3 ms·

What on earth is this comment even about. First of all, HTTP/2 has a lot of advantage over HTTP/1.1, like server push. Saying it doesn't provide the benefits it

What on earth is this comment even about. First of all, HTTP/2 has a lot of advantage over HTTP/1.1, like server push. Saying it doesn't provide the benefits it claimed is wrong. It uses a single TCP connection, which for websites that require a lot of them (hint: lots of people nowadays do. You've got the webapp trend to thank for that) actually IMPROVES things. TCP overhead is not negligeable. And then there's the header compression algorithm that's included in HTTP2 that further helps getting size down. HTTPS-only is NOT a protocol limitation. It was pushed by BOTH Google AND Mozilla, in the name of security, like all the new features coming to the web (need webrtc ? Https. Want the camera ? https. Want https ? https). I'm not actually too sure I like that trend either, it feels like shoving candies down my throat. I like candies. But not like that. However, saying this is a Big Google Conspiracy is ridiculous. I mean what the hell does cookie have to do with anything. PS: On a separate note, could we get 10.0.0.X, 192.168.X.X, 127.0.0.1 and the file:// protocol counted as "Secure" please ? It's a pain to have to create a self-signed certs just to develop stuff.

Klathmon 10y ago
127.0.0.1 and localhost are counted as secure.
- roblabla 10y ago
  Oh really ? I didn't know that, that's cool. Is that a cross-browser, "standard" thing ?
  - Klathmon 10y ago
    At least in chrome and firefox it is. I believe in edge it needs some kind of registry setting.
colanderman 10y ago
10.0.0.X is commonly used across large institutional or corporate networks. If anything, a MITM is even easier there than on the public Internet.
- roblabla 10y ago
  The point is, it's also outside the reach of the public internet, so you can't get "proper" HTTPS anyway (unless you get a custom root CA). I fail to see the danger added in making this ip "Secure". Suddenly, a MITM-ing actor could modify the responses to do some webrtc and ask the user for his geoloc. I don't think it's that much more dangerous. And let's not mention the fact you can get a free HTTPS with let's encrypt, MITM an existing 10.0.0.X connection and serve a 301 to your https-enabled domain name. My use-case is rather simple : I host a few things at home, and I've had to install a root CA on every device just because I can't do webrtc otherwise. I could get a letsencrypt certificate for a domain name, but honestly that sucks.

Klathmon 10y ago

127.0.0.1 and localhost are counted as secure.

roblabla 10y ago
Oh really ? I didn't know that, that's cool. Is that a cross-browser, "standard" thing ?
- Klathmon 10y ago
  At least in chrome and firefox it is. I believe in edge it needs some kind of registry setting.

colanderman 10y ago

10.0.0.X is commonly used across large institutional or corporate networks. If anything, a MITM is even easier there than on the public Internet.

roblabla 10y ago
The point is, it's also outside the reach of the public internet, so you can't get "proper" HTTPS anyway (unless you get a custom root CA). I fail to see the danger added in making this ip "Secure". Suddenly, a MITM-ing actor could modify the responses to do some webrtc and ask the user for his geoloc. I don't think it's that much more dangerous. And let's not mention the fact you can get a free HTTPS with let's encrypt, MITM an existing 10.0.0.X connection and serve a 301 to your https-enabled domain name. My use-case is rather simple : I host a few things at home, and I've had to install a root CA on every device just because I can't do webrtc otherwise. I could get a letsencrypt certificate for a domain name, but honestly that sucks.