5 ms·

My favorite part of the internet were always the small hobyist websites. The guy that has an encyclopedic database about Grateful Dead trivia, the other guy tha

My favorite part of the internet were always the small hobyist websites. The guy that has an encyclopedic database about Grateful Dead trivia, the other guy that collects pictures of plants. Those people are independent, they're not technical and their 90s looking websites are going to go under because of blanket security policies that don't concern them.

greglindahl 9y ago
You do realize you're making this complaint on a discussion about a tool that makes HTTPS easier for said small hobbyist websites? I've updated all of my hobby sites using Let's Encrypt, and I really appreciate how it was easy for me while also being good for my users.
- rospaya 9y ago
  My comment isn't against Let's Encrypt. It's against blacklisting text only sites that don't need HTTPS.
  - jenscow 9y ago
    Nobody is blacklisting them. The visitors are just being informed of the risks. The warning used to be the absence of a pad-lock, but who notices that?
  - niij 9y ago
    If a "text-only" website is on HTTP it can be MITM'ed and used to serve up malicious JS.
__jal 9y ago
If not SSL, then they'd go away at the point some other technical change dropped. Or do you suggest "we" continue using broken protocols forever in order to preserve them? Do you still support telnet to accommodate people who can't handle `ssh-keygen`? In any case, (a small subset of) the random enthusiast sites and such are close to the only reason I use a browser recreationally anymore. I absolutely agree with you. The answer isn't to stop fixing things. The answer is to make it easier and cheaper to be secure. Kinda like what LE is doing, no?
- rospaya 9y ago
  My point is that those sites don't need to be any more secure than they are. A hobbyist website written in HTML in Notepad with only text and images that can be run on IE 5.0 might not require HTTPS and Google and others might change that.
  - jakelazaroff 9y ago
    I don't get the notion that some sites don't "need" HTTPS. The threat model it protects against isn't only sensitive information being intercepted, it's also man-in-the-middle attacks that actually change what's delivered. Maybe a hobbyist website only has text and images sitting on its server, but the visitor might receive malware — and that can happen to literally any site served over HTTP.
    - josteink 9y ago
      > I don't get the notion that some sites don't "need" HTTPS. Your failure to grasp this is fairly evident from the rest of your comment.
      - slrz 9y ago
        Plaintext HTTP being fine for delivering public documents might have been true 10 or 20 years ago. Sadly, attacks on and uninvited mutation/corruption of plaintext content has become that super-common (at least in some parts of the world) that you can be almost certain that one or more of your users will be affected by it if you're not taking precautions. It sucks badly. I'd prefer a less hostile network myself. Even back then there were bad actors but at least you could somewhat count on well-meaning network operators and ISPs. Nowadays it's ISPs themselves that forge DNS replies and willfully corrupt your plaintext traffic to inject garbage ads and tracking crap into it. And whole nation states that do the same but for censoring instead of ad delivery.
      - deleted 9y ago
        [deleted]
dalore 9y ago
Yeah and what do those hobbyists do? They go to a blogging service provider or something like a wiki provider and they put their stuff. That stuff still happens today. And of course those users wouldn't want someone else coming along and tampering with their collection, so https everywhere is a must. And these users won't even know or care.
staticassertion 9y ago
Now we have wordpress, medium, etc. It's never been easier to have a personal blog over HTTPS.

greglindahl 9y ago

You do realize you're making this complaint on a discussion about a tool that makes HTTPS easier for said small hobbyist websites? I've updated all of my hobby sites using Let's Encrypt, and I really appreciate how it was easy for me while also being good for my users.

rospaya 9y ago
My comment isn't against Let's Encrypt. It's against blacklisting text only sites that don't need HTTPS.
- jenscow 9y ago
  Nobody is blacklisting them. The visitors are just being informed of the risks. The warning used to be the absence of a pad-lock, but who notices that?
- niij 9y ago
  If a "text-only" website is on HTTP it can be MITM'ed and used to serve up malicious JS.

__jal 9y ago

If not SSL, then they'd go away at the point some other technical change dropped. Or do you suggest "we" continue using broken protocols forever in order to preserve them? Do you still support telnet to accommodate people who can't handle `ssh-keygen`? In any case, (a small subset of) the random enthusiast sites and such are close to the only reason I use a browser recreationally anymore. I absolutely agree with you. The answer isn't to stop fixing things. The answer is to make it easier and cheaper to be secure. Kinda like what LE is doing, no?

rospaya 9y ago
My point is that those sites don't need to be any more secure than they are. A hobbyist website written in HTML in Notepad with only text and images that can be run on IE 5.0 might not require HTTPS and Google and others might change that.
- jakelazaroff 9y ago
  I don't get the notion that some sites don't "need" HTTPS. The threat model it protects against isn't only sensitive information being intercepted, it's also man-in-the-middle attacks that actually change what's delivered. Maybe a hobbyist website only has text and images sitting on its server, but the visitor might receive malware — and that can happen to literally any site served over HTTP.
  - josteink 9y ago
    > I don't get the notion that some sites don't "need" HTTPS. Your failure to grasp this is fairly evident from the rest of your comment.
    - slrz 9y ago
      Plaintext HTTP being fine for delivering public documents might have been true 10 or 20 years ago. Sadly, attacks on and uninvited mutation/corruption of plaintext content has become that super-common (at least in some parts of the world) that you can be almost certain that one or more of your users will be affected by it if you're not taking precautions. It sucks badly. I'd prefer a less hostile network myself. Even back then there were bad actors but at least you could somewhat count on well-meaning network operators and ISPs. Nowadays it's ISPs themselves that forge DNS replies and willfully corrupt your plaintext traffic to inject garbage ads and tracking crap into it. And whole nation states that do the same but for censoring instead of ad delivery.
    - deleted 9y ago
      [deleted]

dalore 9y ago

Yeah and what do those hobbyists do? They go to a blogging service provider or something like a wiki provider and they put their stuff. That stuff still happens today. And of course those users wouldn't want someone else coming along and tampering with their collection, so https everywhere is a must. And these users won't even know or care.

staticassertion 9y ago

Now we have wordpress, medium, etc. It's never been easier to have a personal blog over HTTPS.