4 ms·

I've heard these arguments. I am not unsympathetic. For the first, I don't know what to tell you. If they aren't qualified to know when security must exist,

I've heard these arguments. I am not unsympathetic. For the first, I don't know what to tell you. If they aren't qualified to know when security must exist, they are not likely qualified to implement it. For the second, when it is needed, it can be added. A staff directory with no interaction does not need it now. It may never need it. As to the third, in a story, here is a great argument against that: So years ago I ran this dumb little site, by request, for the users to submit stuff, nothing too special. They suddenly wanted the HTTPS, which was at that time outside of their budget, which was zero, and we would have had to move it off of a shared IP (this was some time ago). I told them it wasn't necessary for their use case. "But the LOCK thing makes it safe!" They were so insistent ... but they still demanded the results be sent to them over SMTP. Oh, how I facepalmed. I explained that SMTP was its own channel. No, no, they insisted. The LOCK. HTTPS can result in a false sense of security. At the end of the day, I think I would rather have choices available even if mistakes could be made. Removing choice from people for their own good is fantastic if and only if it will never ever cause any kind of issue on its own. Here, in the article, we discuss some of those issues. If HTTPS were possible to just implement retroactively with nothing ever breaking, not even some ancient software on a floppy disk, fine. For anything other, it's a tradeoff, and I believe for tradeoffs we ought to have the ability to assess the tradeoffs and make a choice. Even choices others do not agree with!

kerkeslager 6y ago
> For the first, I don't know what to tell you. If they aren't qualified to know when security must exist, they are not likely qualified to implement it. ...which is why numerous high-quality implementations already exist. There isn't a way to say this without risking offending you, but if you can take it for what it is, I think you would benefit from it: you have posted a few examples in this thread where you think no one would care about encryption, and there are people posting here saying they do care about encryption in those cases. It might behoove you to approach this with a bit of humility and acknowledge that you are one of the people who isn't qualified to know when people need/want security, and your opinions are borne from that fact.
- at_a_remove 6y ago
  I think there are people who care about just about everything. Let's make those certificates expire every month. Also without a way to say it without risking offending someone: the tinfoil hat brigade can make everything grind to a halt. People can have concerns, and they can be very invested in those concerns, but they can be so concerned that I don't know if I could ever satisfy them. They could be concerned about what operating system that HTTPS-serving software runs on, and their set of requirements might be such that I cannot run anything.
  - kerkeslager 6y ago
    > I think there are people who care about just about everything. True. But I'm not one of those people. You'll note that there are a few of your examples which I haven't objected to. That's because I don't have objections to all of your examples. > Let's make those certificates expire every month. I get your point--people do ask for excessive security measures sometimes. But as an aside, the point of frequent certificate expiration has nothing to do with security. It's to encourage automation of renewals.
    - at_a_remove 6y ago
      And with that dreadful menuing system I described above, there was no way to automate that. I had even considered using Expect! So the encouragement has resulted in a detriment to me: more work. Oh, for a little choice! But the one-size-fits-all parade marches onward.
      - cycloptic 6y ago
        Yeah it is more work. If you're a sysadmin, that is your job and it's why you get paid. You're welcome to choose another job if it's too much work for you.
        at_a_remove 6y ago
        Yes, it is more work. And doing it doing it once every month instead of once a year is yet more work. But is it valuable work? Does that work accomplish anything? Or is that effort wasted when I could have been doing other things? I was not a sysadmin -- I kept trying to avoid that, but got sucked in, as a programmer (my title), with the reasoning I have been doing "web stuff" for a long time, as well as the sysadmin duties that were required for setting up websites "back in the day." I could have been programming and solving real problems on a more permanent basis, but here I am, carrying water with a hole in the bottom of the bucket. Once the DevOps wand got waved, I got out. If people are truly concerned about security, even the much-disliked sysadmin duties foisted upon me could have had the time more wisely spent then flipping certs around.
HappyDreamer 6y ago
> If they aren't qualified to know when security must exist, they are not likely qualified to implement it Actually that's incorrect. It's simple to add a LetsEncrypt cert in the right way -- but not easy to come up with all possible ways people might want to attack your site. @kerkeslager wrote: "But there is always incentive for bad people to hack a server ..." Those are good reasons, the ones you listed -- and yet another reason is that someone might want to use your website or app, to break into someone's else's website, e.g. by adding a link to, say, Google's login page, but the link is in fact to a password stealing site. -- And it's impossible to know when or if someone has the motivation to do such things to some of one's visitors / users.

kerkeslager 6y ago

> For the first, I don't know what to tell you. If they aren't qualified to know when security must exist, they are not likely qualified to implement it. ...which is why numerous high-quality implementations already exist. There isn't a way to say this without risking offending you, but if you can take it for what it is, I think you would benefit from it: you have posted a few examples in this thread where you think no one would care about encryption, and there are people posting here saying they do care about encryption in those cases. It might behoove you to approach this with a bit of humility and acknowledge that you are one of the people who isn't qualified to know when people need/want security, and your opinions are borne from that fact.

at_a_remove 6y ago
I think there are people who care about just about everything. Let's make those certificates expire every month. Also without a way to say it without risking offending someone: the tinfoil hat brigade can make everything grind to a halt. People can have concerns, and they can be very invested in those concerns, but they can be so concerned that I don't know if I could ever satisfy them. They could be concerned about what operating system that HTTPS-serving software runs on, and their set of requirements might be such that I cannot run anything.
- kerkeslager 6y ago
  > I think there are people who care about just about everything. True. But I'm not one of those people. You'll note that there are a few of your examples which I haven't objected to. That's because I don't have objections to all of your examples. > Let's make those certificates expire every month. I get your point--people do ask for excessive security measures sometimes. But as an aside, the point of frequent certificate expiration has nothing to do with security. It's to encourage automation of renewals.
  - at_a_remove 6y ago
    And with that dreadful menuing system I described above, there was no way to automate that. I had even considered using Expect! So the encouragement has resulted in a detriment to me: more work. Oh, for a little choice! But the one-size-fits-all parade marches onward.
    - cycloptic 6y ago
      Yeah it is more work. If you're a sysadmin, that is your job and it's why you get paid. You're welcome to choose another job if it's too much work for you.
      - at_a_remove 6y ago
        Yes, it is more work. And doing it doing it once every month instead of once a year is yet more work. But is it valuable work? Does that work accomplish anything? Or is that effort wasted when I could have been doing other things? I was not a sysadmin -- I kept trying to avoid that, but got sucked in, as a programmer (my title), with the reasoning I have been doing "web stuff" for a long time, as well as the sysadmin duties that were required for setting up websites "back in the day." I could have been programming and solving real problems on a more permanent basis, but here I am, carrying water with a hole in the bottom of the bucket. Once the DevOps wand got waved, I got out. If people are truly concerned about security, even the much-disliked sysadmin duties foisted upon me could have had the time more wisely spent then flipping certs around.

HappyDreamer 6y ago

> If they aren't qualified to know when security must exist, they are not likely qualified to implement it Actually that's incorrect. It's simple to add a LetsEncrypt cert in the right way -- but not easy to come up with all possible ways people might want to attack your site. @kerkeslager wrote: "But there is always incentive for bad people to hack a server ..." Those are good reasons, the ones you listed -- and yet another reason is that someone might want to use your website or app, to break into someone's else's website, e.g. by adding a link to, say, Google's login page, but the link is in fact to a password stealing site. -- And it's impossible to know when or if someone has the motivation to do such things to some of one's visitors / users.