3 ms·

I would hope you could expand on this a bit?

bullen 6y ago
Not OP but: HTTPS is not secure because it is centralized and it does not protect against MITM. HTTP is the foundation of our civilization, it will never go away how much certificate sellers try. But I would go one step further and point out that HTTP can be made secure manually selectively so that you only secure the things that need security! HTTPS wastes energy by encrypting cat pictures, and we don't have that much cheap energy left! But don't worry this will not kill HTTP only Mozilla/Chrome. Chromium will always allow adblockers for free and HTTP, because if they remove it, I'll fork it and add it back in, even if it takes 1 day to compile!
- MayeulC 6y ago
  To me, HTTP is the wrong target. It would be much more interesting to replace IP, like Yggdrasil does (and I think gnunet, cjdns, hyperboria & others). If you IP is a cryptographic identifier: * It cannot be forged * Anyone can generate a new one on-demand * Every packet is authenticated, every packet can be encrypted * TLS becomes redundant However, the DNS part remains a hard one. How to securely link to websites you have never seen? Pet names seem like a way to do so. Asking users to type IP addresses isn't really an answer, I think, but I don't know if there's a lot of "basic" users who type URLs in nowadays, they all seem to rely on google providing the right website anyway, or the web browser itself. It's not like DNS is also our single source of trust nowadays, but at least certificate providers are competent enough to make sure names are resolved correctly. One option would be to make signed DNS records over a DHT: the root authority "." signs "com", "net", etc, that sign "ycombinator", etc. Publish to DHT, hash-indexed. Of course, point-to-point connections have their weaknesses as well, it might be interesting to migrate to something like beaker browser (html on top of hypercore, formerly DAT, kind of like mutable torrents in a DHT). At the end of the day, the core issue is: migrating users is difficult if the benefits are not immediately obvious. And yes, massively adopting anything else would litterally "kill the old web", in the protocol sense. In the community or content sense? Not so sure. https://yggdrasil-network.github.io/ https://yggdrasil-network.github.io/ https://gnunet.org/en/ https://gnunet.org/en/ https://github.com/cjdelisle/cjdns/ https://github.com/cjdelisle/cjdns/ https://beakerbrowser.com/ https://beakerbrowser.com/ https://hypercore-protocol.org/ https://hypercore-protocol.org/
  - bullen 6y ago
    IP is even harder to replace, it is completely fossilized by this point and that is a feature. The challenge is not to replace the pipes but to build something meaningful using the pipes we have without too much added complexity: I built a realtime MMO stack using only HTTP/1.1 for network.
    - MayeulC 6y ago
      You can always build a transition infrastructure on the top of IP, like https did by coexisting with http, and a bit like gemini does (it has https://gemini.circumlunar.space/ https://gemini.circumlunar.space/ at least). Then build some links without it, and have the compatibility layer the other way. If there are compelling reasons to use the new protocol, it might gain some traction. Maybe we'll turn off IP, but probably not within a century, unless some organization acquires a tremendous amount of control over the Internet.

Not OP but: HTTPS is not secure because it is centralized and it does not protect against MITM. HTTP is the foundation of our civilization, it will never go away how much certificate sellers try. But I would go one step further and point out that HTTP can be made secure manually selectively so that you only secure the things that need security! HTTPS wastes energy by encrypting cat pictures, and we don't have that much cheap energy left! But don't worry this will not kill HTTP only Mozilla/Chrome. Chromium will always allow adblockers for free and HTTP, because if they remove it, I'll fork it and add it back in, even if it takes 1 day to compile!

MayeulC 6y ago
To me, HTTP is the wrong target. It would be much more interesting to replace IP, like Yggdrasil does (and I think gnunet, cjdns, hyperboria & others). If you IP is a cryptographic identifier: * It cannot be forged * Anyone can generate a new one on-demand * Every packet is authenticated, every packet can be encrypted * TLS becomes redundant However, the DNS part remains a hard one. How to securely link to websites you have never seen? Pet names seem like a way to do so. Asking users to type IP addresses isn't really an answer, I think, but I don't know if there's a lot of "basic" users who type URLs in nowadays, they all seem to rely on google providing the right website anyway, or the web browser itself. It's not like DNS is also our single source of trust nowadays, but at least certificate providers are competent enough to make sure names are resolved correctly. One option would be to make signed DNS records over a DHT: the root authority "." signs "com", "net", etc, that sign "ycombinator", etc. Publish to DHT, hash-indexed. Of course, point-to-point connections have their weaknesses as well, it might be interesting to migrate to something like beaker browser (html on top of hypercore, formerly DAT, kind of like mutable torrents in a DHT). At the end of the day, the core issue is: migrating users is difficult if the benefits are not immediately obvious. And yes, massively adopting anything else would litterally "kill the old web", in the protocol sense. In the community or content sense? Not so sure. https://yggdrasil-network.github.io/ https://yggdrasil-network.github.io/ https://gnunet.org/en/ https://gnunet.org/en/ https://github.com/cjdelisle/cjdns/ https://github.com/cjdelisle/cjdns/ https://beakerbrowser.com/ https://beakerbrowser.com/ https://hypercore-protocol.org/ https://hypercore-protocol.org/
- bullen 6y ago
  IP is even harder to replace, it is completely fossilized by this point and that is a feature. The challenge is not to replace the pipes but to build something meaningful using the pipes we have without too much added complexity: I built a realtime MMO stack using only HTTP/1.1 for network.
  - MayeulC 6y ago
    You can always build a transition infrastructure on the top of IP, like https did by coexisting with http, and a bit like gemini does (it has https://gemini.circumlunar.space/ https://gemini.circumlunar.space/ at least). Then build some links without it, and have the compatibility layer the other way. If there are compelling reasons to use the new protocol, it might gain some traction. Maybe we'll turn off IP, but probably not within a century, unless some organization acquires a tremendous amount of control over the Internet.