2 ms·
Am I the only person that is wary of 100% https ? Remember, once you encrypt a web resource in SSL, you add a ton of baggage on top of any methods that might b
by rsync 10y ago
Am I the only person that is wary of 100% https ?
Remember, once you encrypt a web resource in SSL, you add a ton of baggage on top of any methods that might be used to access it.
I like a world in which I can 'nc' a web resource and manipulate it with unix primitives without a truckload of software dependencies.
If sensitive information is involved, then certainly - use SSL. I understand that we must give up conveniences for that functionality.
But there are a lot of web resources that have existed, do exist, and potentially exist that are completely benign ... I think we're shackling ourselves by chasing after this perfection.
Or, put another way, we're chaining ourselves to a world where web resources are only accessed by web browsers, and only by those web browsers that are chaining themselves to a fairly dubious security scheme...
- icebraining 10y agoJust as you can use "nc" for an HTTP resource, you can use "openssl s_client" or "ncat --ssl" (from the nmap project) or "socat" to manipulate an HTTPS resource using the same unix primitives. Which truckload of dependencies does this require? The Debian package for OpenSSL only depends on libc. I do fully agree that the web is getting more tied to browsers, and to me that's worrying, but TLS is mostly a transparent tunnel over which you can use the same protocols; it's not part of that trend, in my opinion.