5 ms·

Aa I recall, people didn't say it was an unnecessary burden, they said it breaks home labs.

by gowld 6y ago

wnevets 6y ago
I recall folks on HN and else where claim static websites don't need https.
- Crontab 6y ago
  I've held that opinion and I was wrong.
  - namibj 6y ago
    I still hold that opinion, though reduced to situations where there are other ways than full-blown TLS to get authenticity. Due to a lack of options for putting signing pubkeys into DNS or something like that, this requires the loaded page itself to be delivered over TLS. Bulk content can rely on subresource integrity, but may need a fall back on TLS to successfully load the content in the presence of MITM. This fallback can likely be done via a small script, either inline or also served via TLS.
    - Anunayj 6y ago
      > Due to a lack of options for putting signing pubkeys into DNS or something like that Yes and there is https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na... for that! We just need community to adopt it, and move away from the mess of a system CAs are.
      - namibj 6y ago
        No, that's for putting TLS pubkeys into DNS. I'm complaining about a lack of support for signing keys. Think IPFS's IPNS (though that goes a bit beyond just signing keys, as it includes DHT-based retrieval with just the key (and notably lacking an address).
SilverRed 6y ago
Nope, there was certainly a lot saying that you only need TLS on login pages and sensitive data pages. And that even sites with login and payment pages are ok to use http on the rest of the site.
walrus01 6y ago
My home lab has its own openssl x.509 root CA, which issues TLS certs for all my stuff in rfc1918 IP space. I've trusted the CA in my browsers. It wasn't rocket science to set up.
- Anunayj 6y ago
  Hmm is just grabbing a domain name and pointing subdomains to internal IP address bad idea? Cause that's what I do and I thought everyone did this.

Aa I recall, people didn't say it was an unnecessary burden, they said it breaks home labs.

by gowld 6y ago

Aa I recall, people didn't say it was an unnecessary burden, they said it breaks home labs.

wnevets 6y ago

I recall folks on HN and else where claim static websites don't need https.

Crontab 6y ago
I've held that opinion and I was wrong.
- namibj 6y ago
  I still hold that opinion, though reduced to situations where there are other ways than full-blown TLS to get authenticity. Due to a lack of options for putting signing pubkeys into DNS or something like that, this requires the loaded page itself to be delivered over TLS. Bulk content can rely on subresource integrity, but may need a fall back on TLS to successfully load the content in the presence of MITM. This fallback can likely be done via a small script, either inline or also served via TLS.
  - Anunayj 6y ago
    > Due to a lack of options for putting signing pubkeys into DNS or something like that Yes and there is https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na... for that! We just need community to adopt it, and move away from the mess of a system CAs are.
    - namibj 6y ago
      No, that's for putting TLS pubkeys into DNS. I'm complaining about a lack of support for signing keys. Think IPFS's IPNS (though that goes a bit beyond just signing keys, as it includes DHT-based retrieval with just the key (and notably lacking an address).

SilverRed 6y ago

Nope, there was certainly a lot saying that you only need TLS on login pages and sensitive data pages. And that even sites with login and payment pages are ok to use http on the rest of the site.

walrus01 6y ago

My home lab has its own openssl x.509 root CA, which issues TLS certs for all my stuff in rfc1918 IP space. I've trusted the CA in my browsers. It wasn't rocket science to set up.

Anunayj 6y ago
Hmm is just grabbing a domain name and pointing subdomains to internal IP address bad idea? Cause that's what I do and I thought everyone did this.