3 ms·

I’m sure you’ve already heard of this, but for anyone who hasn’t: check out Gemini, a protocol and format (gemtext) that might appeal to users with this philoso

I’m sure you’ve already heard of this, but for anyone who hasn’t: check out Gemini, a protocol and format (gemtext) that might appeal to users with this philosophy.

1vuio0pswjnm7 5y ago
From gemini.circumlunar.space: "Overview Gemini is a new internet protocol which: Is heavier than gopher Is lighter than the web Will not replace either Strives for maximum power to weight ratio Takes user privacy very seriously" <--- Yet it REQUIRES user to send plaintext hostnames over the wire With HTTPS, sending the hostname in plaintext over the wire ("SNI") is a problem that can be worked around. However, per the Gemini protocol specification, SNI is mandatory, not optional, even when there is no virtual hosting. That is bad design. Does Gemini provide any workarounds. Why not. At present, I only need to send plaintext hostname over the wire for a minority of HTTPS sites. Most sites do not require it. One shared hosting provider, Cloudflare, even offers encrypted SNI, which works fine while encrypted Client Hello (ECH) is being finalised. AFAICT, the SNI problem will eventually be fixed in HTTPS. Making SNI mandatory, i.e., no option to disable it, is against the philosophy of user control. One of the reasons I use links and other non-graphical clients plus a local TLS proxy, instead using of a popular browser, is because the popular browsers do not permit the user to disable the sending of plaintext hostnames over the wire. Not all HTTPS sites require SNI, in fact most do not require it, yet popular browsers send hostnames in plaintext to every website. From a user perspective, that is stupid. Gemini is arguably worse because it codifies this stupidity into the protocol, thereby ensuring people will write clients that send hostnames in plaintext over the wire to every site and servers that will reject TLS negotiation without SNI. If there is only one Gemini site on an IP address, then it makes no sense to send the hostname in plaintext over the wire.

I’m sure you’ve already heard of this, but for anyone who hasn’t: check out Gemini, a protocol and format (gemtext) that might appeal to users with this philosophy.

1vuio0pswjnm7 5y ago

From gemini.circumlunar.space: "Overview Gemini is a new internet protocol which: Is heavier than gopher Is lighter than the web Will not replace either Strives for maximum power to weight ratio Takes user privacy very seriously" <--- Yet it REQUIRES user to send plaintext hostnames over the wire With HTTPS, sending the hostname in plaintext over the wire ("SNI") is a problem that can be worked around. However, per the Gemini protocol specification, SNI is mandatory, not optional, even when there is no virtual hosting. That is bad design. Does Gemini provide any workarounds. Why not. At present, I only need to send plaintext hostname over the wire for a minority of HTTPS sites. Most sites do not require it. One shared hosting provider, Cloudflare, even offers encrypted SNI, which works fine while encrypted Client Hello (ECH) is being finalised. AFAICT, the SNI problem will eventually be fixed in HTTPS. Making SNI mandatory, i.e., no option to disable it, is against the philosophy of user control. One of the reasons I use links and other non-graphical clients plus a local TLS proxy, instead using of a popular browser, is because the popular browsers do not permit the user to disable the sending of plaintext hostnames over the wire. Not all HTTPS sites require SNI, in fact most do not require it, yet popular browsers send hostnames in plaintext to every website. From a user perspective, that is stupid. Gemini is arguably worse because it codifies this stupidity into the protocol, thereby ensuring people will write clients that send hostnames in plaintext over the wire to every site and servers that will reject TLS negotiation without SNI. If there is only one Gemini site on an IP address, then it makes no sense to send the hostname in plaintext over the wire.