6 ms·

It's obvious I need to spend more time researching Gemini and similar things. The "web" is going to be a true monoculture very, very soon.

dewey 6y ago
Using https is making the web a monoculture?
- jevgeni 6y ago
  It obviously is. Having just an HTML site now becomes more expensive for no clear reason. Which makes more sense for people to check out Gemini.
  - dewey 6y ago
    What makes it more expensive? A certificate is free (With LE or self-signed), the performance impact is negligible and there's a clear reason for why everyone should be using it.
    - oofoe 6y ago
      It does add a "tax" of sort in the form time or attention that must be paid to keep a website up. You can't just sling some files in a directory and be done -- you have to pay for certificates or pay (in time and executable capability) to keep LetsEncrypt up to date. And, as wonderful as LetsEncrypt is, it's not forever. At some point, they're gonna' get tired of messing with it or it will get taken over by private equity (see .org) and for whatever reason, it won't work any more. And sure, that's always been true, new stuff obsoletes old and things fall by the wayside. But my current browser can access modern websites as well as sites from the dawn of the Web. But FireFox 85, 87 or 90 will probably make https mandatory -- and that amazing continuity is gone.
      - MaxBarraclough 6y ago
        There are good reasons to insist on the use of HTTPS for all sites on the public web, with no exceptions or excuses. This topic has cropped up before: • https://news.ycombinator.com/item?id=21912817 https://news.ycombinator.com/item?id=21912817 • https://news.ycombinator.com/item?id=24640183 https://news.ycombinator.com/item?id=24640183 • https://news.ycombinator.com/item?id=22147858 https://news.ycombinator.com/item?id=22147858
        jevgeni 6y ago
        These links list literally SOME and not ALL cases that need encryption.
        MaxBarraclough 6y ago
        I'm afraid I don't see your point here, please elaborate.
        jevgeni 6y ago
        Your point is "this should be applied to ALL sites", while your argument for it is "because it is relevant for SOME sites".
        MaxBarraclough 6y ago
        Not so. In the top link, points 2, 3, and 5, apply to all public websites.
    - jevgeni 6y ago
      You cannot say that certificates are reliably free (especially in the long run), if there's only one entity providing them and that entity is dependent on corporate sponsors.
      - josephcsible 6y ago
        We can't say that a true statement is true just because there's a chance that at some point it becomes false?
        jevgeni 6y ago
        By that logic Lehman Brothers stock was a great investment on the 14 September 2008.
      - snazz 6y ago
        Tons of major websites rely on Let's Encrypt, so I think it's fair to say that they're probably not going anywhere soon. Free certificates are now standard on services like Cloudflare and Google App Engine. I think that AWS can generate free ones too.
    - romwell 6y ago
      Not everyone needs HTTPS, in spite of what the HN mantra says. Some websites are the equivalents of billboards. The cost is dependence on a central authority that can make your site inaccessible in a whim.
  - snazz 6y ago
    You're aware that Gemini mandates a recent version of TLS in the protocol specification, right?
    - jevgeni 6y ago
      Self-signed certificates are first class citizens. Section 4.2 of the spec.
- m_eiman 6y ago
  It's part of the culture of making everything web terribly complicated, which has resulted in the death of all but three web browsers. It's now practically impossible to write a new web browser from scratch, unless you're a mega corp with endless resources and a grudge against Google, and they're still adding more complexity every day.
  - dewey 6y ago
    The web started out as a very optimistic project with no security and a lot based on trust. As it evolved a lot of security had to be bolted on which now makes it a bit more complicated than in the early days. But what's the alternative? Of course a perfect protocol where nothing needs to be added later would be great, but that's not very realistic.
    - m_eiman 6y ago
      The problem isn't just HTTPS, it's the ever-expanding array of various APIs and technologies that "must" be implemented to be a "real" or "complete" browser. Even Firefox, that's been around for a long time and has a fairly large mind share, is at best an afterthought in many web projects. The amount of APIs that need to be implemented to be considered even a basic web browser is so huge that it's not an approachable project for just about any organization, and as an individual it's just not possible.
  - josephcsible 6y ago
    Supporting TLS is a cakewalk compared to handling modern HTML/JS/etc. This has nothing to do with the browser monoculture.
dusted 6y ago
I agree. HTTPS is great, at definitely needed for a lot of things. But I don't need my cat pictures encrypted, I don't need lots of things encrypted, and frankly, I don't want it to be encrypted when it's not required, it's a waste of resources, both processing and network. Then there is the case of all the old computers that either lack the processing power or support for modern algorithms.
- antonyh 6y ago
  When there's executable code there needs to be encryption. JS HTML CSS WASM etc ...all need to be tamper-resistant. Processing power, meh. More of an issue is older devices not getting the updates to software for the newer algorithms, and not getting the updated certificates. I got rid of a perfectly good tablet for just this reason. A bit slow perhaps but workable.
- autoexec 6y ago
  I'd be more receptive to this if ISPs weren't snooping on traffic and selling their customer's browsing history. As long as we have to operate under the assumption that every scrap of data we send or request will be picked apart and used against us whenever possible I'd rather encrypt everything and have a little less to worry about.
  - m_eiman 6y ago
    Perhaps you should get some better laws in your country to prevent this, instead of ruining the web for the rest of the world?
    - snazz 6y ago
      Sorry to burst your bubble, but intelligence agencies are going to be monitoring your traffic regardless. The Internet is a global network; laws in specific countries or economic zones don't affect data in transit through other parts of the world.
- visarga 6y ago
  > I don't need my cat pictures encrypted Because all images are of cats or it's easy to tell when it's sensitive and when not.
GuB-42 6y ago
Gemini is a monoculture. They almost say it in the FAQ: > 2.5 Why not just use a subset of HTTP and HTML? > [...] The problem is that deciding upon a strictly limited subset of HTTP and HTML, slapping a label on it and calling it a day would do almost nothing to create a clearly demarcated space where people can go to consume only that kind of content in only that kind of way. [...] The protocol itself has very strong opinions on what is allowed and what is not. It is simple but mandates TLS (so, not simple), because authors think encryption is important but other things are not. It is also deliberately non-extensible. Not saying it is a bad thing, I mean, they didn't hurt anyone. But that protocol is clearly intended as a rallying point for like-minded individuals rather than something for everyone to use.

dewey 6y ago

Using https is making the web a monoculture?

jevgeni 6y ago
It obviously is. Having just an HTML site now becomes more expensive for no clear reason. Which makes more sense for people to check out Gemini.
- dewey 6y ago
  What makes it more expensive? A certificate is free (With LE or self-signed), the performance impact is negligible and there's a clear reason for why everyone should be using it.
  - oofoe 6y ago
    It does add a "tax" of sort in the form time or attention that must be paid to keep a website up. You can't just sling some files in a directory and be done -- you have to pay for certificates or pay (in time and executable capability) to keep LetsEncrypt up to date. And, as wonderful as LetsEncrypt is, it's not forever. At some point, they're gonna' get tired of messing with it or it will get taken over by private equity (see .org) and for whatever reason, it won't work any more. And sure, that's always been true, new stuff obsoletes old and things fall by the wayside. But my current browser can access modern websites as well as sites from the dawn of the Web. But FireFox 85, 87 or 90 will probably make https mandatory -- and that amazing continuity is gone.
    - MaxBarraclough 6y ago
      There are good reasons to insist on the use of HTTPS for all sites on the public web, with no exceptions or excuses. This topic has cropped up before: • https://news.ycombinator.com/item?id=21912817 https://news.ycombinator.com/item?id=21912817 • https://news.ycombinator.com/item?id=24640183 https://news.ycombinator.com/item?id=24640183 • https://news.ycombinator.com/item?id=22147858 https://news.ycombinator.com/item?id=22147858
      - jevgeni 6y ago
        These links list literally SOME and not ALL cases that need encryption.
        MaxBarraclough 6y ago
        I'm afraid I don't see your point here, please elaborate.
        jevgeni 6y ago
        Your point is "this should be applied to ALL sites", while your argument for it is "because it is relevant for SOME sites".
        MaxBarraclough 6y ago
        Not so. In the top link, points 2, 3, and 5, apply to all public websites.
  - jevgeni 6y ago
    You cannot say that certificates are reliably free (especially in the long run), if there's only one entity providing them and that entity is dependent on corporate sponsors.
    - josephcsible 6y ago
      We can't say that a true statement is true just because there's a chance that at some point it becomes false?
      - jevgeni 6y ago
        By that logic Lehman Brothers stock was a great investment on the 14 September 2008.
    - snazz 6y ago
      Tons of major websites rely on Let's Encrypt, so I think it's fair to say that they're probably not going anywhere soon. Free certificates are now standard on services like Cloudflare and Google App Engine. I think that AWS can generate free ones too.
  - romwell 6y ago
    Not everyone needs HTTPS, in spite of what the HN mantra says. Some websites are the equivalents of billboards. The cost is dependence on a central authority that can make your site inaccessible in a whim.
- snazz 6y ago
  You're aware that Gemini mandates a recent version of TLS in the protocol specification, right?
  - jevgeni 6y ago
    Self-signed certificates are first class citizens. Section 4.2 of the spec.
m_eiman 6y ago
It's part of the culture of making everything web terribly complicated, which has resulted in the death of all but three web browsers. It's now practically impossible to write a new web browser from scratch, unless you're a mega corp with endless resources and a grudge against Google, and they're still adding more complexity every day.
- dewey 6y ago
  The web started out as a very optimistic project with no security and a lot based on trust. As it evolved a lot of security had to be bolted on which now makes it a bit more complicated than in the early days. But what's the alternative? Of course a perfect protocol where nothing needs to be added later would be great, but that's not very realistic.
  - m_eiman 6y ago
    The problem isn't just HTTPS, it's the ever-expanding array of various APIs and technologies that "must" be implemented to be a "real" or "complete" browser. Even Firefox, that's been around for a long time and has a fairly large mind share, is at best an afterthought in many web projects. The amount of APIs that need to be implemented to be considered even a basic web browser is so huge that it's not an approachable project for just about any organization, and as an individual it's just not possible.
- josephcsible 6y ago
  Supporting TLS is a cakewalk compared to handling modern HTML/JS/etc. This has nothing to do with the browser monoculture.

dusted 6y ago

I agree. HTTPS is great, at definitely needed for a lot of things. But I don't need my cat pictures encrypted, I don't need lots of things encrypted, and frankly, I don't want it to be encrypted when it's not required, it's a waste of resources, both processing and network. Then there is the case of all the old computers that either lack the processing power or support for modern algorithms.

antonyh 6y ago
When there's executable code there needs to be encryption. JS HTML CSS WASM etc ...all need to be tamper-resistant. Processing power, meh. More of an issue is older devices not getting the updates to software for the newer algorithms, and not getting the updated certificates. I got rid of a perfectly good tablet for just this reason. A bit slow perhaps but workable.
autoexec 6y ago
I'd be more receptive to this if ISPs weren't snooping on traffic and selling their customer's browsing history. As long as we have to operate under the assumption that every scrap of data we send or request will be picked apart and used against us whenever possible I'd rather encrypt everything and have a little less to worry about.
- m_eiman 6y ago
  Perhaps you should get some better laws in your country to prevent this, instead of ruining the web for the rest of the world?
  - snazz 6y ago
    Sorry to burst your bubble, but intelligence agencies are going to be monitoring your traffic regardless. The Internet is a global network; laws in specific countries or economic zones don't affect data in transit through other parts of the world.
visarga 6y ago
> I don't need my cat pictures encrypted Because all images are of cats or it's easy to tell when it's sensitive and when not.

GuB-42 6y ago

Gemini is a monoculture. They almost say it in the FAQ: > 2.5 Why not just use a subset of HTTP and HTML? > [...] The problem is that deciding upon a strictly limited subset of HTTP and HTML, slapping a label on it and calling it a day would do almost nothing to create a clearly demarcated space where people can go to consume only that kind of content in only that kind of way. [...] The protocol itself has very strong opinions on what is allowed and what is not. It is simple but mandates TLS (so, not simple), because authors think encryption is important but other things are not. It is also deliberately non-extensible. Not saying it is a bad thing, I mean, they didn't hurt anyone. But that protocol is clearly intended as a rallying point for like-minded individuals rather than something for everyone to use.