4 ms·
I don't even disagree that HTTPS by itself is not needed for that use case; but in my experience those "old custom appliances" are riddled with unpatched securi
by icebraining 6y ago
I don't even disagree that HTTPS by itself is not needed for that use case; but in my experience those "old custom appliances" are riddled with unpatched security holes and shouldn't be left open to the Internet anyway, lest they become zombie members of a botnet. Are those an exception?
- at_a_remove 6y ago"Niche stuff where you had one or two vendors in the whole arena." If we didn't have them open to the Internet, we would have no service. There are no choices in that arena besides strawberry and vanilla. That is it, that is all. In this case, your requirement would result in the service not existing. This is not helpful to what we're trying to do.
- pwinnski 6y agoI think the counter-argument here is that by existing in their current form, these products either are now, or will in the future be, used as part of botstorms, exploited for illegal purposes, etc. I'm sympathetic to your argument, but I've also seen a little tiny "I'm just storing a list of the CDs I own in a text file" apps blow up with multiple gigs of unwanted data, which _probably_ would not have happened with HTTPS. Overall I'm on the side of "there must be some exceptions," but I have to admit that every month it's harder and harder to think of what the legitimate exceptions might actually be, given the toxic nature of the internet.