6 ms·

Is there a reason he doesn't have HTTPS on his site? Firefox throws up a giant warning when I try to visit.

mistrial9 5y ago
side note - I have some misc content that is http today in 2021 - I feel that the original HTML spec is better than modern web in some ways, therefore I like sticking to http here and there, when I chose, based on first principles
- yjftsjthsd-h 5y ago
  Old HTML might be fine, but sending it over an insecure connection isn't.
  - rsj_hn 5y ago
    These words "secure" and "insecure" when used as synonyms for "encrypted" and "plaintext" obscure more than they illuminate and have done a lot of damage to the world of software security. They stop thought. You would not believe how many times I've talked to a company with some complex webapp and asked for their security policy and they respond with some statement about using TLS. It's absurd. Then even in books or standards, you are starting to see chapters called "security/cryptography". As if encrypting something was a type of security pixie dust. I am not trying to relitigate the battle of SSL's naming scheme, that battle was lost, and now people associate "security" with encryption. Who knows, maybe in the future they will associate "security" with bitcoin. But it's certainly not true that every plaintext connection is an insecure connection in the sense of actual security. Not everything needs to be or should be encrypted, and many things obtain no benefit whatsoever from being encrypted.
    - rgj 5y ago
      In TLS context, “secure” and “insecure” don’t just mean (un)encrypted, but also whether the connection is authenticated, i.e. whether you can be fairly sure you’re looking at the “real” website. This is a far more important property of a site using https. Especially in a world full of disinformation, authenticity and integrity of information are often a much greater good than confidentiality.
      - rsj_hn 5y ago
        I understand what TLS does, but an argument that "we live in a world of disinformation" is not a substitute for having a well defined threat model and for many websites, particularly sites that broadcast information or download binaries which might already be signed or have hashes distributed via alternate means, there does not need to be a threat that requires TLS to address it. Like it or not, it is up to the information owner to determine their threat model and which mitigations are suitable for that threat model. If someone is broadcasting a message containing information that is public, they may not consider someone intercepting a response and altering it to be a threat that needs addressing, or they may consider alternate mitigations as sufficient -- e.g. the fact that many people can independently verify the information from different sources. For the vast majority of sites, this is a reasonable assumption. Just because you may be worried about this threat doesn't mean the information owner needs to be. Of course you as an information consumer have your own threat model, and if you are really worried about someone targeting you and altering http responses sent to your browser, then you may not want to visit unencrypted sites. That is also legitimate. The information owner can't force their threat model on you anymore than you can force yours on them. But words like "secure" and "insecure" make sense only with respect to a given threat model, they are not attributes of an http connection.
        enzanki_ars 5y ago
        Like others have said, I agree that stating that TLS does not garuntee security. But, plain unencrypted HTTP does mean insecure. For a good discussion into why _all_ websites should use HTTPS, and the many different ways that not having the connection secured is actively harmful and why should not be done in the modern era. https://www.troyhunt.com/heres-why-your-static-website-needs https://www.troyhunt.com/heres-why-your-static-website-needs... Not having your site as HTTPS puts all of your website visitors at risk. Even US ISPs like that of Comcast use these very same practices to inject warnings into insecure web traffic[0], some of which look more like advertisements than warnings. And like mentioned in the article, promises from ISPs not to use it for advertisements are just that, promises, and those can be broken in an instant. And when you have the power to inject anything without notice, you can do anything and everything with the website experience. You can attempt to force a download, present scam pages that look like antivirus warnings or software updates, one of the easiest ways to have users fall for malware. We should _never_ expect regular non-technical users to have all of their threat models in mind, nor should they be expected to understand all of these differences. Website owners should be expected to protect all of their visitors as best as possible and one of the easiest ways to start is by protecting their website with modern HTTPS encryption. Otherwise, it would be like a chef leaving the bones in a salmon before serving to a customer. You could do leave them in, but a customer might not know they are there and you have left a choking hazard. [0]: https://gizmodo.com/comcast-to-customer-who-noticed-it-secre https://gizmodo.com/comcast-to-customer-who-noticed-it-secre...
    - orf 5y ago
      In the era of instant, free and stupidly easy to configure TLS certificates why not just serve it over HTTPS?
      - rsj_hn 5y ago
        It's definately easier nowadays to do it, but you still have the issue of services becoming unavailable because certs expired - something that routinely happens, so it adds some operational overhead that - in the examples I described -- provides no benefit. This operational complexity is there even if the certs themselves are free. More importantly, security theater is something that should be avoided as it creates bad habits and promotes irreality in a field already rife with the same. I'm not sure why cryptography struggles so much with this, but there are a lot of people who don't understand what benefits, if any, cryptography provides to their application but decide to add it in anyways. This should be considered a bad practice. Imagine if someone told you to add a function to a codebase just because other codebases had it, and what harm can it do, even if this function served no purpose and doesn't require too many CPU cycles. Most software developers would oppose the idea, they would want to add code only when it is needed, and would favor the removal of unneeded code as beneficial, given that this simplifies the codebase. The same is true for encryption, which requires a lot of CPU cycles, and adds non-trivial complexity. So the idea that it should be added everywhere even where it's not needed is something we should resist.
        orf 5y ago
        In the time it took you to write this reply you could have set up an auto-renewing certificate for your site with let’s encrypt. Or you could have pressed a button and have it served behind cloudflare. The nuance of if encryption is really required in this specific case is pointless when it is so easy and readily available. The effective direction becomes “just blanket serve everything over HTTPS” because there isn’t much downside.
        mistrial9 5y ago
        >auto-renewing my super-smart and hardworking admins just lost a dozen services over the weekend because one of the hundred "easy" certs they manage expired, was not refreshed for whatever reasons, and the node happened to be an LDAP services node. at some point, "easy" and "instant" becomes "needs constant attention"
    - yjftsjthsd-h 5y ago
      I'm happy to agree that TLS doesn't guarantee security, but plaintext HTTP does guarantee insecurity.
      - deleted 5y ago
        [deleted]
yellow_lead 5y ago
Many read only sites don't have HTTPS. Firefox and other browsers are at fault for saying it's insecure.
- enzanki_ars 5y ago
  For a good discussion into why _all_ websites should use HTTPS, I'd highly recommend this article. https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs... Not having your site as HTTPS puts all of your readers at risk. Even US ISPs like that of Comcast use this very same practice to inject warnings into insecure web traffic[0]. And like mentioned in the article, promises from ISPs not to use it for advertisements are just that, promises, and those can be broken in an instant. [0]: https://gizmodo.com/comcast-to-customer-who-noticed-it-secretly-injecting-c-1821235362 https://gizmodo.com/comcast-to-customer-who-noticed-it-secre...
  - enriquto 5y ago
    This article is controversial and shows a distorted and incomplete point of view. For example, https sites are more vulnerable to some types of censorship. A CA can censor your site by unilaterally revoking your certificate. It routinely happens already. Promises from CAs not to censor you are just that, promises, and those can be broken in an instant.
tcgv 5y ago
I actually sent him a cold e-mail in Nov/2020 on that matter to which he promptly replied (in less than 1h) that his site "just doesn't have https". So he's aware of that. IMHO it'd be a small effort for improving his readers experience (and security).
- gambiting 5y ago
  I'm genuinely curious - how? On both of these points. It's just a simple text page, why would this ever need https at all?
  - LgWoodenBadger 5y ago
    How do you know what you read is actually what pg wrote?
    - gambiting 5y ago
      I don't know, how do you know someone hasn't hacked into his server and changed the text there even if he had HTTPS? There are things to worry about, and there is a simple text blog not using HTTPS.
      - tcgv 5y ago
        It's much easier to intercept and tamper with non encrypted network communication than to hack into a server.
  - tcgv 5y ago
    Two things, first readers wouldn't receive that browser security warning (which is a bad experience) and second the transmitted content wouldn't be vulnerable to manipulation (such as ISPs injecting adds or attackers trying to deceive you).
ilaksh 5y ago
The reasons to use HTTPS on a blog or everywhere regardless of whether there is data that needs to be secured are mainly to fight against things like censorship or ISP surveillance. If you really don't think your website is going to be censored, that leaves the problem of ISPs injecting content. Maybe he doesn't feel that is a big problem, or that there is another way to fight it. The big push for everything to be https is about making it hard for governments or ISPs to say that some site or another should be an exception. It's kind of like, wearing masks.. before the policy was that everyone should wear a mask, best to keep it simple and not try to make exceptions that way we will get the most adoption.. except for sites like this, it's like you never actually talk, and have been vaccinated so you are not worried about catching anything and don't wear a mask. The other part of this is that for people like me who have been serving http for so many years, the campaign for https just doesn't hit as hard as for young people who really grew up with that mindset being preached to them constantly. But in the end, I think that it is better if everyone does it. Just maybe not quite as severe a problem as you think if a few people slip through the cracks.

side note - I have some misc content that is http today in 2021 - I feel that the original HTML spec is better than modern web in some ways, therefore I like sticking to http here and there, when I chose, based on first principles

yjftsjthsd-h 5y ago
Old HTML might be fine, but sending it over an insecure connection isn't.
- rsj_hn 5y ago
  These words "secure" and "insecure" when used as synonyms for "encrypted" and "plaintext" obscure more than they illuminate and have done a lot of damage to the world of software security. They stop thought. You would not believe how many times I've talked to a company with some complex webapp and asked for their security policy and they respond with some statement about using TLS. It's absurd. Then even in books or standards, you are starting to see chapters called "security/cryptography". As if encrypting something was a type of security pixie dust. I am not trying to relitigate the battle of SSL's naming scheme, that battle was lost, and now people associate "security" with encryption. Who knows, maybe in the future they will associate "security" with bitcoin. But it's certainly not true that every plaintext connection is an insecure connection in the sense of actual security. Not everything needs to be or should be encrypted, and many things obtain no benefit whatsoever from being encrypted.
  - rgj 5y ago
    In TLS context, “secure” and “insecure” don’t just mean (un)encrypted, but also whether the connection is authenticated, i.e. whether you can be fairly sure you’re looking at the “real” website. This is a far more important property of a site using https. Especially in a world full of disinformation, authenticity and integrity of information are often a much greater good than confidentiality.
    - rsj_hn 5y ago
      I understand what TLS does, but an argument that "we live in a world of disinformation" is not a substitute for having a well defined threat model and for many websites, particularly sites that broadcast information or download binaries which might already be signed or have hashes distributed via alternate means, there does not need to be a threat that requires TLS to address it. Like it or not, it is up to the information owner to determine their threat model and which mitigations are suitable for that threat model. If someone is broadcasting a message containing information that is public, they may not consider someone intercepting a response and altering it to be a threat that needs addressing, or they may consider alternate mitigations as sufficient -- e.g. the fact that many people can independently verify the information from different sources. For the vast majority of sites, this is a reasonable assumption. Just because you may be worried about this threat doesn't mean the information owner needs to be. Of course you as an information consumer have your own threat model, and if you are really worried about someone targeting you and altering http responses sent to your browser, then you may not want to visit unencrypted sites. That is also legitimate. The information owner can't force their threat model on you anymore than you can force yours on them. But words like "secure" and "insecure" make sense only with respect to a given threat model, they are not attributes of an http connection.
      - enzanki_ars 5y ago
        Like others have said, I agree that stating that TLS does not garuntee security. But, plain unencrypted HTTP does mean insecure. For a good discussion into why _all_ websites should use HTTPS, and the many different ways that not having the connection secured is actively harmful and why should not be done in the modern era. https://www.troyhunt.com/heres-why-your-static-website-needs https://www.troyhunt.com/heres-why-your-static-website-needs... Not having your site as HTTPS puts all of your website visitors at risk. Even US ISPs like that of Comcast use these very same practices to inject warnings into insecure web traffic[0], some of which look more like advertisements than warnings. And like mentioned in the article, promises from ISPs not to use it for advertisements are just that, promises, and those can be broken in an instant. And when you have the power to inject anything without notice, you can do anything and everything with the website experience. You can attempt to force a download, present scam pages that look like antivirus warnings or software updates, one of the easiest ways to have users fall for malware. We should _never_ expect regular non-technical users to have all of their threat models in mind, nor should they be expected to understand all of these differences. Website owners should be expected to protect all of their visitors as best as possible and one of the easiest ways to start is by protecting their website with modern HTTPS encryption. Otherwise, it would be like a chef leaving the bones in a salmon before serving to a customer. You could do leave them in, but a customer might not know they are there and you have left a choking hazard. [0]: https://gizmodo.com/comcast-to-customer-who-noticed-it-secre https://gizmodo.com/comcast-to-customer-who-noticed-it-secre...
  - orf 5y ago
    In the era of instant, free and stupidly easy to configure TLS certificates why not just serve it over HTTPS?
    - rsj_hn 5y ago
      It's definately easier nowadays to do it, but you still have the issue of services becoming unavailable because certs expired - something that routinely happens, so it adds some operational overhead that - in the examples I described -- provides no benefit. This operational complexity is there even if the certs themselves are free. More importantly, security theater is something that should be avoided as it creates bad habits and promotes irreality in a field already rife with the same. I'm not sure why cryptography struggles so much with this, but there are a lot of people who don't understand what benefits, if any, cryptography provides to their application but decide to add it in anyways. This should be considered a bad practice. Imagine if someone told you to add a function to a codebase just because other codebases had it, and what harm can it do, even if this function served no purpose and doesn't require too many CPU cycles. Most software developers would oppose the idea, they would want to add code only when it is needed, and would favor the removal of unneeded code as beneficial, given that this simplifies the codebase. The same is true for encryption, which requires a lot of CPU cycles, and adds non-trivial complexity. So the idea that it should be added everywhere even where it's not needed is something we should resist.
      - orf 5y ago
        In the time it took you to write this reply you could have set up an auto-renewing certificate for your site with let’s encrypt. Or you could have pressed a button and have it served behind cloudflare. The nuance of if encryption is really required in this specific case is pointless when it is so easy and readily available. The effective direction becomes “just blanket serve everything over HTTPS” because there isn’t much downside.
        mistrial9 5y ago
        >auto-renewing my super-smart and hardworking admins just lost a dozen services over the weekend because one of the hundred "easy" certs they manage expired, was not refreshed for whatever reasons, and the node happened to be an LDAP services node. at some point, "easy" and "instant" becomes "needs constant attention"
  - yjftsjthsd-h 5y ago
    I'm happy to agree that TLS doesn't guarantee security, but plaintext HTTP does guarantee insecurity.
    - deleted 5y ago
      [deleted]

yellow_lead 5y ago

Many read only sites don't have HTTPS. Firefox and other browsers are at fault for saying it's insecure.

enzanki_ars 5y ago
For a good discussion into why _all_ websites should use HTTPS, I'd highly recommend this article. https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs... Not having your site as HTTPS puts all of your readers at risk. Even US ISPs like that of Comcast use this very same practice to inject warnings into insecure web traffic[0]. And like mentioned in the article, promises from ISPs not to use it for advertisements are just that, promises, and those can be broken in an instant. [0]: https://gizmodo.com/comcast-to-customer-who-noticed-it-secretly-injecting-c-1821235362 https://gizmodo.com/comcast-to-customer-who-noticed-it-secre...
- enriquto 5y ago
  This article is controversial and shows a distorted and incomplete point of view. For example, https sites are more vulnerable to some types of censorship. A CA can censor your site by unilaterally revoking your certificate. It routinely happens already. Promises from CAs not to censor you are just that, promises, and those can be broken in an instant.

tcgv 5y ago

I actually sent him a cold e-mail in Nov/2020 on that matter to which he promptly replied (in less than 1h) that his site "just doesn't have https". So he's aware of that. IMHO it'd be a small effort for improving his readers experience (and security).

gambiting 5y ago
I'm genuinely curious - how? On both of these points. It's just a simple text page, why would this ever need https at all?
- LgWoodenBadger 5y ago
  How do you know what you read is actually what pg wrote?
  - gambiting 5y ago
    I don't know, how do you know someone hasn't hacked into his server and changed the text there even if he had HTTPS? There are things to worry about, and there is a simple text blog not using HTTPS.
    - tcgv 5y ago
      It's much easier to intercept and tamper with non encrypted network communication than to hack into a server.
- tcgv 5y ago
  Two things, first readers wouldn't receive that browser security warning (which is a bad experience) and second the transmitted content wouldn't be vulnerable to manipulation (such as ISPs injecting adds or attackers trying to deceive you).

ilaksh 5y ago

The reasons to use HTTPS on a blog or everywhere regardless of whether there is data that needs to be secured are mainly to fight against things like censorship or ISP surveillance. If you really don't think your website is going to be censored, that leaves the problem of ISPs injecting content. Maybe he doesn't feel that is a big problem, or that there is another way to fight it. The big push for everything to be https is about making it hard for governments or ISPs to say that some site or another should be an exception. It's kind of like, wearing masks.. before the policy was that everyone should wear a mask, best to keep it simple and not try to make exceptions that way we will get the most adoption.. except for sites like this, it's like you never actually talk, and have been vaccinated so you are not worried about catching anything and don't wear a mask. The other part of this is that for people like me who have been serving http for so many years, the campaign for https just doesn't hit as hard as for young people who really grew up with that mindset being preached to them constantly. But in the end, I think that it is better if everyone does it. Just maybe not quite as severe a problem as you think if a few people slip through the cracks.