5 ms·

Ironically his blog isn't available on https. Would be time that browers mark http sites' address bar as "Not secure" in orange. It's either secure or it isn't

Ironically his blog isn't available on https. Would be time that browers mark http sites' address bar as "Not secure" in orange. It's either secure or it isn't. Fun fact; Europe's ePrivacy law is coming next year which enforces all communication to be secure.

sigzero 9y ago
Which they cannot enforce on the web except by blocking (aka censoring the web).
- photonios 9y ago
  They could fine you.
  - kcolford 9y ago
    Only if you are (or will be) incorporated in the EU, which generally you should be in order to accept payments from and do business in the EU.
  - kerkeslager 9y ago
    I live in the US, operate in the US, and if I ever go to the EU, I am quite confident that the system won't move quickly enough to notice I'm in the EU and collect fines during a tourist stay. So no, they couldn't fine me. If they did fine me, there would be zero repercussions for simply ignoring the fine. I am not saying I plan to break this law: I'm a big supporter of encrypting everything and I was in compliance with this law before this law existed. I think that this law is a big positive step for privacy in the EU. I am saying that the claims that this EU law will have massive international effects are overblown. There are five other continents with major businesses and only the businesses which operate in the EU have any reason to care about EU laws which are enforceable only in the EU. EDIT: I accidentally a continent.
- _jal 9y ago
  Right, because the only way we can control speeding is by barricading roads.
slim 9y ago
Security depends on your threat model. HTTP is generally secure for publishing and has the added advantage of being cacheable by proxies. This blog is secure
- Sir_Cmpwn 9y ago
  It can be MITM'd and used as a vector for malware.
- sphix0r 9y ago
  TLS = encryption TLS = authentication TLS = tamper proof
  - dredmorbius 9y ago
    Largely, yes, modulo CA integrity and APT attacks.
- cratermoon 9y ago
  There is a lot more to the threat model than "will my content be stolen or compromised?"
- inetknght 9y ago
  > HTTP is generally secure This statement is wholly incorrect. HTTP is not generally secure. > for publishing When I publish something I do not intend for third parties to interfere with the delivery of what I publish. > and has the added advantage of being cacheable by proxies If you trust your proxy, you can still have cached data at your proxy. If you don't trust your proxy, then why are you proxying through it?
  - dredmorbius 9y ago
    HTTP plus a trusted hash would provide an integrity measure of the content of a page, and enable hashing. It would not prevent anyone from examining that content in flight, or altering it. It would allow any such alteration to be identified. It is possible to offer various levels of assurance on unencrypted communications. Mind: I'm describing a possible world, not the one most of us happen to live in. Unless, say, you're retrieving Debian package repositories over FTP or HTTP transport, and rely on the package signature rather than HTTPS for integrity. See for example: https://unix.stackexchange.com/q/90227 https://unix.stackexchange.com/q/90227
pjc50 9y ago
> Europe's ePrivacy law is coming next year which enforces all communication to be secure. Link to Directive please? (The reason I ask is that news reporting on EU law in English is extremely unreliable, and it's best to go to primary sources)
- d0lph 9y ago
  Even local reporting on new laws is not great, somewhat recently was Feinstein's gun law, not a fan of it, but there was so much misinformation flying around, making it seem much worse than it was. Which in turn detracted from legitimate criticism.
- sphix0r 9y ago
  > Link to Directive please? I-scoop[0] explains it well. Do some digging in the documents[1] and you'll get the idea where it's heading to. "Respect for the privacy of one’s communications is an essential dimension of this right, applying both to natural and legal persons. Confidentiality of electronic communications ensures that information exchanged between parties and the external elements of such communication, including when the information has been sent, from where, to whom, is not to be revealed to anyone other than to the parties involved in a communication. The principle of confidentiality should apply to current and future means of communication, including calls, internet access, instant messaging applications, e-mail, internet phone calls and personal messaging provided through social media." [1](page 6, article 7) > (The reason I ask is that news reporting on EU law in English is extremely unreliable, and it's best to go to primary sources) Completely agreed, it's a complete jungle of information and the source documents are hard to digest. [0] https://www.i-scoop.eu/gdpr/eu-eprivacy-regulation/#The_consolidated_version_of_the_European_Council_and_further_ePrivacy_Regulation_topics_to_analyze https://www.i-scoop.eu/gdpr/eu-eprivacy-regulation/#The_cons... [1] http://data.consilium.europa.eu/doc/document/ST-15333-2017-INIT/en/pdf http://data.consilium.europa.eu/doc/document/ST-15333-2017-I...
nemoniac 9y ago
Europe's GDPR data law contains no such stipulation.
- sphix0r 9y ago
  I'm referring to the communication (ePrivacy) not data / consent (GDPR).
  - nemoniac 9y ago
    That requirement applies to over-the-top communications providers, not to communication in general.

sigzero 9y ago

Which they cannot enforce on the web except by blocking (aka censoring the web).

photonios 9y ago
They could fine you.
- kcolford 9y ago
  Only if you are (or will be) incorporated in the EU, which generally you should be in order to accept payments from and do business in the EU.
- kerkeslager 9y ago
  I live in the US, operate in the US, and if I ever go to the EU, I am quite confident that the system won't move quickly enough to notice I'm in the EU and collect fines during a tourist stay. So no, they couldn't fine me. If they did fine me, there would be zero repercussions for simply ignoring the fine. I am not saying I plan to break this law: I'm a big supporter of encrypting everything and I was in compliance with this law before this law existed. I think that this law is a big positive step for privacy in the EU. I am saying that the claims that this EU law will have massive international effects are overblown. There are five other continents with major businesses and only the businesses which operate in the EU have any reason to care about EU laws which are enforceable only in the EU. EDIT: I accidentally a continent.
_jal 9y ago
Right, because the only way we can control speeding is by barricading roads.

slim 9y ago

Security depends on your threat model. HTTP is generally secure for publishing and has the added advantage of being cacheable by proxies. This blog is secure

Sir_Cmpwn 9y ago
It can be MITM'd and used as a vector for malware.
sphix0r 9y ago
TLS = encryption TLS = authentication TLS = tamper proof
- dredmorbius 9y ago
  Largely, yes, modulo CA integrity and APT attacks.
cratermoon 9y ago
There is a lot more to the threat model than "will my content be stolen or compromised?"
inetknght 9y ago
> HTTP is generally secure This statement is wholly incorrect. HTTP is not generally secure. > for publishing When I publish something I do not intend for third parties to interfere with the delivery of what I publish. > and has the added advantage of being cacheable by proxies If you trust your proxy, you can still have cached data at your proxy. If you don't trust your proxy, then why are you proxying through it?
- dredmorbius 9y ago
  HTTP plus a trusted hash would provide an integrity measure of the content of a page, and enable hashing. It would not prevent anyone from examining that content in flight, or altering it. It would allow any such alteration to be identified. It is possible to offer various levels of assurance on unencrypted communications. Mind: I'm describing a possible world, not the one most of us happen to live in. Unless, say, you're retrieving Debian package repositories over FTP or HTTP transport, and rely on the package signature rather than HTTPS for integrity. See for example: https://unix.stackexchange.com/q/90227 https://unix.stackexchange.com/q/90227

pjc50 9y ago

> Europe's ePrivacy law is coming next year which enforces all communication to be secure. Link to Directive please? (The reason I ask is that news reporting on EU law in English is extremely unreliable, and it's best to go to primary sources)

d0lph 9y ago
Even local reporting on new laws is not great, somewhat recently was Feinstein's gun law, not a fan of it, but there was so much misinformation flying around, making it seem much worse than it was. Which in turn detracted from legitimate criticism.
sphix0r 9y ago
> Link to Directive please? I-scoop[0] explains it well. Do some digging in the documents[1] and you'll get the idea where it's heading to. "Respect for the privacy of one’s communications is an essential dimension of this right, applying both to natural and legal persons. Confidentiality of electronic communications ensures that information exchanged between parties and the external elements of such communication, including when the information has been sent, from where, to whom, is not to be revealed to anyone other than to the parties involved in a communication. The principle of confidentiality should apply to current and future means of communication, including calls, internet access, instant messaging applications, e-mail, internet phone calls and personal messaging provided through social media." [1](page 6, article 7) > (The reason I ask is that news reporting on EU law in English is extremely unreliable, and it's best to go to primary sources) Completely agreed, it's a complete jungle of information and the source documents are hard to digest. [0] https://www.i-scoop.eu/gdpr/eu-eprivacy-regulation/#The_consolidated_version_of_the_European_Council_and_further_ePrivacy_Regulation_topics_to_analyze https://www.i-scoop.eu/gdpr/eu-eprivacy-regulation/#The_cons... [1] http://data.consilium.europa.eu/doc/document/ST-15333-2017-INIT/en/pdf http://data.consilium.europa.eu/doc/document/ST-15333-2017-I...

nemoniac 9y ago

Europe's GDPR data law contains no such stipulation.

sphix0r 9y ago
I'm referring to the communication (ePrivacy) not data / consent (GDPR).
- nemoniac 9y ago
  That requirement applies to over-the-top communications providers, not to communication in general.