SSL certs are expensive because of the administrative work associated with it. 

Riley Childs
Library Director and IT Admin
Junior
Charlotte United Christian Academy
P: 704-497-2086 (Anytime)
P: 704-537-0331 x101 (M-F 7:30am-3pm ET)

Sent from my iPhone 
Please excuse mistakes

> On Nov 6, 2013, at 8:28 PM, Cary Gordon <[log in to unmask]> wrote:
> 
> It sounds like we are willing to throw security under the bus for an edge case, although I am sure that I am missing some subtlety
> 
> Cary
> 
>> On Nov 5, 2013, at 10:27 AM, Ross Singer <[log in to unmask]> wrote:
>> 
>>> On Tue, Nov 5, 2013 at 12:07 PM, William Denton <[log in to unmask]> wrote:
>>> 
>>> 
>>> (Question:  Why does HTTPS complicate screen-scraping?  Every decent tool
>>> and library supports HTTPS, doesn't it?)
>> 
>> Birkin asked me this same question, and I realized I should clarify what I
>> meant.  I was mostly referring to existing screen scrapers/existing web
>> sites.  If you redirect every request from http to https, this will
>> probably break things.  I think the Open Library example that Karen
>> mentioned is a good case study.
>> 
>> And it's pretty different for a library or tool to support HTTPS and a
>> specific app to be expecting it.  If you follow the thread around that OL
>> change, it appears there are issues with Java (as one example) arbitrarily
>> consuming HTTPS (from what I understand, you need to have the cert
>> locally?), but I don't know enough about it to say for certain.  I think
>> there would also probably be potential issues around mashups (AJAX, for
>> example), but seeing as code4lib.org doesn't support CORS, not really a
>> current issue.  Does apply more generally to your question about library
>> websites at large, though.
>> 
>> Anyway, I agree with you that the option for both should be there.  I'm not
>> just not convinced that HTTPS-all-the-time is necessary for all web use
>> cases.
>> 
>> -Ross.