5 ms·

The existence of vulnerabilities doesn’t negate the bullshit security theatre of certificate authorities. Banning http is a great example of tossing the baby w

The existence of vulnerabilities doesn’t negate the bullshit security theatre of certificate authorities. Banning http is a great example of tossing the baby with the bathwater. Https is better, but there are still valuable use cases for unencrypted web traffic. I am sorry this bugs you, but please note that your straw man is not the argument I’d make. Sometimes you need a low hassle web server. Renewing let’s encrypt certs is not low hassle.

Cyphase 9y ago
> The existence of vulnerabilities doesn’t negate the bullshit security theatre of certificate authorities. I agree that the current CA system has flaws, but there are efforts such as Certificate Transparency[1] and DANE[2] attempting to improve or bypass the CA system. That said, just having encryption defeats passive eavesdropping, and even the current CA system of authentication raises the bar for active eavesdropping. > Banning http is a great example of tossing the baby with the bathwater. I'm not sure what you mean by that. > Https is better, but there are still valuable use cases for unencrypted web traffic. Like what? [1] https://en.wikipedia.org/wiki/Certificate_Transparency https://en.wikipedia.org/wiki/Certificate_Transparency [2] https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...
- dozzie 9y ago
  >> Https is better, but there are still valuable use cases for unencrypted web traffic. > Like what? Things like this: https://utcc.utoronto.ca/~cks/space/blog/tech/BIOSViaHTTPSensible https://utcc.utoronto.ca/~cks/space/blog/tech/BIOSViaHTTPSen...
  - Cyphase 9y ago
    Let's take it as given that HTTP is the right answer in that situation; I'm not saying it is or isn't, but let's assume it is. We're talking about HTTP(S) in web browsers and client-side applications; no one is actually talking about _banning_ HTTP, e.g. blocking port 80 or filtering via deep packet inspection. If you have a use case where after careful thought you decide that HTTP is better than HTTPS, then fine. But HTTPS should be the default.
    - droopybuns 9y ago
      The functional result for the chrome browser’s ui warnings will be almost indistinguishable from banning http.
      - Cyphase 9y ago
        For web sites and web browsers, sure. But if you want to use HTTP for your BIOS updates (dozzie's example), then go ahead; I don't think anyone is seriously proposing to stop you. Just please make sure that it's done securely. Anyway, TLS is not enough for secure updates.

Cyphase 9y ago

> The existence of vulnerabilities doesn’t negate the bullshit security theatre of certificate authorities. I agree that the current CA system has flaws, but there are efforts such as Certificate Transparency[1] and DANE[2] attempting to improve or bypass the CA system. That said, just having encryption defeats passive eavesdropping, and even the current CA system of authentication raises the bar for active eavesdropping. > Banning http is a great example of tossing the baby with the bathwater. I'm not sure what you mean by that. > Https is better, but there are still valuable use cases for unencrypted web traffic. Like what? [1] https://en.wikipedia.org/wiki/Certificate_Transparency https://en.wikipedia.org/wiki/Certificate_Transparency [2] https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...

dozzie 9y ago
>> Https is better, but there are still valuable use cases for unencrypted web traffic. > Like what? Things like this: https://utcc.utoronto.ca/~cks/space/blog/tech/BIOSViaHTTPSensible https://utcc.utoronto.ca/~cks/space/blog/tech/BIOSViaHTTPSen...
- Cyphase 9y ago
  Let's take it as given that HTTP is the right answer in that situation; I'm not saying it is or isn't, but let's assume it is. We're talking about HTTP(S) in web browsers and client-side applications; no one is actually talking about _banning_ HTTP, e.g. blocking port 80 or filtering via deep packet inspection. If you have a use case where after careful thought you decide that HTTP is better than HTTPS, then fine. But HTTPS should be the default.
  - droopybuns 9y ago
    The functional result for the chrome browser’s ui warnings will be almost indistinguishable from banning http.
    - Cyphase 9y ago
      For web sites and web browsers, sure. But if you want to use HTTP for your BIOS updates (dozzie's example), then go ahead; I don't think anyone is seriously proposing to stop you. Just please make sure that it's done securely. Anyway, TLS is not enough for secure updates.