., 1124 rue Marie-Anne Est #32, Montreal, QC H2J 2T5<BR>
T: 438-380-4801 x101 C: 514-554-3826 W: <A HREF="http://evan.status.net/">http://evan.status.net/</A> E: <A HREF="mailto:evan@status.net">evan@status.net</A><BR>
<BR>
<BR>
</TD>
</TR>
</TABLE>
</BODY>
</HTML>