4 ms·

Yes, shame all libraries/swimming pools giving their schedule online without HTTPS. Shame gutenberg project, the documentations for OS, code, your washing machi

Yes, shame all libraries/swimming pools giving their schedule online without HTTPS. Shame gutenberg project, the documentations for OS, code, your washing machine. Why would money from libraries gutenberg project, NGOs informations go to more expansive OPEX for web hosting when an information is clearly designed and OK to be public? And does not require adds or payment. Google has some godwin point very authoritative views on the internet and the protocols that make me dislike them. Especially that their business model it is to not pay transit for distributing their contents. Basically every fucking internet users pay the 95th percentile transit to google products even if they don't watch videos on youtube, don't use gmail or else. These people are like ... catholic priests. Do as I say, not as I act and be good members of the community.

geofft 11y ago
What additional money is needed to implement HTTPS? It's like an afternoon of a sysadmin's time; it doesn't require any more opex. If you have a favorite library or NGO that doesn't support HTTPS for lack of funding, I am personally happy to donate an afternoon's of a sysadmin's wages to them. (Or to set it up for them, honestly.) Project Gutenberg is already over HTTPS, so I'm not sure what you mean by that. If you think they were strongarmed by Google into it, instead of having decided this long ago as a simple and obvious step for the good of their mission, a reference for that would help inform the discussion.
- schoen 11y ago
  Libraries in particular can get help from the Library Freedom Project to set up HTTPS. Some librarians have come to appreciate its importance in protecting information about what library resources (like books) patrons are interested in, for library web sites that allow people to do catalogue searches online, for example. https://libraryfreedomproject.org/ourwork/digitalprivacypledge/ https://libraryfreedomproject.org/ourwork/digitalprivacypled... (It's true that that's not the original poster's exact example, which hypothesized a static site that just tells you the library's schedule. But I think library catalogues are a super-great example where information is completely public -- it's not secret what the library has in its collection -- but information about users' interest in that information is private and sensitive, and the people providing the information strongly agree with that concern when they stop to think about it; librarians care very much about not revealing who is interested in which books.)
- SFjulie1 11y ago
  buying a certificate and changing it yourself. So it costs minimum price a certificate, and at least one person competent enough. And competence in terms of spending is way more than the certificate. Outsourcing security without knowledge is praying for being abused. So sometimes you are better in terms of costs and efficiency without. And HTTPS cost more for rural users because you cannot cache SSL contents. So in africa, alaska, yukon, peta ouchnok people with small providers have to pay a tax. And it increases also the 95th percentile. So basically everybody except google will pay for this but it will impact more the poorest content provider & users.
  - geofft 11y ago
    Certificates are free. The required competence is only marginally more than the required competence of setting up a website, and is rapidly dropping to zero more. (And is, if your website is hosted by a third-party service, which is a pretty reasonable approach for the organizations you name.) I don't understand what you mean by "Outsourcing security without knowledge is praying for being abused." From your original argument, the website admins don't care about security, right? So the worst that happens is their setup is insecure, but their setup was insecure to start with, and the were okay with that. You aren't more at risk from outsourcing your HTTPS versus just not doing HTTPS. I'd be very surprised to hear that people in Alaska are getting their internet via an HTTP cache. Frankly, I'd also be surprised to hear that people in Africa are, except possibly for certain mobile internet. I'm curious, where does this happen? Even so, and especially for mobile internet, HTTPS isn't a problem. The provider gives you the phone, so they can control the software, certs, etc. on it. They can run a caching proxy server that takes "HTTPS" requests in plaintext, and sends them out over HTTPS if they can't be satisfied from the cache. (It's pretty easy to configure an HTTP forward proxy this way.)
    - SFjulie1 11y ago
      Certificates are free? Some are. Do you trust certificates given without checking the real identity of the user? I do not. It has a cost. If you do not check you have the perfect tool for a MITM. Then is https more expensive than http? Of course you idiot. Have you never seen your CPU burn under https? With TLS the load is on the first connection. Meaning it is around x% (x said to be 1 by google) for long sessions IF and only IF you have a costly engineer optimizing your stack. And I know by experience that google cipher suite are sometimes close to be ridicusly weak in order to achieve this. (I saw an RC4 while playing with gmail). And that is servers side. Add the client side. So what about no "engineer". What about an SSL2.0 cipher suite having RC4 MD5 ... and all the default weak settings recommended you can see on the internet? Well, the illusion of security is no security. the S of https is for security. Having a tag saying I am secure if any government or criminal organisation can break your ciphering in a matter of seconds is no actual security. And it defeats the purpose of TRUST granted by security. Then way pay the extra x% of https in this case? Oh! I just read your last paragraph. Can someone explain to this person why HTTPS cannot be cached? Oh! It can it : has been sold to Tunisia by MS in 2007, France to lybia circa 2005, China is doing it ... for intercepting and deciphering citizens conversation. Caching HTTPS is basically doing a Man In The Middle attack. It requires a "joker" certificate nicely given by a root authority. Doing so (as microsoft did) normaly induce "the death penalty" of security firms. MS is alive, hence anyway we cannot trust https ... since snowden revelations. The proxy would still have to do the handshake anyway to have the https => cpu load. The premise of security are trust. https nowadays is a costly joke. For the record operators especially when IP routing goes through shared tunnel of collects (3G) have been traditionnaly using a protocol called WCCP to cache transparently your http content. And 4G is deployed substantially in USA & wealthy European countries, but not everywhere. So even if you don't have a proxy your operator may. And if you think all USA is at 1Mb/sec for 50$/months read this http://seclists.org/nanog/2015/Oct/337 http://seclists.org/nanog/2015/Oct/337 Last and least : I worked in an ISP 10 years ago. One of the datacenter was 5% of france global traffic, the electricity used was as much as a city of 40K inhabitants. It makes internet as an industry the biggest user of fossil energies. According to my approximation we should be around 2%[+1%?] of the global national consumption. Very near transport industry (plane + trucks). And https will not help. So I see no other arguments for https than being sheeps.
theandrewbailey 11y ago
> Yes, shame all libraries/swimming pools giving their schedule online without HTTPS. Shame gutenberg project, the documentations for OS, code, your washing machine. So it's OK for someone to tamper with your documentation to trick you into doing something dangerous? Is it OK for a librarian to give out information on who looked at what? > Basically every fucking internet users pay the 95th percentile transit to google products even if they don't watch videos on youtube, don't use gmail or else. Except Google does pay for their transit. They pay for bulk transit to go around the world. Just like everyday internet users pay their ISP to get data the rest of the way down the road to where they are.
- SFjulie1 11y ago
  Seriously. Who would care about a library? Not everything on the internet is privacy. And even with https any proxy (WCCP) already knows which URL I went to.

geofft 11y ago

What additional money is needed to implement HTTPS? It's like an afternoon of a sysadmin's time; it doesn't require any more opex. If you have a favorite library or NGO that doesn't support HTTPS for lack of funding, I am personally happy to donate an afternoon's of a sysadmin's wages to them. (Or to set it up for them, honestly.) Project Gutenberg is already over HTTPS, so I'm not sure what you mean by that. If you think they were strongarmed by Google into it, instead of having decided this long ago as a simple and obvious step for the good of their mission, a reference for that would help inform the discussion.

schoen 11y ago
Libraries in particular can get help from the Library Freedom Project to set up HTTPS. Some librarians have come to appreciate its importance in protecting information about what library resources (like books) patrons are interested in, for library web sites that allow people to do catalogue searches online, for example. https://libraryfreedomproject.org/ourwork/digitalprivacypledge/ https://libraryfreedomproject.org/ourwork/digitalprivacypled... (It's true that that's not the original poster's exact example, which hypothesized a static site that just tells you the library's schedule. But I think library catalogues are a super-great example where information is completely public -- it's not secret what the library has in its collection -- but information about users' interest in that information is private and sensitive, and the people providing the information strongly agree with that concern when they stop to think about it; librarians care very much about not revealing who is interested in which books.)
SFjulie1 11y ago
buying a certificate and changing it yourself. So it costs minimum price a certificate, and at least one person competent enough. And competence in terms of spending is way more than the certificate. Outsourcing security without knowledge is praying for being abused. So sometimes you are better in terms of costs and efficiency without. And HTTPS cost more for rural users because you cannot cache SSL contents. So in africa, alaska, yukon, peta ouchnok people with small providers have to pay a tax. And it increases also the 95th percentile. So basically everybody except google will pay for this but it will impact more the poorest content provider & users.
- geofft 11y ago
  Certificates are free. The required competence is only marginally more than the required competence of setting up a website, and is rapidly dropping to zero more. (And is, if your website is hosted by a third-party service, which is a pretty reasonable approach for the organizations you name.) I don't understand what you mean by "Outsourcing security without knowledge is praying for being abused." From your original argument, the website admins don't care about security, right? So the worst that happens is their setup is insecure, but their setup was insecure to start with, and the were okay with that. You aren't more at risk from outsourcing your HTTPS versus just not doing HTTPS. I'd be very surprised to hear that people in Alaska are getting their internet via an HTTP cache. Frankly, I'd also be surprised to hear that people in Africa are, except possibly for certain mobile internet. I'm curious, where does this happen? Even so, and especially for mobile internet, HTTPS isn't a problem. The provider gives you the phone, so they can control the software, certs, etc. on it. They can run a caching proxy server that takes "HTTPS" requests in plaintext, and sends them out over HTTPS if they can't be satisfied from the cache. (It's pretty easy to configure an HTTP forward proxy this way.)
  - SFjulie1 11y ago
    Certificates are free? Some are. Do you trust certificates given without checking the real identity of the user? I do not. It has a cost. If you do not check you have the perfect tool for a MITM. Then is https more expensive than http? Of course you idiot. Have you never seen your CPU burn under https? With TLS the load is on the first connection. Meaning it is around x% (x said to be 1 by google) for long sessions IF and only IF you have a costly engineer optimizing your stack. And I know by experience that google cipher suite are sometimes close to be ridicusly weak in order to achieve this. (I saw an RC4 while playing with gmail). And that is servers side. Add the client side. So what about no "engineer". What about an SSL2.0 cipher suite having RC4 MD5 ... and all the default weak settings recommended you can see on the internet? Well, the illusion of security is no security. the S of https is for security. Having a tag saying I am secure if any government or criminal organisation can break your ciphering in a matter of seconds is no actual security. And it defeats the purpose of TRUST granted by security. Then way pay the extra x% of https in this case? Oh! I just read your last paragraph. Can someone explain to this person why HTTPS cannot be cached? Oh! It can it : has been sold to Tunisia by MS in 2007, France to lybia circa 2005, China is doing it ... for intercepting and deciphering citizens conversation. Caching HTTPS is basically doing a Man In The Middle attack. It requires a "joker" certificate nicely given by a root authority. Doing so (as microsoft did) normaly induce "the death penalty" of security firms. MS is alive, hence anyway we cannot trust https ... since snowden revelations. The proxy would still have to do the handshake anyway to have the https => cpu load. The premise of security are trust. https nowadays is a costly joke. For the record operators especially when IP routing goes through shared tunnel of collects (3G) have been traditionnaly using a protocol called WCCP to cache transparently your http content. And 4G is deployed substantially in USA & wealthy European countries, but not everywhere. So even if you don't have a proxy your operator may. And if you think all USA is at 1Mb/sec for 50$/months read this http://seclists.org/nanog/2015/Oct/337 http://seclists.org/nanog/2015/Oct/337 Last and least : I worked in an ISP 10 years ago. One of the datacenter was 5% of france global traffic, the electricity used was as much as a city of 40K inhabitants. It makes internet as an industry the biggest user of fossil energies. According to my approximation we should be around 2%[+1%?] of the global national consumption. Very near transport industry (plane + trucks). And https will not help. So I see no other arguments for https than being sheeps.

theandrewbailey 11y ago

> Yes, shame all libraries/swimming pools giving their schedule online without HTTPS. Shame gutenberg project, the documentations for OS, code, your washing machine. So it's OK for someone to tamper with your documentation to trick you into doing something dangerous? Is it OK for a librarian to give out information on who looked at what? > Basically every fucking internet users pay the 95th percentile transit to google products even if they don't watch videos on youtube, don't use gmail or else. Except Google does pay for their transit. They pay for bulk transit to go around the world. Just like everyday internet users pay their ISP to get data the rest of the way down the road to where they are.

SFjulie1 11y ago
Seriously. Who would care about a library? Not everything on the internet is privacy. And even with https any proxy (WCCP) already knows which URL I went to.