6 ms·

But HTTPS did. You just had to pay to get a certificate.

doublerabbit 7y ago
You had to pay a fair bit of money back then for SSL. And why does a static html site need https? I’m all for encryption but we just HTTPS things pointlessly. Why can’t I use my own self-signed certificate, it’s the same thing.
- joeraut 7y ago
  HTTPS everywhere has other advantages, such as preventing ISPs from injecting scripts or content into HTTP pages. [0] [0] https://news.ycombinator.com/item?id=21389657 https://news.ycombinator.com/item?id=21389657
- metafunctor 7y ago
  Because without HTTPS, the content can be modified in transit. Some free Wi-Fi access points and evil ISPs, for example, will inject ads and trackers.
- msh 7y ago
  There is a good explanation of why your static site need ssl here: https://youtu.be/_BNIkw4Ao9w https://youtu.be/_BNIkw4Ao9w
- MaxBarraclough 7y ago
  HTTPS should be used even for static sites. 1. Privacy matters. A medical website, or indeed Wikipedia, should prevent a snooping ISP from finding out you have been reading about an embarrassing condition. This is similar to the way librarians are extremely protective of their loan records [0]. Netflix use HTTPS for their streams, for the same reason (it does nothing to aid their DRM, it's purely about privacy) [1]. 2. As someone here already mentioned, it prevents ads/trackers/malware being injected into the page by unscrupulous ISPs (this really has happened [2]) 3. Modern browsers will (rightly) warn users not to trust the site. This makes the site look bad. 4. Some fancy browser features are disabled if you use unencrypted HTTP. Likely irrelevant for a static site though. 5. Let's turn the tables and ask why you wouldn't use HTTPS for a public-facing web server. There are just two reasons: firstly, reduced admin overhead not having to bother with certs, and secondly, it enables caching web proxies, which is only relevant if you're running a serious distribution platform like Steam, or a Linux package-management repo [3] > Why can’t I use my own self-signed certificate, it’s the same thing. It is not. I don't think you understand the role of CAs. Self-signed certs do not provide protection against connecting to an impersonator. [0] https://www.theguardian.com/us-news/2016/jan/13/us-library-records-purged-data-privacy https://www.theguardian.com/us-news/2016/jan/13/us-library-r... [1] https://arstechnica.com/information-technology/2015/04/it-wasnt-easy-but-netflix-will-soon-use-https-to-secure-video-streams/ https://arstechnica.com/information-technology/2015/04/it-wa... [2] https://doesmysiteneedhttps.com/ https://doesmysiteneedhttps.com/ [3] https://whydoesaptnotusehttps.com/ https://whydoesaptnotusehttps.com/
  - doublerabbit 7y ago
    I’ll agree to disagree, because otherwise the conversation would be moot. I just disagree that we should “HTTPS” everything and that’s partly because of the overhead. A medical site is different to a static html site like listed in the post. ISP regardless of SSL know which sites I’m visiting. It’s there in the HTTP host header regardless of SSL or not. And transit security can easily be encrypted without SSL but people are too lazy to encrypt their content within the application. “run acme encryptbot” no thanks. When I want a pure server with nothing other than my application I don’t want to download a certificate bot, install (lang) and let it mess with my configuration. I don’t dismiss that HTTPS is important but I feel platform is flawed. Owned by corporate greed. It’s security based upon pay us money or else model.
    - MaxBarraclough 7y ago
      > the overhead The computational overhead is negligible. This simply isn't a credible argument against HTTPS. Netflix send petabytes of data over HTTPS. There's no excuse for anyone else. > A medical site is different to a static html site like listed in the post. Different in degree, but not in category. Your browsing habits on ordinary non-sensitive sites can still be used to profile you. > ISP regardless of SSL know which sites I’m visiting They can still look at the destination IP, yes, and they can probably look at your DNS requests, as secure DNS is currently only rarely used. It's still worth doing. Knowing that someone went on Wikipedia tells you almost nothing. Knowing the specific pages they went to, tells you a great deal. > It’s there in the HTTP host header regardless of SSL or not. That's not the case. HTTPS encrypts all headers. > transit security can easily be encrypted without SSL The easy solution is HTTPS. > people are too lazy to encrypt their content within the application. A universal principle in cyber-security: rolling your own crypto scheme is generally a terrible idea. As I said, Steam and Apt are the exceptions; they use plain HTTP for delivery, and implement secure file verification using hashes. Even here, with competent people running a simple delivery scheme, there can be serious security issues [0]. When it comes to web applications, you cannot implement your own secure delivery, for the obvious reason: an attacker can just replace your code. Sites like LastPass.com still have to use HTTPS to deliver the web app. Even if it could be done, there would be no reason to. The browser offers you HTTPS, so you get a carefully designed, battle-tested protocol, and a carefully designed, battle-tested implementation. You are entirely shielded from all the complexities. You aren't going to do better in JavaScript. > When I want a pure server with nothing other than my application I don’t want to download a certificate bot, install (lang) and let it mess with my configuration. It's additional configuration work, yes, but I don't accept that it's much of an argument against HTTPs. You still have totally free choice over your tooling and languages. > I don’t dismiss that HTTPS is important but I feel platform is flawed. You've not presented a single good argument against the technical merits of HTTPS. > Owned by corporate greed. It’s security based upon pay us money or else model. You can get certs for free. This isn't new. [1] [0] https://justi.cz/security/2019/01/22/apt-rce.html https://justi.cz/security/2019/01/22/apt-rce.html [1] https://en.wikipedia.org/wiki/Let%27s_Encrypt https://en.wikipedia.org/wiki/Let%27s_Encrypt
- micheljansen 7y ago
  You could get one for under $10/y which is not what I’d call a fair bit of money. I think the problem with HTTPS/SSL was that it tried to solve two problems at once (trust and encryption) without a practical way to separate them. You can argue that’s justified (what’s the point knowing the connection is encrypted if you don’t know who is on the other side), but those panicky browser alerts made self signed SSL certificates all but useless. That’s why we need letsencrypt now.
thefounder 7y ago
Even with let's encrypt it still seems odd to me that you need a 3rd party to confirm you own a domain name(and issue a certificate for it). The web trust model is broken.

You had to pay a fair bit of money back then for SSL. And why does a static html site need https? I’m all for encryption but we just HTTPS things pointlessly. Why can’t I use my own self-signed certificate, it’s the same thing.

joeraut 7y ago
HTTPS everywhere has other advantages, such as preventing ISPs from injecting scripts or content into HTTP pages. [0] [0] https://news.ycombinator.com/item?id=21389657 https://news.ycombinator.com/item?id=21389657
metafunctor 7y ago
Because without HTTPS, the content can be modified in transit. Some free Wi-Fi access points and evil ISPs, for example, will inject ads and trackers.
msh 7y ago
There is a good explanation of why your static site need ssl here: https://youtu.be/_BNIkw4Ao9w https://youtu.be/_BNIkw4Ao9w
MaxBarraclough 7y ago
HTTPS should be used even for static sites. 1. Privacy matters. A medical website, or indeed Wikipedia, should prevent a snooping ISP from finding out you have been reading about an embarrassing condition. This is similar to the way librarians are extremely protective of their loan records [0]. Netflix use HTTPS for their streams, for the same reason (it does nothing to aid their DRM, it's purely about privacy) [1]. 2. As someone here already mentioned, it prevents ads/trackers/malware being injected into the page by unscrupulous ISPs (this really has happened [2]) 3. Modern browsers will (rightly) warn users not to trust the site. This makes the site look bad. 4. Some fancy browser features are disabled if you use unencrypted HTTP. Likely irrelevant for a static site though. 5. Let's turn the tables and ask why you wouldn't use HTTPS for a public-facing web server. There are just two reasons: firstly, reduced admin overhead not having to bother with certs, and secondly, it enables caching web proxies, which is only relevant if you're running a serious distribution platform like Steam, or a Linux package-management repo [3] > Why can’t I use my own self-signed certificate, it’s the same thing. It is not. I don't think you understand the role of CAs. Self-signed certs do not provide protection against connecting to an impersonator. [0] https://www.theguardian.com/us-news/2016/jan/13/us-library-records-purged-data-privacy https://www.theguardian.com/us-news/2016/jan/13/us-library-r... [1] https://arstechnica.com/information-technology/2015/04/it-wasnt-easy-but-netflix-will-soon-use-https-to-secure-video-streams/ https://arstechnica.com/information-technology/2015/04/it-wa... [2] https://doesmysiteneedhttps.com/ https://doesmysiteneedhttps.com/ [3] https://whydoesaptnotusehttps.com/ https://whydoesaptnotusehttps.com/
- doublerabbit 7y ago
  I’ll agree to disagree, because otherwise the conversation would be moot. I just disagree that we should “HTTPS” everything and that’s partly because of the overhead. A medical site is different to a static html site like listed in the post. ISP regardless of SSL know which sites I’m visiting. It’s there in the HTTP host header regardless of SSL or not. And transit security can easily be encrypted without SSL but people are too lazy to encrypt their content within the application. “run acme encryptbot” no thanks. When I want a pure server with nothing other than my application I don’t want to download a certificate bot, install (lang) and let it mess with my configuration. I don’t dismiss that HTTPS is important but I feel platform is flawed. Owned by corporate greed. It’s security based upon pay us money or else model.
  - MaxBarraclough 7y ago
    > the overhead The computational overhead is negligible. This simply isn't a credible argument against HTTPS. Netflix send petabytes of data over HTTPS. There's no excuse for anyone else. > A medical site is different to a static html site like listed in the post. Different in degree, but not in category. Your browsing habits on ordinary non-sensitive sites can still be used to profile you. > ISP regardless of SSL know which sites I’m visiting They can still look at the destination IP, yes, and they can probably look at your DNS requests, as secure DNS is currently only rarely used. It's still worth doing. Knowing that someone went on Wikipedia tells you almost nothing. Knowing the specific pages they went to, tells you a great deal. > It’s there in the HTTP host header regardless of SSL or not. That's not the case. HTTPS encrypts all headers. > transit security can easily be encrypted without SSL The easy solution is HTTPS. > people are too lazy to encrypt their content within the application. A universal principle in cyber-security: rolling your own crypto scheme is generally a terrible idea. As I said, Steam and Apt are the exceptions; they use plain HTTP for delivery, and implement secure file verification using hashes. Even here, with competent people running a simple delivery scheme, there can be serious security issues [0]. When it comes to web applications, you cannot implement your own secure delivery, for the obvious reason: an attacker can just replace your code. Sites like LastPass.com still have to use HTTPS to deliver the web app. Even if it could be done, there would be no reason to. The browser offers you HTTPS, so you get a carefully designed, battle-tested protocol, and a carefully designed, battle-tested implementation. You are entirely shielded from all the complexities. You aren't going to do better in JavaScript. > When I want a pure server with nothing other than my application I don’t want to download a certificate bot, install (lang) and let it mess with my configuration. It's additional configuration work, yes, but I don't accept that it's much of an argument against HTTPs. You still have totally free choice over your tooling and languages. > I don’t dismiss that HTTPS is important but I feel platform is flawed. You've not presented a single good argument against the technical merits of HTTPS. > Owned by corporate greed. It’s security based upon pay us money or else model. You can get certs for free. This isn't new. [1] [0] https://justi.cz/security/2019/01/22/apt-rce.html https://justi.cz/security/2019/01/22/apt-rce.html [1] https://en.wikipedia.org/wiki/Let%27s_Encrypt https://en.wikipedia.org/wiki/Let%27s_Encrypt
micheljansen 7y ago
You could get one for under $10/y which is not what I’d call a fair bit of money. I think the problem with HTTPS/SSL was that it tried to solve two problems at once (trust and encryption) without a practical way to separate them. You can argue that’s justified (what’s the point knowing the connection is encrypted if you don’t know who is on the other side), but those panicky browser alerts made self signed SSL certificates all but useless. That’s why we need letsencrypt now.

thefounder 7y ago

Even with let's encrypt it still seems odd to me that you need a 3rd party to confirm you own a domain name(and issue a certificate for it). The web trust model is broken.