5 ms·

Why does the old web server even need HTTPS? Have I missed a memo that HTTP is going away? If you're not sending anything private (ie just the contents of the

Why does the old web server even need HTTPS? Have I missed a memo that HTTP is going away? If you're not sending anything private (ie just the contents of the website are being delivered) there isn't really any need for HTTPS, so leave that old HTTPD server running HTTP. But, if you want your stuff encrypted, you can't rely on old versions of HTTPS so you have to use something more modern. Also, if you want your transmissions to be secure, you probably shouldn't be relying on hardware/software that has passed EoL ages ago too. If you want to read more, you can check out my page at wais://runkel.org/personal?old-servers

msla 6y ago
Tell that to ISPs who insert ads into every non-encrypted location they can find.
- vultour 6y ago
  Pretty sure that’s mostly a US problem, I haven’t heard of any other first world country where this regularly happens. You should probably work on fixing the problem instead of requiring everyone to accommodate you.
  - msla 6y ago
    You're wrong, naturally, and the fact HTTPS solves the general problem is proof enough it's needed.
- mrunkel 6y ago
  I'm not arguing against HTTPS. I'm saying that it's not a requirement for an old website running on an old server (which is what the post was about).
int_19h 6y ago
> Have I missed a memo that HTTP is going away? https://konklone.com/post/were-deprecating-http-and-its-going-to-be-okay https://konklone.com/post/were-deprecating-http-and-its-goin... (FWIW, I personally don't like it and think that it's a mistake.)
- mrunkel 6y ago
  Considering that post is 5 years old and HTTP still works in Firefox and Chrome, I don't think what the post says is coming is coming.
  - int_19h 6y ago
    A change of this magnitude is going to take many years.
  - konklone 6y ago
    Author of the post here :) In those 5 years, HTTPS has gone from being the minority of traffic to being ~90% of the connections observed by most Chrome clients (scroll down a few graphs for the Chrome-observed one): https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/https/overview Firefox has reported similar numbers. It's now more common for new web features to require HTTPS when they are introduced, to avoid developing HTTP sites as dependencies: https://blog.mozilla.org/security/2018/01/15/secure-contexts-everywhere/ https://blog.mozilla.org/security/2018/01/15/secure-contexts... That doesn't mean that HTTP is banned, but given the magnitude of the change and the size of the web, I think it's fair to say that it's being deprecated. More practically, anyone who wanted to build a product (or a government process) on intercepting or modifying people's unencrypted web traffic would find their dataset to be an order of magnitude smaller, and orders of magnitude less useful (since so much of the remaining HTTP traffic is in the long tail of small/older sites).

msla 6y ago

Tell that to ISPs who insert ads into every non-encrypted location they can find.

vultour 6y ago
Pretty sure that’s mostly a US problem, I haven’t heard of any other first world country where this regularly happens. You should probably work on fixing the problem instead of requiring everyone to accommodate you.
- msla 6y ago
  You're wrong, naturally, and the fact HTTPS solves the general problem is proof enough it's needed.
mrunkel 6y ago
I'm not arguing against HTTPS. I'm saying that it's not a requirement for an old website running on an old server (which is what the post was about).

int_19h 6y ago

> Have I missed a memo that HTTP is going away? https://konklone.com/post/were-deprecating-http-and-its-going-to-be-okay https://konklone.com/post/were-deprecating-http-and-its-goin... (FWIW, I personally don't like it and think that it's a mistake.)

mrunkel 6y ago
Considering that post is 5 years old and HTTP still works in Firefox and Chrome, I don't think what the post says is coming is coming.
- int_19h 6y ago
  A change of this magnitude is going to take many years.
- konklone 6y ago
  Author of the post here :) In those 5 years, HTTPS has gone from being the minority of traffic to being ~90% of the connections observed by most Chrome clients (scroll down a few graphs for the Chrome-observed one): https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/https/overview Firefox has reported similar numbers. It's now more common for new web features to require HTTPS when they are introduced, to avoid developing HTTP sites as dependencies: https://blog.mozilla.org/security/2018/01/15/secure-contexts-everywhere/ https://blog.mozilla.org/security/2018/01/15/secure-contexts... That doesn't mean that HTTP is banned, but given the magnitude of the change and the size of the web, I think it's fair to say that it's being deprecated. More practically, anyone who wanted to build a product (or a government process) on intercepting or modifying people's unencrypted web traffic would find their dataset to be an order of magnitude smaller, and orders of magnitude less useful (since so much of the remaining HTTP traffic is in the long tail of small/older sites).