5 ms·

If you mean bootstrapping a webservice-project, I don't believe it's hard in any way. With offerings like Lets Encrypts, it's incredibly easy and takes no more

by fredsir 10y ago

If you mean bootstrapping a webservice-project, I don't believe it's hard in any way. With offerings like Lets Encrypts, it's incredibly easy and takes no more than 20 minutes.

dijit 10y ago
Bootstrapping using letsecrypt requires an internet connection and a public facing service. I can say that 14 year old me, who had books, a pc and no internet would have been screwed by this.
- icebraining 10y ago
  If you're just using it locally, you can use a self-signed cert. Caddy generates one automatically by just adding "self_signed" to your config[1]. Or you can copy-paste a single OpenSSL or PowerShell command to generate one. [1]: https://caddyserver.com/blog/caddy-0_9-released#easy-self-signed-certificates https://caddyserver.com/blog/caddy-0_9-released#easy-self-si...
  - drcongo 10y ago
    I tried out Caddy on a project the other day, it was incredibly simple to set up HTTP2 with Let's Encrypt.
  - dijit 10y ago
    This is the closest thing to reasonable that anybody has suggested. I seem to be getting brigaded by the encryption cargo cult and while I agree that nothing public facing should not have encryption it's a different thing to force all developing students to learn TLS/SSL before they start actually learning to code. I expressed dissatisfaction with the fact that learning to code for the web has a barrier to entry now that can be very difficult for various reasons. Learning To debug TLS issues is another problem in of itself which often takes a lot of years to fully understand. A new programmer should be very aware of the tools that are available to make this easier. But 14 year old me with a php book and no internet did not have such luxuries and that was all I said.
    - sametmax 10y ago
      People downvoting you completely forgot how it was when they started. They don't see the huge gap between us now, experts, and the beginners arriving on the market. In the quest of making our field more professional, we failed to make it gradual improvements.
    - pixl97 10y ago
      The difference between 14 year old you and now, is that crappy php app you made then might have made it years before it was hacked. These days it could last just minutes. The problem here is you are thinking about just yourself. Yes, it's hard to do learn all these things. It was especially hard back then because the the sources to learn were pretty crappy and taught a lot of bad things. That's part of the reason we have the 'exploit a day' internet we suffer from now. If new web developers have to learn both protocol security and code development, it will probably mean less developers. Which is great for the ones that take the time to learn, they'll get paid more. It also is probably better for the customer, hopefully it will mean they are less likely to get served virus_porn_encrypt-your-computer.exe from your half baked website.
  - sametmax 10y ago
    But this implies you can then deploy your caddy server. Which means a private server with root rights. Do you realize most devs don't even know server admin ? If you know the command line, you are not most dev. You are far, far away from the reality of enterprise software. Tomcat and apache are still massively deployed. If you moved to nginx years ago, remember than it's still a new toy for a huge number of people. So caddy...
    - openasocket 10y ago
      You don't need caddy, you just need a self-signed cert, which is pretty easy to generate.
    - vetinari 10y ago
      Apache is easy to configure with TLS or Let's Encrypt. The only unfortunate thing is, that RHEL7/CentOS7 have OpenSSL 1.0.1 and mod_http2 requires OpenSSL 1.0.2. Thus no http2 there.
    - jonathanoliver 10y ago
      Caddy doesn't require root. You can easily use systemd/upstart/custom scripts to run as an unprivileged user.
- metafunctor 10y ago
  Pardon my ignorance, but how will the 14 year old you create a website without an internet connection and a public facing service? If you can create one, presumably for your internal network, with no public facing parts, how exactly does letsencrypt "screw you"? You can create and distribute self-signed certificates today, just like you could the past 20 years.
  - dijit 10y ago
    If I'm required to use SSL to do hello world using php/mysql then that definitely is a turn-off.
    - DorothySim 10y ago
      You are not required to use SSL to do hello world. You are required to use SSL if you want to use HTTP2 (yes, I know about h2c).
- stephen_g 10y ago
  I'm confused - because the presence of HTTP2 means that HTTP no longer exists? Browsers will still support HTTP in a decade (current low-powered network hardware and the like will still be around and need to work).
sametmax 10y ago
It's 20 minutes only if you are exactly in the regular use case and already know what you are doing. And it's 20 minutes for one thing. Imagine if each little detail of your setup would take 20 minutes. And of course down the road you will have to figure out subdomains, cross domain requests, media streaming, embedding external unsecure content, debugging on mobile devices, etc. And of course this will work only if you are on a private server, cause on the simplest hosting you won't have this. You lost touch with the quantity of knowledge you accumulated over the years.
- pixl97 10y ago
  > embedding external unsecure content, There is an easy answer to that. DON'T Most browsers block it at this point, and rightfully so. A single unencrypted include can be used to inject malicious content on a web page. Lots of people use internet over untrusted connections (open wireless) or partially trusted connections (ISPs injecting content). >You lost touch with the quantity of knowledge you accumulated over the years. Therefore we must lobby that our skill set is protected by law and that protocols and best practices are not allowed to change! Uh? Sorry man, you are going to have to evolve as the internet changes. Well, you don't have to, but when all your devices are encrypted and asking for a few bit coins to unlock, you will have been warned that it was going to happen.
  - sametmax 10y ago
    > There is an easy answer to that. > DON'T Easy to say when your business is no tied to advertisers on which you have zero leverage. > Therefore we must lobby that our skill set is protected by law and that protocols and best practices are not allowed to change! Making TLS optional on HTTP2 would have not taken anything from you. You are just here in your ivory tower looking down on people that are clearly not as pure as your are. Well sorry, but down there, among the humans, you have PHP dev that are using EasyPHP, people that don't know the command line, people using mixed content and have no control over it, people that can't spend hours to continuously learn new things every week, people that don't have private servers and so on. And you know what ? I'm not even among them. I run my service on private servers with https. I use docker, letsencrypt and react or whatever is useful to me. But giving trainings and having friends running side business, I know that it's not the only reality in IT. So basically, right now, HTTP2 is just built to be hard for a huge part of the dev population, with no good reasons.

by fredsir 10y ago

If you mean bootstrapping a webservice-project, I don't believe it's hard in any way. With offerings like Lets Encrypts, it's incredibly easy and takes no more than 20 minutes.

dijit 10y ago

Bootstrapping using letsecrypt requires an internet connection and a public facing service. I can say that 14 year old me, who had books, a pc and no internet would have been screwed by this.

icebraining 10y ago
If you're just using it locally, you can use a self-signed cert. Caddy generates one automatically by just adding "self_signed" to your config[1]. Or you can copy-paste a single OpenSSL or PowerShell command to generate one. [1]: https://caddyserver.com/blog/caddy-0_9-released#easy-self-signed-certificates https://caddyserver.com/blog/caddy-0_9-released#easy-self-si...
- drcongo 10y ago
  I tried out Caddy on a project the other day, it was incredibly simple to set up HTTP2 with Let's Encrypt.
- dijit 10y ago
  This is the closest thing to reasonable that anybody has suggested. I seem to be getting brigaded by the encryption cargo cult and while I agree that nothing public facing should not have encryption it's a different thing to force all developing students to learn TLS/SSL before they start actually learning to code. I expressed dissatisfaction with the fact that learning to code for the web has a barrier to entry now that can be very difficult for various reasons. Learning To debug TLS issues is another problem in of itself which often takes a lot of years to fully understand. A new programmer should be very aware of the tools that are available to make this easier. But 14 year old me with a php book and no internet did not have such luxuries and that was all I said.
  - sametmax 10y ago
    People downvoting you completely forgot how it was when they started. They don't see the huge gap between us now, experts, and the beginners arriving on the market. In the quest of making our field more professional, we failed to make it gradual improvements.
  - pixl97 10y ago
    The difference between 14 year old you and now, is that crappy php app you made then might have made it years before it was hacked. These days it could last just minutes. The problem here is you are thinking about just yourself. Yes, it's hard to do learn all these things. It was especially hard back then because the the sources to learn were pretty crappy and taught a lot of bad things. That's part of the reason we have the 'exploit a day' internet we suffer from now. If new web developers have to learn both protocol security and code development, it will probably mean less developers. Which is great for the ones that take the time to learn, they'll get paid more. It also is probably better for the customer, hopefully it will mean they are less likely to get served virus_porn_encrypt-your-computer.exe from your half baked website.
- sametmax 10y ago
  But this implies you can then deploy your caddy server. Which means a private server with root rights. Do you realize most devs don't even know server admin ? If you know the command line, you are not most dev. You are far, far away from the reality of enterprise software. Tomcat and apache are still massively deployed. If you moved to nginx years ago, remember than it's still a new toy for a huge number of people. So caddy...
  - openasocket 10y ago
    You don't need caddy, you just need a self-signed cert, which is pretty easy to generate.
  - vetinari 10y ago
    Apache is easy to configure with TLS or Let's Encrypt. The only unfortunate thing is, that RHEL7/CentOS7 have OpenSSL 1.0.1 and mod_http2 requires OpenSSL 1.0.2. Thus no http2 there.
  - jonathanoliver 10y ago
    Caddy doesn't require root. You can easily use systemd/upstart/custom scripts to run as an unprivileged user.
metafunctor 10y ago
Pardon my ignorance, but how will the 14 year old you create a website without an internet connection and a public facing service? If you can create one, presumably for your internal network, with no public facing parts, how exactly does letsencrypt "screw you"? You can create and distribute self-signed certificates today, just like you could the past 20 years.
- dijit 10y ago
  If I'm required to use SSL to do hello world using php/mysql then that definitely is a turn-off.
  - DorothySim 10y ago
    You are not required to use SSL to do hello world. You are required to use SSL if you want to use HTTP2 (yes, I know about h2c).
stephen_g 10y ago
I'm confused - because the presence of HTTP2 means that HTTP no longer exists? Browsers will still support HTTP in a decade (current low-powered network hardware and the like will still be around and need to work).

sametmax 10y ago

It's 20 minutes only if you are exactly in the regular use case and already know what you are doing. And it's 20 minutes for one thing. Imagine if each little detail of your setup would take 20 minutes. And of course down the road you will have to figure out subdomains, cross domain requests, media streaming, embedding external unsecure content, debugging on mobile devices, etc. And of course this will work only if you are on a private server, cause on the simplest hosting you won't have this. You lost touch with the quantity of knowledge you accumulated over the years.

pixl97 10y ago
> embedding external unsecure content, There is an easy answer to that. DON'T Most browsers block it at this point, and rightfully so. A single unencrypted include can be used to inject malicious content on a web page. Lots of people use internet over untrusted connections (open wireless) or partially trusted connections (ISPs injecting content). >You lost touch with the quantity of knowledge you accumulated over the years. Therefore we must lobby that our skill set is protected by law and that protocols and best practices are not allowed to change! Uh? Sorry man, you are going to have to evolve as the internet changes. Well, you don't have to, but when all your devices are encrypted and asking for a few bit coins to unlock, you will have been warned that it was going to happen.
- sametmax 10y ago
  > There is an easy answer to that. > DON'T Easy to say when your business is no tied to advertisers on which you have zero leverage. > Therefore we must lobby that our skill set is protected by law and that protocols and best practices are not allowed to change! Making TLS optional on HTTP2 would have not taken anything from you. You are just here in your ivory tower looking down on people that are clearly not as pure as your are. Well sorry, but down there, among the humans, you have PHP dev that are using EasyPHP, people that don't know the command line, people using mixed content and have no control over it, people that can't spend hours to continuously learn new things every week, people that don't have private servers and so on. And you know what ? I'm not even among them. I run my service on private servers with https. I use docker, letsencrypt and react or whatever is useful to me. But giving trainings and having friends running side business, I know that it's not the only reality in IT. So basically, right now, HTTP2 is just built to be hard for a huge part of the dev population, with no good reasons.