4 ms·

Ask your mom to "put an old HTTP server behind a reverse proxied nginx instance with auto-renewing letsencrypt certs" and time her. See if it takes 10 minutes.

by wegs 6y ago

Ask your mom to "put an old HTTP server behind a reverse proxied nginx instance with auto-renewing letsencrypt certs" and time her. See if it takes 10 minutes. Then ask someone to foot the server bill. See how many takers you get. This is fine for corporations with IT departments, but when I was a high school student, I had a web page, and my web server was sitting under a desk in a random office. When I was in college, professors ran their own web servers. A lot of innovation bubbled up, bottom-up. Big tech stuck that with a fork. That's not a good thing.

theandrewbailey 6y ago
A high school student/college professor is clever enough to write web pages and setup web servers, but not clever enough to install encryption keys and certificates? Not buying it.
- Silhouette 6y ago
  There is a difference between being able to do something once and being willing to take on some ongoing and occasionally time-consuming responsibility to maintain it. Look at how many useful but Java-based demonstrations on academics' websites became inaccessible when the browsers decided Java plug-ins were evil and should be removed. What happened was not that people who had voluntarily spent considerable time over the course of possibly several years developing useful little bits of software suddenly dropped everything to redo all of that work again in a different language just because the browser developers had decided that other language was now flavour of the month. Instead, lots of valuable work was effectively lost.
  - cycloptic 6y ago
    >Instead, lots of valuable work was effectively lost. How? It's Java. You should be able to download the JAR and run it on any compatible JVM.
    - hedora 6y ago
      Java changed its security model at the same time, and applets needed to run inside a web browser. (You could fix this by modifying the source, but why bother, since no one would use the result in practice?)
      - danShumway 6y ago
        That seems like an issue with Java/Oracle then, not browser manufacturers. This has also come up with Flash, where Adobe still hasn't opened up the technology to the point where people can effectively emulate it. If a technology is insecure, and it gets removed from a specific environment for security reasons, and simultaneously a company makes it so that it's impossible to run outside of that environment -- the deprecation wasn't really the problem then. The reason we've lost massive numbers of Java applets and Flash apps isn't because they got deprecated from web browsers, it's because alternative environments and emulators were never built or given the support they needed. Mozilla/Google can't just decide to change the Java security model for native applets.
        Silhouette 6y ago
        Applets weren't necessarily standalone software, though. I built several professionally, and they were all integrated into a wider web page, not just a self-contained program. The changes by the plug-in developers were often unhelpful in the final days before we gave up on those technologies entirely, but let's not pretend they were the root cause of the plug-ins' demise.
        danShumway 6y ago
        > Applets weren't necessarily standalone software That's a very good point. I don't think they were the root cause, but even though there are scenarios like you're talking about, I still think we'd be in a different world today if different companies were handling those plugins. It's worth noting that from a preservation perspective, today we're at the point where people are pretty realistically looking into emulating SWF runtimes in Javascript inside web browsers. If that happened, you wouldn't even need click-to-play. SWFs would just work with the same sandboxing guarantees as the browser. The biggest reason that hasn't really taken off is because the SWF format still hasn't been opened up. The reason why there isn't just a drop-in WASM library that lets you run Flash code on the web is because of Adobe, not Mozilla or Google. Of course, especially in the case of Java we could only ever emulate features that browsers support. But that's why the plugins were deprecated in the first place; because they supported inherently insecure features that we either don't want in the browser, or don't want to support in the same way. But that's true for lots of platforms, and yet I can already run C/Rust/Lua code in a web browser. The Lua runtime had been cross-compiled to ASM.js before Flash was dead (although today we have a lot better speed). But the difference between Lua/C and Java was that the most common Java runtime was proprietary. OpenJDK browser plugins would break most sites that I was using. So there wasn't anybody who was sitting down to say, "excluding the features that browsers don't support, is there any of this code that's salvageable?" They weren't really allowed to do that.
  - Jonnax 6y ago
    They decided to drop java as a plugin because people would browse to a random webpage, and malware would automatically be downloaded to their machines.
    - hedora 6y ago
      Java plug-ins died off for a reason, but that doesn’t change the fact that deprecating http is effectively deleting decades worth of the internet for no good reason. If someone can own my browser by mitm’ing a static html page, then they can do it more easily by serving malicious ads, or using seo / social engineering to steer me to a web server they control. I don’t buy that argument. Also, browsers could run in a simple and secure legacy mode when they connect via http.
      - pwinnski 6y ago
        +1 Even if there are good reasons, it;'s still effectively deleting decades worth of the internet. To blithely say that it's trivial to slap together a reverse proxy and keep it updated is both factually wrong and missing the point: something has been lost, and it's sad.
      - Wowfunhappy 6y ago
        ...is there talk of browsers actually dropping support for http connections?
      - danShumway 6y ago
        > Also, browsers could run in a simple and secure legacy mode when they connect via http. :) What if, purely as a theoretical proposal, they display the webpage as normal, but just show a little icon in the address bar that marks the website as insecure? Have I missed something? Is anybody actually talking about removing HTTP support from browsers? I don't think that this is the same scenario as Java or Flash at all, HTTP still works fine. All of the static websites that people are complaining about losing still load without any problems. And even if it was the same scenario, Java is not a great example to use here, because the deprecation of Java and Flash, as painful as it was to many people, was also very clearly, almost universally recognized as necessary for security. Java and Flash are probably the two best examples you could come up with if you wanted to argue, "sometimes it's necessary to take painful steps that break things to make a secure system. Sometimes you can't trust developers to do the right things until you force them." Am I sad about Flash and Java? Of course, I have a fair amount of personal background in that area. We lost precious things. But should we have kept Java? No, of course not. Obviously not, that would have been such a terrible idea for both security and the Open web. I remember the pain of trying to get decent Flash support on Linux. It was a fantastic, open system for some people. But it was also proprietary, and filled with security holes, and being used in ridiculous ways for DRM and circumvention of Open browser standards, and frankly, the slow deprecation path just wasn't working. I wish Flash had been handled better, but... I mean, we did have to get rid of it. I don't believe anyone could seriously argue to me that the web would be better if we were still using Java and Flash today. So even in a theoretical world where we're actually talking about deprecating unencrypted HTTP support, we should still only be talking about preserving or emulating sites that will be lost. We shouldn't be talking about continuing to do something that's insecure.
Jonnax 6y ago
Why can't you do that today? Internet connections are much faster. Most people aren't under CG-NAT. Even a raspberry pi can be a server. What are you arguing here? Why is your tech illiterate mum setting up a http server but can't do https? Wouldn't it be better to create a blog on medium? Or a site on square space? How about a free site with GitHub pages? I just don't understand the idea that people want to set up something and forget about it. That's how you get hacked and turned into part of a botnet.
- wegs 6y ago
  I'm arguing: (1) The poster arguing this was 10 minutes was being dishonest. (2) As the original article said, it's a different internet if the only way to get something up is to go through Square Space or Github pages. It's much less decentralized, and much more corporate. Yes, I do think the internet could have evolved to where a tech-illiterate mum could host her own web page from her router at home. It didn't, and we lost something in that process.

by wegs 6y ago

theandrewbailey 6y ago

A high school student/college professor is clever enough to write web pages and setup web servers, but not clever enough to install encryption keys and certificates? Not buying it.

Silhouette 6y ago
There is a difference between being able to do something once and being willing to take on some ongoing and occasionally time-consuming responsibility to maintain it. Look at how many useful but Java-based demonstrations on academics' websites became inaccessible when the browsers decided Java plug-ins were evil and should be removed. What happened was not that people who had voluntarily spent considerable time over the course of possibly several years developing useful little bits of software suddenly dropped everything to redo all of that work again in a different language just because the browser developers had decided that other language was now flavour of the month. Instead, lots of valuable work was effectively lost.
- cycloptic 6y ago
  >Instead, lots of valuable work was effectively lost. How? It's Java. You should be able to download the JAR and run it on any compatible JVM.
  - hedora 6y ago
    Java changed its security model at the same time, and applets needed to run inside a web browser. (You could fix this by modifying the source, but why bother, since no one would use the result in practice?)
    - danShumway 6y ago
      That seems like an issue with Java/Oracle then, not browser manufacturers. This has also come up with Flash, where Adobe still hasn't opened up the technology to the point where people can effectively emulate it. If a technology is insecure, and it gets removed from a specific environment for security reasons, and simultaneously a company makes it so that it's impossible to run outside of that environment -- the deprecation wasn't really the problem then. The reason we've lost massive numbers of Java applets and Flash apps isn't because they got deprecated from web browsers, it's because alternative environments and emulators were never built or given the support they needed. Mozilla/Google can't just decide to change the Java security model for native applets.
      - Silhouette 6y ago
        Applets weren't necessarily standalone software, though. I built several professionally, and they were all integrated into a wider web page, not just a self-contained program. The changes by the plug-in developers were often unhelpful in the final days before we gave up on those technologies entirely, but let's not pretend they were the root cause of the plug-ins' demise.
        danShumway 6y ago
        > Applets weren't necessarily standalone software That's a very good point. I don't think they were the root cause, but even though there are scenarios like you're talking about, I still think we'd be in a different world today if different companies were handling those plugins. It's worth noting that from a preservation perspective, today we're at the point where people are pretty realistically looking into emulating SWF runtimes in Javascript inside web browsers. If that happened, you wouldn't even need click-to-play. SWFs would just work with the same sandboxing guarantees as the browser. The biggest reason that hasn't really taken off is because the SWF format still hasn't been opened up. The reason why there isn't just a drop-in WASM library that lets you run Flash code on the web is because of Adobe, not Mozilla or Google. Of course, especially in the case of Java we could only ever emulate features that browsers support. But that's why the plugins were deprecated in the first place; because they supported inherently insecure features that we either don't want in the browser, or don't want to support in the same way. But that's true for lots of platforms, and yet I can already run C/Rust/Lua code in a web browser. The Lua runtime had been cross-compiled to ASM.js before Flash was dead (although today we have a lot better speed). But the difference between Lua/C and Java was that the most common Java runtime was proprietary. OpenJDK browser plugins would break most sites that I was using. So there wasn't anybody who was sitting down to say, "excluding the features that browsers don't support, is there any of this code that's salvageable?" They weren't really allowed to do that.
- Jonnax 6y ago
  They decided to drop java as a plugin because people would browse to a random webpage, and malware would automatically be downloaded to their machines.
  - hedora 6y ago
    Java plug-ins died off for a reason, but that doesn’t change the fact that deprecating http is effectively deleting decades worth of the internet for no good reason. If someone can own my browser by mitm’ing a static html page, then they can do it more easily by serving malicious ads, or using seo / social engineering to steer me to a web server they control. I don’t buy that argument. Also, browsers could run in a simple and secure legacy mode when they connect via http.
    - pwinnski 6y ago
      +1 Even if there are good reasons, it;'s still effectively deleting decades worth of the internet. To blithely say that it's trivial to slap together a reverse proxy and keep it updated is both factually wrong and missing the point: something has been lost, and it's sad.
    - Wowfunhappy 6y ago
      ...is there talk of browsers actually dropping support for http connections?
    - danShumway 6y ago
      > Also, browsers could run in a simple and secure legacy mode when they connect via http. :) What if, purely as a theoretical proposal, they display the webpage as normal, but just show a little icon in the address bar that marks the website as insecure? Have I missed something? Is anybody actually talking about removing HTTP support from browsers? I don't think that this is the same scenario as Java or Flash at all, HTTP still works fine. All of the static websites that people are complaining about losing still load without any problems. And even if it was the same scenario, Java is not a great example to use here, because the deprecation of Java and Flash, as painful as it was to many people, was also very clearly, almost universally recognized as necessary for security. Java and Flash are probably the two best examples you could come up with if you wanted to argue, "sometimes it's necessary to take painful steps that break things to make a secure system. Sometimes you can't trust developers to do the right things until you force them." Am I sad about Flash and Java? Of course, I have a fair amount of personal background in that area. We lost precious things. But should we have kept Java? No, of course not. Obviously not, that would have been such a terrible idea for both security and the Open web. I remember the pain of trying to get decent Flash support on Linux. It was a fantastic, open system for some people. But it was also proprietary, and filled with security holes, and being used in ridiculous ways for DRM and circumvention of Open browser standards, and frankly, the slow deprecation path just wasn't working. I wish Flash had been handled better, but... I mean, we did have to get rid of it. I don't believe anyone could seriously argue to me that the web would be better if we were still using Java and Flash today. So even in a theoretical world where we're actually talking about deprecating unencrypted HTTP support, we should still only be talking about preserving or emulating sites that will be lost. We shouldn't be talking about continuing to do something that's insecure.

Jonnax 6y ago

Why can't you do that today? Internet connections are much faster. Most people aren't under CG-NAT. Even a raspberry pi can be a server. What are you arguing here? Why is your tech illiterate mum setting up a http server but can't do https? Wouldn't it be better to create a blog on medium? Or a site on square space? How about a free site with GitHub pages? I just don't understand the idea that people want to set up something and forget about it. That's how you get hacked and turned into part of a botnet.

wegs 6y ago
I'm arguing: (1) The poster arguing this was 10 minutes was being dishonest. (2) As the original article said, it's a different internet if the only way to get something up is to go through Square Space or Github pages. It's much less decentralized, and much more corporate. Yes, I do think the internet could have evolved to where a tech-illiterate mum could host her own web page from her router at home. It didn't, and we lost something in that process.