8 ms·
I'm talking about the general state of HTTPS implantation. If you develop an offline device which offers a web UI, and it happens to use any feature that is dee
by j1elo 6y ago
I'm talking about the general state of HTTPS implantation. If you develop an offline device which offers a web UI, and it happens to use any feature that is deemed to require a Secure Context, you're out of luck.
WebRTC is such a feature, but there are lots more, and they can change from one version of the browser to the next one.
The players who are pushing so hard to shove HTTPS down our throats are simply closing their eyes and ignoring the use cases that are not interesting to them. The mandatory renewal timing is a good example: it used to be more than 1 year, now it is 90 days (and some would like to reduce it to mere weeks!) Absolutely great for the grand scheme of things and global security of the Internet, but dismaying for lots of other use cases.
- dcow 6y agoYeah, I think we need a browser that isn't developed by companies with vested interests in having all your traffic go to them...
- spurgu 6y agoThen again I think Google would do just fine even if Firefox was the only browser.
- Wowfunhappy 6y agoI don't actually see the problem. If you're on a local network, there's no practical way to deal with certificates, so use http. Chrome will fall back. Problem solved. If http support ever gets truly removed, I will be very upset. But that hasn't happened, so what is there to complain about?
- simias 6y agoHTTP is effectively considered legacy by the big web actors these days. More and more APIs are HTTPS-only (often for good reasons) and the "insecure" warnings you get from using HTTP become more intrusive every year. The trajectory is pretty clear, the long term plan is to phase out HTTP completely. And I'm not against it, but I need a solution for LAN devices, and it doesn't exist at the moment because the big web actors do everything in the cloud these days and they don't care about this use case.
- forgotmypw17 6y agoI AM against it, because it puts more centralized censorship power in the hands of the certificate authority. Also, it completely cuts out "legacy" devices, basically anything more than 5 years old. The Web is once again splitting into AOLized mainstream and "indie underground" that you have to make an effort to access.
- chc 6y agoWho is "the certificate authority" you're referring to here?
- jussij 6y agoThe OP means that in using https (and being forced to used https) you are also being forced into paying a 'third party' an annual fee just to get a valid certificate. That 'third party' is one of the recognized 'certificate authorities'. But the OPs point is by going https, you don't have a choice, you have to pay the certificate tax.
- jjoonathan 6y agoRight, and Let's Encrypt doesn't solve the problem, it just kicks the can to DNS, which is globally unique and costs money. Communicating between your computer and any device that you supposedly own without the slow, unnecessary, and increasingly intrusive permission of some cloud IoT stack will become more and more difficult.
- deleted 6y ago[deleted]
- isignal 6y agoThis is not true, you can set your host to trust a self signed certificate without much difficulty. Check out this tool for example https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert (prev discussion at https://news.ycombinator.com/item?id=17748208 https://news.ycombinator.com/item?id=17748208)
- Jarwain 6y agoThe problem is that there is no way to deal with certs on a local network, but the OP would like to be able to use https anyways; http might be considered too insecure for their usecase
- rcdwealth 6y agoMake your own CA, install on each computer, install certificates, voila.
- tsimionescu 6y agoRepeat every 3 months or whenever the root certs expire.
- jodrellblank 6y ago3 months? I must have updated FireFox / Discord / VS Code /etc. about a hundred times in last 3 months. Plenty for them to add renewed SSL whatevers inside one of the updates.
- Wowfunhappy 6y ago> 3 months? I must have updated FireFox / Discord / VS Code /etc. I think this state of affairs is nuts. With the exception of Firefox, because web browsers have an inordinate number of security issues to contend with.
- throwaway53453 6y agoAnd other programs don't?
- Wowfunhappy 6y agoAn instant messaging client shouldn’t be executing arbitrary remote code, no.
- cyc116 6y agoHTTP does not solve the problem if you still want your traffic encrypted in transit.
- bpye 6y agoSelf-signed certificates seem reasonable in this context - unless I’m missing something.
- tsimionescu 6y agoThey might to you, but the browser doesn't agree. It will scream with all its force to all your users that this accessing that product is a really really dangerous idea.
- chpatrick 6y agoYou can set up the users' machines so that they trust your certificate.
- heinrichhartman 6y agoI have tried to do just that but ran into all kinds of difficulties: 1. Overhead: I have 5 devices that I own 3 of my wife and a smart TV. Setting all this us takes a lot of time, even if it worked fine. 2. What about visitors to my home, that I want to give access? They need the cert as well together with lengthy instructions on how to install it. 3. How do I even install certs on an iPhone? 4. Firefox uses it's own Certificate Database -- for each profile. So I'll have to install certs on the system AND on the host (for e.g. Chrome to find it). 5. All these steps need to be repeated every year (90 days?!) depending on the cert expiration period. Eventually I just gave up on this. It's not practical. There needs to be a better solution.
- spockz 6y agoI have been looking at using MDM for my iPhone so I can install trusted root certs and require it to be on vpn when not using a specific list of WiFi networks. It is a hassle and as far as I could see it requires resetting the device and I’m not sure I can restore my backup over it and retain both.
- zaarn 6y ago