4 ms·

I presume when you say "device" you actually mean software. HTTPS can absolutely run on devices from 25 years ago. Expecting network-connected clients to work

I presume when you say "device" you actually mean software. HTTPS can absolutely run on devices from 25 years ago. Expecting network-connected clients to work securely without software updates for even a few months these days though isn't really possible, but that's down to the externalities of the world and has nothing to do with spec design.

Brian_K_White 5y ago
The mechanism by which https rendered the old device inoperable does not change the fact that https rendered the old device inoperable. One may argue that the problem is essentially unavoidable because the alternative is untenable (delivering any sort of communication without both encryption and authentication to ensure the veracity of the data) but that doesn't make the observation any less true. https is in fact a pain in the ass and introduces a lot of overhead and grief and shortened the useful life of countless things, relative to the time before https.
- lucideer 5y ago
  > The mechanism by which https rendered the old device inoperable does not change the fact that https rendered the old device inoperable This is one of those many cases on the internet where people make an unfounded statement and then just move on as if it's accepted as true. How does the mechanism not change the fact??? The mechanism in this case is outdated software; upgrading or changing the software on the device makes the device operable (you absolutely can install modern TLS on Windows XP, alternatively you could also install a modern OS on most devices that came with Windows XP). That fact seems to make the mechanism extremely relevant in whether the device is operable.
  - AshamedCaptain 5y ago
    The point is that this makes HTTPS effectively NOT "built to last". The underlying layers keep changing and therefore requires changes to clients. Compare HTTP. Or even IPv4, which still works to this day, with the same software & hardware combination.
    - lucideer 5y ago
      You seem to be redefining the "built to last" to encapsulate backward compat, which is an odd definition, but let's go with it. The only aspect of HTTPS that isn't backward compatible in the way you're talking about is, effectively, the algorithms keeping up with modern attack vectors. That's not an aspect of HTTPS the spec, it's an aspect of the arms race in network security. So pinning this issue on HTTPS is odd. The reason you can't use outdated software to connect to modern servers isn't due to protocol design, it's due to threat actors.
      - AshamedCaptain 5y ago
        > You seem to be redefining the "built to last" to encapsulate backward compat, which is an odd definition, but let's go with it. What other definition there is? A protocol that has absolutely no backward compatibility, not even with itself, and by design, is "built to last"? Or that a protocol that is frequently rewriting its core algorithms in its base specs is "built to last" ? > That's not an aspect of HTTPS the spec, it's an aspect of the arms race in network security. It is an aspect of the spec. There is literally no HTTPS without SSL/TLS. If there was, you could have an argument there, but: the very definition of HTTPS is "HTTP + SSL". Really, there is no color. Ethernet, IP, HTTP still allow an unmodified client from 25 years ago to work with practically full functionality. HTTPS does not. Whether this is because HTTPS has more ambitious goals (which it obviously has), or whether the designers were smoking something better, or because computer security requires an arms race (that's another debate), the effective result is that HTTPS is not built to last. Everything you build on top of it will require continuous rearchitecturing every couple of years. And I'm not talking about changing some certificates or the like. I am talking spec changes. I'm talking most of the algorithms having changed significantly. Or maybe TLS 1.3 will be the good one this time. Who knows.
forgotmypw17 5y ago
>HTTPS can absolutely run on devices from 25 years ago. This is largely not true, if you want to talk to today's servers. Unlike HTTP, SSL is not cross-compatible with older versions.
- lucideer 5y ago
  You can install modern up-to-date TLS software on a 25yo device. I was making the distinction between hardware and software support.
  - AshamedCaptain 5y ago
    That is quite the assertion... Care to try installing "up-to-date TLS" on a EPOC32 device?
    - lucideer 5y ago
      It certainly would be quite the assertion if one were to choose to interpret "a 25yo device" to mean "any 25yo device", but doing so would be obviously ridiculous.
  - forgotmypw17 5y ago
    I don't think it's possible with even conveniently emulated Windows 95, 98, ME,... I would be happy to be proven wrong. And that is about as mainstream a device as you can get.

Brian_K_White 5y ago

The mechanism by which https rendered the old device inoperable does not change the fact that https rendered the old device inoperable. One may argue that the problem is essentially unavoidable because the alternative is untenable (delivering any sort of communication without both encryption and authentication to ensure the veracity of the data) but that doesn't make the observation any less true. https is in fact a pain in the ass and introduces a lot of overhead and grief and shortened the useful life of countless things, relative to the time before https.

lucideer 5y ago
> The mechanism by which https rendered the old device inoperable does not change the fact that https rendered the old device inoperable This is one of those many cases on the internet where people make an unfounded statement and then just move on as if it's accepted as true. How does the mechanism not change the fact??? The mechanism in this case is outdated software; upgrading or changing the software on the device makes the device operable (you absolutely can install modern TLS on Windows XP, alternatively you could also install a modern OS on most devices that came with Windows XP). That fact seems to make the mechanism extremely relevant in whether the device is operable.
- AshamedCaptain 5y ago
  The point is that this makes HTTPS effectively NOT "built to last". The underlying layers keep changing and therefore requires changes to clients. Compare HTTP. Or even IPv4, which still works to this day, with the same software & hardware combination.
  - lucideer 5y ago
    You seem to be redefining the "built to last" to encapsulate backward compat, which is an odd definition, but let's go with it. The only aspect of HTTPS that isn't backward compatible in the way you're talking about is, effectively, the algorithms keeping up with modern attack vectors. That's not an aspect of HTTPS the spec, it's an aspect of the arms race in network security. So pinning this issue on HTTPS is odd. The reason you can't use outdated software to connect to modern servers isn't due to protocol design, it's due to threat actors.
    - AshamedCaptain 5y ago
      > You seem to be redefining the "built to last" to encapsulate backward compat, which is an odd definition, but let's go with it. What other definition there is? A protocol that has absolutely no backward compatibility, not even with itself, and by design, is "built to last"? Or that a protocol that is frequently rewriting its core algorithms in its base specs is "built to last" ? > That's not an aspect of HTTPS the spec, it's an aspect of the arms race in network security. It is an aspect of the spec. There is literally no HTTPS without SSL/TLS. If there was, you could have an argument there, but: the very definition of HTTPS is "HTTP + SSL". Really, there is no color. Ethernet, IP, HTTP still allow an unmodified client from 25 years ago to work with practically full functionality. HTTPS does not. Whether this is because HTTPS has more ambitious goals (which it obviously has), or whether the designers were smoking something better, or because computer security requires an arms race (that's another debate), the effective result is that HTTPS is not built to last. Everything you build on top of it will require continuous rearchitecturing every couple of years. And I'm not talking about changing some certificates or the like. I am talking spec changes. I'm talking most of the algorithms having changed significantly. Or maybe TLS 1.3 will be the good one this time. Who knows.

forgotmypw17 5y ago

>HTTPS can absolutely run on devices from 25 years ago. This is largely not true, if you want to talk to today's servers. Unlike HTTP, SSL is not cross-compatible with older versions.

lucideer 5y ago
You can install modern up-to-date TLS software on a 25yo device. I was making the distinction between hardware and software support.
- AshamedCaptain 5y ago
  That is quite the assertion... Care to try installing "up-to-date TLS" on a EPOC32 device?
  - lucideer 5y ago
    It certainly would be quite the assertion if one were to choose to interpret "a 25yo device" to mean "any 25yo device", but doing so would be obviously ridiculous.
- forgotmypw17 5y ago
  I don't think it's possible with even conveniently emulated Windows 95, 98, ME,... I would be happy to be proven wrong. And that is about as mainstream a device as you can get.