> for very high traffic websites HTTPS costs a lot of money. .gov sites are not very high traffic.
.gov sites can be very high traffic. Think weather, social security, health care, immigration, visas...
> - When you have such high traffic you also have a bunch of old winxp and similar clients. These dont work fast on HTTPS and dont work without sslv3 and what not.
SSLv3 only kills IE6, which is doable. And it's okay if very old clients work slowly with HTTPS -- those clients have far more problems than just slow HTTPS.
very high traffic is google.com and similar sites. gov sites are not the tiniest sites but they're dwarfed by anyone getting million hits per hour 24/7 (yes google is even way more than that obviously)
Killing IE6 and some others (java clients, etc.) is not always doable and thats the point. its doable for many but not all.
.gov sites can be very high traffic. Think weather, social security, health care, immigration, visas...
> - When you have such high traffic you also have a bunch of old winxp and similar clients. These dont work fast on HTTPS and dont work without sslv3 and what not.
SSLv3 only kills IE6, which is doable. And it's okay if very old clients work slowly with HTTPS -- those clients have far more problems than just slow HTTPS.