3 ms·

You're talking about implementations, I'm talking about specs. HTTP/1x != Windows XP. Advocating for older specs doesn't mean advocating for old insecure impl

• selfhoster11 5y ago
  If I can't establish a TLS connection, I can't get at the HTTP that's flowing over the encrypted pipe. It's pointless to split up HTTP and TLS/SSL when they were always deployed in lockstep anyway (unless you were happy with plaintext, or BYO encryption). If we imagine the HTTP+plaintext at one extreme, and HTTP+TLSv$latest at the other, a whole bunch of specs in the middle have effectively died out because nobody deploys them any more. Therefore, it's unfair to claim that "HTTP-over-TLS works fine across all versions of HTTP" (because it doesn't, unless you also support modern crypto), or that "HTTPS has been supported by browsers since 1994" (because the 1994 HTTPS is not even partly forwards-compatible with the 2022 HTTPS).
• AshamedCaptain 5y ago
  No, it is the standards/specs which are changing. E.g. today SSL/TLS almost universally means TLS 1.2 or 1.3. The SSL specs are no longer accepted by practically any server.
  • lucideer 5y ago
    I guess I should be more specific in my wording: I should have said "advocating for specific older specs" (i.e. HTTP). Not all older specs are worth advocating for. Security is unfortunately an arms race, which means that broadly speaking software-updates are important for anything network-connected. Using old hardware is thankfully still possible, but the idea of expecting a 12-year-old piece of software to securely connect you to the internet today is disconnected from the reality of the threat landscape we live in.