5 ms·
Does this mean we can finally go back to HTTP for connections that don't NEED to be secure without being attacked for it by security Nazis? Seriously, though,
by dublin 5y ago
Does this mean we can finally go back to HTTP for connections that don't NEED to be secure without being attacked for it by security Nazis?
Seriously, though, the far bigger problem is the need for better handling of certificates (often permanent) for embedded servers such as IoT devices. Cert management is still a huge and pretty much unfixable problem for real world deployments once you get outside the realm of propellerheads like us, and recognize that in the real world, "servers" often lack not just professional, competent administrators (which are required even by all current HTTPS solutions), but administrators, period.
- ziddoap 5y agoOr, you know, just don't use the optional browser extension?
- the_optimist 5y agoThese are two different topics. If you have ever dealt with back-end certificates you may better recognize the perspective to which you are responding.
- ziddoap 5y agoThe original post that I replied to only contained the first line regarding 'security Nazis'. The remainder was edited in after my comment. So, it was impossible for me to recognize the parent posters perspective. Thanks though.
- pornel 5y agoWe've been over this. It's not about the content of HTTP websites. It's the fact that every HTTP connection is a network-level vulnerability. It's like building a fortified castle and leaving a side door wide open for the maid. It's just a maid! Why does she need to have a bolted gate!?
- xg15 5y agoWhat is a "network-level vulnerability"?
- randomhodler84 5y agoI’ll provided an example: When the great firewall rewrites http reqs to inject malicious JavaScript to take down GitHub. See “great cannon incident”. Http is a network level vuln, it allows clients to be hijacked by a mitm. It is totally unacceptable.
- robbedpeter 5y agoCisco osi model levels/layers 1 to 7: physical, data link, network, transport, session, presentation, application. Port numbering is a transport layer feature, so it's technically a transport level / layer 4 vulnerability, not network.
- alephu5 5y agoIt's trivial to do public certs with acme.sh, caddy, or certbot so you might as well. For most private networks I think it's fine to use plain HTTP.