10 ms·

It takes 10 minutes to put an old HTTP server behind a reverse proxied nginx instance with auto-renewing letsencrypt certs (you can even reverse proxy old HTTPS

• austinheap 6y ago
  I believe the author is suggesting the royal ‘we’ drew the separation of concerns line inappropriately. Is there a better way? I r not cryptographer.
• chasil 6y ago
  It is also possible to use stunnel to do this, and the configuration to do so is really quite simple. It can be run both as a standing daemon or launched on-demand as an inetd service. The thttpd web server can run modern TLS with this approach, and the footprint is much lighter than with Apache.
• rcthompson 6y ago
  Yeah, HTTPS is the response to the problem. The problem is that the internet is nowhere near as "safe" as it was a few decades ago. (Or at least, the unsafe-ness is now better known.) It's a bit like complaining that you can no longer take your origami collection outside without an umbrella. Well, the umbrella isn't the problem, the rain is. The umbrella is a solution. But of course being under an umbrella isn't the same as being outside on a sunny day. So sure, lament the change in the weather; lament the inconvenience of carrying an umbrella around all the time; but don't blame the umbrella for the rain.
  • signal11 6y ago
    > The problem is that the internet is nowhere near as "safe" as it was a few decades ago. It wasn't very safe a few decades ago either. In 2000, I had naively set up a Linux box under my desk with a public IP, thinking maybe I could host a blog on it. It got a number of portscans within minutes of being set up, and subsequent monitoring showed lots of intrusion attempts. Luckily the box was patched, but I was essentially one zero-day away from being 0wn3d. But I did learn a lot before moving the box behind a firewall. I guess that back in the day, some people could wish these away as unproven threats well into the early 2000s until malware like Nimda / Code Red well and truly destroyed that illusion.
• WoahNoun 6y ago
  If your two servers communicate over the public internet rather than a private network, all you've done is made your users believe they are behind a secure connection when they really aren't. For example, if your "old" server is a colocated physical server and your proxy server is a fancy cloud VM.
  • swiley 6y ago
    This is why the content should have been signed. IMO: https is actually overhyped, it solves some problems but has plenty of its own
  • Jonnax 6y ago
    How old is the server for this scenario? If it can't run a modern web server as a proxy directly. Then maybe you could set up a VPN tunnel between the server and your fancy cloud VM. But running some ancient hardware not for historical reasons but taking user data, is wrong.
    • adrianmonk 6y ago
      Or the hosting provider could offer a turnkey solution. They could use something like VLAN to isolate that physical server on its own network, put the VLAN behind a firewall, and have an HTTPS reverse proxy that goes through that firewall. Depending on how their network is built, it might even be possible to make this self-service where you enable a setting in your account and your physical server gets wrapped in this additional layer.
  • danShumway 6y ago
    > all you've done Eh. I sort of disagree with this specific phrasing. People shouldn't focus only on targeted attacks on the server. Of course if you have an HTTPS proxy in front of an HTTP server, you can be MITMed between those two servers, and that's very bad. But even with that flaw you're getting benefits. Public networks can't inject malware/ads into that webpage, a MITM attacker between your proxy and the main server will have a harder time correlating a request with a specific person, ISPs will have a harder time scanning the traffic for use with ads/metadata. This is a similar argument that comes up sometimes about VPNs. I know people who argue that a VPN does nothing because it just moves trust from one party to another. But the reality is that if you search my public IP address, you will get a pretty decent approximation of where I live. In a world without a VPN, I'm not just choosing whether or not I trust my ISP, I'm choosing whether I'm comfortable giving a decent marker of my physical location to literally every single website that I visit. That doesn't mean the "moving trust" concern isn't valid, it just means it's not the full picture of what a VPN (either privately hosted or through a 3rd-party) protects you from. In the same way, it is a valid concern that behind the scenes data might not be encrypted between a proxy and a server. But that's not the full picture of what HTTPS protects you from. HTTPS also protects you at the router/network level.
• Silhouette 6y ago
  I also disagree with the idea that HTTPS introduced the problem of requiring maintenance; anything you expose to the public internet needs maintenance and security upgrades. Although this argument doesn't allow for the huge number of websites that are not on the public Internet, but instead running on someone's internal network or embedded in some device. It is a dangerous trend for us to rely on browsers made mostly or entirely by businesses who care little for those environments because they make no money from them. There are good reasons that long-lived standards and forward compatibility are important, not least that whoever first developed some useful in-house service with a web front-end or manufactured some long-lived, high-value device may no longer be around to update things routinely according to the whims of Google or whoever.
  • _jal 6y ago
    The issue isn't that Google doesn't make money on intranets. The issue is that the security landscape has gotten so much worse and continues to become more hostile, and private IP address space and a packet filter don't provide nearly as much protection as a lot of people want to think, and attacking internal applications from "outside" is commonplace. The trend towards zero-trust and such is driven more by the fact that there's no such thing has home anymore, at least as far as networks are concerned - there's no realistic way to keep the internet out. And those IoT devices with long-lived security holes are landmines, not assets. I'm much less worried about "long-lived, high value" ones, because those are far more likely to get updates than cheap, fire-and-forget webcams and such. I agree entirely that forward-compatibility is an extremely important consideration. Security, however, frequently pulls in the opposite direction, leaving an unpleasant tradeoff. The trend will not reverse - I don't see how it realistically could. We live in the Red Queen's world.
    • Silhouette 6y ago
      You're arguing that there are no environments now where bad people can't penetrate and roam freely inside the local network? If so, I'm afraid I don't accept that premise at all. Even a basic firewall that accepts no unsolicited incoming traffic is highly effective in environments where you don't need to serve anything to the public Internet from inside your LAN. Between that and keeping software like web browsers and email systems that actively fetch data from outside updated, an average household or small business will be protected reasonably well against most routine threats. The world is far bigger than cloud computing and IoT devices. There must be millions of little in-house web applications someone wrote long ago that are still useful, probably running on some 10-year-old PC in the corner, with some sort of scheduled back-ups if you're lucky. There is also no guarantee that even a high-value, long-lived engineering device manufactured a decade or more ago and still in perfect working order also still has ongoing software support. There is a huge amount of value locked into these old systems, and arbitrarily dismissing their relevance if they don't meet modern security standards that may or may not even be relevant in all the circumstances is like designing a building with such robust security that no-one can get inside, even the owners.
• CamperBob2 6y ago
  It takes 10 minutes to put an old HTTP server behind a reverse proxied nginx instance with auto-renewing letsencrypt certs Hi. I've been online since 1982, when I built my own modem from parts sold out of the back of a magazine. What you just wrote might as well have been instructions for assembling a DIY fusion reactor, for all I know. That's what the author means when he suggests that something is being lost. I now have no realistic choice but to go through a centralized gatekeeper to post content on the Web. That sucks. It wasn't supposed to be that way.
  • satyanash 6y ago
    > no realistic choice but to go through a centralized gatekeeper This is the critical part. Even though Let's Encrypt is not-for-profit, etc. It is still a single entity. Until someone can go and start their own CA in that 10 minutes that works across the world, we're moving away from and not towards what HTTP was.
    • AmericanChopper 6y ago
      The A in CA is always going to stand for authority. The basis of the CA system is that CAs (supposedly) can be trusted. If you remove the hard parts of being a CA, then you remove the basis for that trust (however questionable it was to begin with). You don’t have an authority any more, you just have an ephemeral group of self-attesting certificate issuers, and why would you even need the issuers in that case? These are just the general (and unsolved, or perhaps even unsolvable) problems associated with PKI. I think there’s a solid argument to be made about separating the encryption of communication from the authentication of server identity. That would solve one problem, but it would also just take an existing bad problem and (arguably) make it a lot worse. Given all of its horrendous shortcomings, the CA system is still the most successful PKI ever created, by quite a large margin.
      • Silhouette 6y ago
        The usual alternative proposal is some form of decentralised web of trust. This has the significant advantage that it includes neither the letters CA nor SPOF. But of course it has difficulties of its own, and unfortunately it's hard to see how we could move safely and reasonably quickly in that direction given the entrenched powers that now dominate the CA and browser markets. It is worrying that Let's Encrypt is currently the only major provider of free, relatively easily arranged certs, though. Its success has been impressive, but it's probably also one of the biggest single points of failure in modern Web infrastructure now.
• mariusmg 6y ago
  Ah, the good old why have 1 web server when you can have 2 solution.....
  • ric2b 6y ago
    Adding a process on the same machine is not the same as buying a new machine.
• yc12340 6y ago
  > anything you expose to the public internet needs maintenance and security upgrades. Uh, no — in the past you could have purchased a hosting solution, that does it's own TCP termination (such as shared hosting) to completely forget about your site. Many static websites still exist solely because of that. Now you can accomplish the same thing by paying Cloudflare (or some other party) to terminate your TLS connection. One more kind of parasites has been enshrined in technological stack.
  • enlyth 6y ago
    You don't have to pay Cloudflare anything, they will do it for free
    • pmlnr 6y ago
      And with that, lock you in their ecosystem of proprietary web behind captchas.
  • Sebb767 6y ago
    You can also pay Hetzner, Wordpress, 1&1, AWS or any other hosting provider, most of which also offer automatic certificate renewal by now. I don't see how there is any change, especially since hosting has gotten a lot cheaper.
    • crazypython 6y ago
      Do they offer automated certificate renewal for services with constantly changing IPs? I don't think so.
      • Sebb767 6y ago
        Well, you surely could do this via some proxy setup. But in that case you could also simply rely on LetsEncrypt directly; them going away is as likely as your average hosting provider. Now, of course that's an item on the maintenance list if you're hosting the web page yourself, but as mentioned above: You still need regular updates, having certificate renewal on that list doesn't make any noticeable difference.
• josteink 6y ago
  > It takes 10 minutes to put an old HTTP server behind a reverse proxied nginx instance with auto-renewing letsencrypt certs The point of the article is that not even this is enough, because letsencrypt will change protocols, TLS versions and ciphers will be obsoleted, etc etc. Basically your entire stack will need to be kept continuously up to date. Just setting up Nginx in a Ubuntu LTS release won’t be enough, because you always will need to have everything up to latest always. And obviously you need to automate that self-update process too. So because the browser is insecure and allows JavaScript, everyone else who wants to serve a simple index.html will now need to be a full-on DevOps-expert. To me that sounds pretty backwards. How about we just fix the JavaScript-security issue in the browser instead? Or would that be just too simple??? This is breaking the web in the sense that everything which is old will perish instead of being preserved. Maybe I’ll go back to making my sites HTTP only. It certainly sounds simpler and more reliable than this...
  • fomine3 6y ago
    I can update and maintain nginx and certbot(honestly I use lego) but I won't say I'm a DevOps expert. And you can deploy your static site on Netlify, S3 etc.
• wegs 6y ago
  Ask your mom to "put an old HTTP server behind a reverse proxied nginx instance with auto-renewing letsencrypt certs" and time her. See if it takes 10 minutes. Then ask someone to foot the server bill. See how many takers you get. This is fine for corporations with IT departments, but when I was a high school student, I had a web page, and my web server was sitting under a desk in a random office. When I was in college, professors ran their own web servers. A lot of innovation bubbled up, bottom-up. Big tech stuck that with a fork. That's not a good thing.
  • theandrewbailey 6y ago
    A high school student/college professor is clever enough to write web pages and setup web servers, but not clever enough to install encryption keys and certificates? Not buying it.
    • Silhouette 6y ago
      There is a difference between being able to do something once and being willing to take on some ongoing and occasionally time-consuming responsibility to maintain it. Look at how many useful but Java-based demonstrations on academics' websites became inaccessible when the browsers decided Java plug-ins were evil and should be removed. What happened was not that people who had voluntarily spent considerable time over the course of possibly several years developing useful little bits of software suddenly dropped everything to redo all of that work again in a different language just because the browser developers had decided that other language was now flavour of the month. Instead, lots of valuable work was effectively lost.
      • cycloptic 6y ago
        >Instead, lots of valuable work was effectively lost. How? It's Java. You should be able to download the JAR and run it on any compatible JVM.
        • hedora 6y ago
          Java changed its security model at the same time, and applets needed to run inside a web browser. (You could fix this by modifying the source, but why bother, since no one would use the result in practice?)
• polote 6y ago
  It takes less than 1 minute to correct its writing mistakes before publishing a message and still most people dont do it. The time it takes to do an action is not enough to evaluate the task