8 ms·

Totally agree. I have an iPad app that runs an embedded http server, so that other clients on the same lan can connect to it. Making that into an embedded https

Totally agree. I have an iPad app that runs an embedded http server, so that other clients on the same lan can connect to it. Making that into an embedded https server would be a big hassle.

chrisseaton 6y ago
> Making that into an embedded https server would be a big hassle. Why? HTTPS is an open protocol anyone can implement.
- jackewiehose 6y ago
  It's still a much bigger hassle to implement HTTPS than just HTTP.
  - chrisseaton 6y ago
    Don't your libraries implement it?
  - cpeterso 6y ago
    The biggest hassle would be that the embedded HTTPS server needs a trusted certificate, but certificates are only issued for hostnames, not IP addresses. So the embedded HTTPS server's certificate and LAN clients would need to know the hostname of the device running the app.
    - cxr 6y ago
      Cloudflare manages to provide a certificate for https://1.1.1.1 https://1.1.1.1. (But not reserved ones; see [1].) Aside from that, what is the purpose of this comment supposed to be? (The general tone reads as if its meant to refute the parent; did you intend it to be a reply to chrisseaton instead—and thus a defense of the HTTPS-complicates-things position?) 1. https://news.ycombinator.com/item?id=16717849 https://news.ycombinator.com/item?id=16717849
      - cpeterso 6y ago
        That’s interesting about the 1.1.1.1 certificate. I wasn’t refuting jackewiehose‘s comment about HTTPS hassles. I was just sharing a specific example of a hassle.
      - majewsky 6y ago
        > https://1.1.1.1 https://1.1.1.1 That's correct, some CAs issue certificates for public IPs. You're never ever going to get a cert for a private IP, since these are not globally unique.
        cxr 6y ago
        This isn't saying anything not already covered in the material I referenced in my comment—although it does say it less precisely, so I'd argue on those grounds that all things considered this comment need not have been posted... (In any case, I'm totally mystified about why my own comment that includes that link and corrects the untrue statement about it not being possible possible to get certificates for IPs was deemed to offend someone's sensibilities. Surely the offense, if there is one, is in the comment that makes an outright, verifiably untrue claim?)
- Rexxar 6y ago
  Open doesn't imply it's easy.
- auggierose 6y ago
  The certificate management is the problem here. Let's say the server is running on 192.168.1.73, how do I get a certificate for that? On the next start of the app, the server might be running on 192.168.1.76, so I need another certificate for that. You see the problem? Also take into account that the entire infrastructure for solving that problem needs to run inside the iPad App, which needs to be accepted to the Apple store ...

Totally agree. I have an iPad app that runs an embedded http server, so that other clients on the same lan can connect to it. Making that into an embedded https server would be a big hassle.

chrisseaton 6y ago

> Making that into an embedded https server would be a big hassle. Why? HTTPS is an open protocol anyone can implement.

jackewiehose 6y ago
It's still a much bigger hassle to implement HTTPS than just HTTP.
- chrisseaton 6y ago
  Don't your libraries implement it?
- cpeterso 6y ago
  The biggest hassle would be that the embedded HTTPS server needs a trusted certificate, but certificates are only issued for hostnames, not IP addresses. So the embedded HTTPS server's certificate and LAN clients would need to know the hostname of the device running the app.
  - cxr 6y ago
    Cloudflare manages to provide a certificate for https://1.1.1.1 https://1.1.1.1. (But not reserved ones; see [1].) Aside from that, what is the purpose of this comment supposed to be? (The general tone reads as if its meant to refute the parent; did you intend it to be a reply to chrisseaton instead—and thus a defense of the HTTPS-complicates-things position?) 1. https://news.ycombinator.com/item?id=16717849 https://news.ycombinator.com/item?id=16717849
    - cpeterso 6y ago
      That’s interesting about the 1.1.1.1 certificate. I wasn’t refuting jackewiehose‘s comment about HTTPS hassles. I was just sharing a specific example of a hassle.
    - majewsky 6y ago
      > https://1.1.1.1 https://1.1.1.1 That's correct, some CAs issue certificates for public IPs. You're never ever going to get a cert for a private IP, since these are not globally unique.
      - cxr 6y ago
        This isn't saying anything not already covered in the material I referenced in my comment—although it does say it less precisely, so I'd argue on those grounds that all things considered this comment need not have been posted... (In any case, I'm totally mystified about why my own comment that includes that link and corrects the untrue statement about it not being possible possible to get certificates for IPs was deemed to offend someone's sensibilities. Surely the offense, if there is one, is in the comment that makes an outright, verifiably untrue claim?)
Rexxar 6y ago
Open doesn't imply it's easy.
auggierose 6y ago
The certificate management is the problem here. Let's say the server is running on 192.168.1.73, how do I get a certificate for that? On the next start of the app, the server might be running on 192.168.1.76, so I need another certificate for that. You see the problem? Also take into account that the entire infrastructure for solving that problem needs to run inside the iPad App, which needs to be accepted to the Apple store ...