3 ms·

One potentially good reason to not force SSL: https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites-made-them-less-accessible/ https://meyerweb.com/eric

One potentially good reason to not force SSL: https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites-made-them-less-accessible/ https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites... TL;DR: Secure websites can make the web less accessible for those who rely on metered satellite internet (and I'm sure plenty of other cases).

satanspastaroll 7y ago
Trading security for convenience is rarely a good idea. The rest of the world should not conform the to failures of certain areas to provide internet.
- oneeyedpigeon 7y ago
  No, but it's a good idea to have the option, so long as people are aware of the implications.
- rkagerer 7y ago
  Unfortunately convenience usually does tradeoff against security. Thoughtful UX can deliver both, but it's rare to find in practice. That casual dismissal of davidmurdoch's counterargument comes across tone-deaf to people stuck on crappy connections.
- davidmurdoch 7y ago
  I see your point. But we trade security for convenience 24/7/365. We could all have bulletproof glass in our homes, personal security cameras everywhere, backup generators, panic rooms, etc, but we don't, because it's not convenient (and I know the expense is primarily what makes it not convenient, but I think it's still a valid argument). Providing access to Wikipedia over http to people in third world countries may be worth the risk of someone MITMing the site with propaganda. The suggestion is only to give some users the option.
  - pixl97 7y ago
    Mitm with propaganda is the least of the worries. Full on exploit code is. The fact is as an ecosystem develops completely increases. Lifeforms in that ecosystem have to spend more time and effort protecting themselves from outside attacks as time progresses.
Ajedi32 7y ago
The caching problem can be fixed through other means. Signed HTTP Exchanges[0] seem like a promising solution. [0]: https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html https://wicg.github.io/webpackage/draft-yasskin-http-origin-...
leonlag 7y ago
TLS 1.3 with 1-RTT should improve this situation at least somewhat. I suspect HTTP3 will help in high packet loss situations but it's going to be a while until that's deployed. Also wikipedia is still perfectly reachable via http if you disable the HSTS preloading in your browser
anchpop 7y ago
I'm not an expert, but would this be fixable by installing a new root certificate on the computers who want to use the caching server, and then having the caching server sign the pages it transmits using the new root certificate?

satanspastaroll 7y ago

Trading security for convenience is rarely a good idea. The rest of the world should not conform the to failures of certain areas to provide internet.

oneeyedpigeon 7y ago
No, but it's a good idea to have the option, so long as people are aware of the implications.
rkagerer 7y ago
Unfortunately convenience usually does tradeoff against security. Thoughtful UX can deliver both, but it's rare to find in practice. That casual dismissal of davidmurdoch's counterargument comes across tone-deaf to people stuck on crappy connections.
davidmurdoch 7y ago
I see your point. But we trade security for convenience 24/7/365. We could all have bulletproof glass in our homes, personal security cameras everywhere, backup generators, panic rooms, etc, but we don't, because it's not convenient (and I know the expense is primarily what makes it not convenient, but I think it's still a valid argument). Providing access to Wikipedia over http to people in third world countries may be worth the risk of someone MITMing the site with propaganda. The suggestion is only to give some users the option.
- pixl97 7y ago
  Mitm with propaganda is the least of the worries. Full on exploit code is. The fact is as an ecosystem develops completely increases. Lifeforms in that ecosystem have to spend more time and effort protecting themselves from outside attacks as time progresses.

Ajedi32 7y ago

The caching problem can be fixed through other means. Signed HTTP Exchanges[0] seem like a promising solution. [0]: https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html https://wicg.github.io/webpackage/draft-yasskin-http-origin-...

leonlag 7y ago

TLS 1.3 with 1-RTT should improve this situation at least somewhat. I suspect HTTP3 will help in high packet loss situations but it's going to be a while until that's deployed. Also wikipedia is still perfectly reachable via http if you disable the HSTS preloading in your browser

anchpop 7y ago

I'm not an expert, but would this be fixable by installing a new root certificate on the computers who want to use the caching server, and then having the caching server sign the pages it transmits using the new root certificate?