Re: [pmm-cms-developers] Response about Security and SSL

[Bill H. <bil...@gm...>]

> 1. "Mike, isn't SSL open? And if so, then why would the stations even have
> to buy it?" 
>     Yes. SSL is an open standard like HTML, XML, ect.  A station does not
> have a pay anything unless they want an signed certificate from Verisign,
> Thwart or another.  It is possible that a host might charge for SSL access. 

Most of the time, hosting providers will charge a setup fee to make a
specific directory for SSL. Many stations, especially small ones, are
hosting with their license-holder, i.e. whatever university they are
affiliated with. In such a case, SSL access would need to be granted
by the IT department of that organization, ad these IT folks are not
always willing to do such things because they do not want to trouble
themselves to open the SSL port.

> 2. Setup? 
>     Very easy.  Only takes a few minutes and a number of Linux based Apache
> distros comes with it.  Windows Apache does not, however; OpenSSL is a free
> download with Win32 builds (you can check our my server:
> https://wr.townhouse.clarkson.edu/npr [it might be slow because of
> Clarkson's internet use policy garbage]).

Again, this is easy for folks who know how to do it and have shell
access. I would be willing to put money on the fact that most small
stations will not qualify on either point. So they will need both
permision and assistance.


My only remaining comment on this point is this. Having dealt with
many small business clients and provided hosting services for both
small and mid-sized organizations for nearly six years, and having
spoken with several small stations in the past regarding their hosting
situation and their abilities, knowledge and skills, it is obvious to
me that SSL cannot be required. There are too many opportunities for
SSL to be the one and only thing that would keep people from using the
software in that case.

I think you folks have made a wise decision to make it optional. As
long as you have a slightly less secure fallback (such as htaccess)
for those who can't use it, this is definitely the best solution to
this conundrum.

Have fun!

Bill Haenel