5 ms·
HTTP is effectively considered legacy by the big web actors these days. More and more APIs are HTTPS-only (often for good reasons) and the "insecure" warnings y
by simias 6y ago
HTTP is effectively considered legacy by the big web actors these days. More and more APIs are HTTPS-only (often for good reasons) and the "insecure" warnings you get from using HTTP become more intrusive every year.
The trajectory is pretty clear, the long term plan is to phase out HTTP completely. And I'm not against it, but I need a solution for LAN devices, and it doesn't exist at the moment because the big web actors do everything in the cloud these days and they don't care about this use case.
- forgotmypw17 6y agoI AM against it, because it puts more centralized censorship power in the hands of the certificate authority. Also, it completely cuts out "legacy" devices, basically anything more than 5 years old. The Web is once again splitting into AOLized mainstream and "indie underground" that you have to make an effort to access.
- chc 6y agoWho is "the certificate authority" you're referring to here?
- jussij 6y agoThe OP means that in using https (and being forced to used https) you are also being forced into paying a 'third party' an annual fee just to get a valid certificate. That 'third party' is one of the recognized 'certificate authorities'. But the OPs point is by going https, you don't have a choice, you have to pay the certificate tax.
- jjoonathan 6y agoRight, and Let's Encrypt doesn't solve the problem, it just kicks the can to DNS, which is globally unique and costs money. Communicating between your computer and any device that you supposedly own without the slow, unnecessary, and increasingly intrusive permission of some cloud IoT stack will become more and more difficult.
- deleted 6y ago[deleted]
- isignal 6y agoThis is not true, you can set your host to trust a self signed certificate without much difficulty. Check out this tool for example https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert (prev discussion at https://news.ycombinator.com/item?id=17748208 https://news.ycombinator.com/item?id=17748208)
- colejohnson66 6y agoSelf signing doesn’t let the world access my website without some scary warning.
- rblatz 6y agoThat’s irrelevant to this discussion about hosting sites on a LAN with no internet access. If you need https on the public internet you need a trusted cert.
- bildung 6y agoDon't think personal LAN, think e.g. industrial automation: Many sensible companies want modern sensor systems that provide REST APIs and so on, but don't want those to access the internet. The hosts in this case often are appliance-like devices from third parties.
- colejohnson66 6y agoBut that’s my point, and many others’. Sure, we can self sign, but it’s useless for the WWW. You’re forced to pay up to one of the few certificate providers. Thankfully, Let’s Encrypt has made it free and easier, but it’s not a no-brainer.
- midasuni 6y agoI would like to trust a given root very for only a specific domain (and sub domain) I.e *.int.mycorp.com, but not www.mybank.com Browsers don’t let me do that, it’s either app or nothing. X509 name constraints aren’t great either and don’t give me, the browser operator, the power.
- RupertEisenhart 6y agoLetsencrypt provide a really good service. I can recommend the docker image made by linuxserver in particular [0]. Makes Https a (tax free) breeze. [0] https://docs.linuxserver.io/general/swag https://docs.linuxserver.io/general/swag
- Cyberspy 6y agoThat's OK then, if that's we all have to do to run any devices inside our LAN/home network. Want a NAS box for sharing family files/photos or some other IoT device at home? Just set yourself up some other device to run the docker image, get your self a certificate from LetsEncrypt and then... install it on the NAS box? How does that happen?
- forgotmypw17 6y agoThe authority who grants you your SSL certificate. There is more than one out there, sure, but you can't do it without them. And ultimately, they all answer to the same authority above them: the browser maker who populates the root trust store. So, to summarize: one more way for the browser maker to control what the user can and cannot access without jumping through hoops.
- tomcooks 6y agoPerfect time to radicalize the underground (say by beginning to experiment with Gemini or other protocols), the mainstream as usual only knows how to follow
- forgotmypw17 6y agoI prefer HTTP :)
- kstrauser 6y agoGemini requires TLS 1.2 or higher.
- yakubin 6y agoBut it doesn't rely on CAs. It relies on TOFU.
- netik 6y agoLet’s encrypt exists, your argument is moot.
- nec4b 6y agoCan you use it on a microcontroller in a home network?