6 ms·

I got to say you're spot on. Keeping things working is no challenge looks at his commodores. Keeping them relevant is more of a challenge, this is one reason I

by dusted 5y ago

I got to say you're spot on. Keeping things working is no challenge looks at his commodores. Keeping them relevant is more of a challenge, this is one reason I hate to see people forcing redirects to HTTPS, it's just great and dandy that modern browsers suggest this to users (as long as they don't force), but for vast vast amounts of information, in the free world, you shouldn't force people into always-encrypted. There is zero good reason I shouldn't be able to choose to read Wikipedia unencrypted. And I can do that on pretty much any machine that can somehow crawl onto the Internet. There's also the problem of "easily replaceable parts", because parts stop being produced, and I think we've been in a golden-age of new-old-stock, and I don't see that continuing in the future. Easily replaceable pose two problems, first, is sourcing the actual part as the world moves on and production stops, the other is that easily replaceable is at odds with industry demand, sure, I personally like 40 pin dip sockets for my hobby electronics, because they're easy to solder, things are large enough I can see them! But I'd not want every appliance I own to be constrained by that, meaning there's no incentive to produce them, leading back to the first problem. There are so many problems with how to build a machine that lasts, or, even how to build an architecture, or system, that lasts, but they are worthwhile pursuits, discussing and thinking about them is worthwhile, because, systems we can understand, own and service are inherently more valuable than the ones we cannot.

Jaxan 5y ago
There is a reason to read Wikipedia via https: ISP can otherwise inject ads or even change the page. This has actually happened.
- dusted 5y ago
  That's not a good reason to take away my choice, and rob me of the opportunity to access this information on an older device if I wanted to.
  - smackeyacky 5y ago
    Proxies like WeBone can solve that. https://github.com/atauenis/webone https://github.com/atauenis/webone I use it for a solaris install. https://smackeyacky.blogspot.com/2021/10/hacker-news-in-hotjavatm-for-solaris.html https://smackeyacky.blogspot.com/2021/10/hacker-news-in-hotj...
    - yesenadam 5y ago
      Wow, WebOne looks awesome, thank you! My second computer is a 2005 mac mini..and it can't see ~98% of the web. I'll try that.
    - dusted 5y ago
      I appreciate the effort, but there's something that rubs me the wrong way about the state of this "force the world to always encrypt and offer no alternative", the same beef I have with Gemini. "Take perfectly good protocol" -> "Wrap encryption around it" -> "Only offer encrypted version even though the plaintext version is right there" -> "Use third-party tool and extra infrastructure to unwrap perfectly good protocol before it can be used".
      - smackeyacky 5y ago
        I sympathise somewhat but unfortunately the popularity of the internet means those innocent days of unencrypted information have been made dangerous due to too many bad actors. Like usenet, it's gone, it's not coming back. We shrug and move on.
      - samatman 5y ago
        I mentioned this in another thread, but given a secure way to acquire public keys, MITM attacks can be fully mitigated with signatures rather than payload encryption. A tiny client doesn't have to bother checking this signature, anything capable of receiving encrypted data could be just as sure that the payload is byte-identical with the author's intention as TLS makes possible. The difference is everyone gets to read your postcard if they want, but I'm with you: if I have an AVR barely able to GET the weather report, and strip numbers out of it if the JSON schema doesn't change even slightly, what problem is going to arise from some bad actor reading that packet on the way in? If Mallory starts messing with my dumb Arduino garden I can set up a firewall that checks the signatures. It's progressive enhancement with graceful degradation.
  - coldtea 5y ago
    Nobody took away your choice. You just need to implement/find SSL for that older device.
    - dusted 5y ago
      I think you've got something mixed up here, it's not that more effort is required by either party, it's just NOT to block port 80, and NOT write explicit redirect rules, and poof, stuff works.
      - coldtea 5y ago
        Some other party then has the extra effort of security, privacy, etc. support for those using 80 with modern computers and browsers...
        dusted 5y ago
        I don't see how, moderns browsers are free to suggest https, users are free to use it, network admins are free to require it
  - Someone 5y ago
    You may not need that extra protection (now), but society does. It’s just like all the other kinds of safety measures we expect, such as seat belts, regulations w.r.t. food safety, fire protection, standards for tool safety, etc. Nothing of that is needed, until you need it (I’ve never needed seat belts or airbags, for example, but can understand society requiring them) If the industry hadn’t forced the world to https, I think governments would have.
smackeyacky 5y ago
There is one reason I can think of for encrypting websites, it tells you the information is coming from where you expect and not an interloper. I agree its worth thinking about about serviceability and longevity but I can't help feeling like it would be like worrying about keeping a PDP 11 running for fifty years.
- inter_netuser 5y ago
  General Electric is actually commited to run PDP-11 for another 30 years, until 2050. And it’s already 52 years old, today. Seems like solved problem. https://m.slashdot.org/story/187671 https://m.slashdot.org/story/187671
- samatman 5y ago
  This purpose could be accomplished with a cryptographic signature of the plain text. Thin clients would have the option to just take the Internet's word for the provenance of the data, any system capable of running encryption algorithms can confirm they received the exact bytes the author intended. This would be an example of progressive enhancement, which has fallen out of favor.
- upofadown 5y ago
  Why should I value the information from one internet stranger over another? You can't authenticate if you don't know who anyone is. If someone is consistently changing the information then someone is going to notice. Just think about all that unauthenticated information in libraries. Anyone can replace pages in the books. Books can be substituted with completely fake copies. No one bothers to do this for the same reasons no one bothers to MITM connections to plain text web sites.
  - treesknees 5y ago
    In a world where governments are even changing the ending to popular movies [0], how do you know that tampering with books and other sources of information aren't taking place? Perhaps you're speaking specifically about American libraries, probably because most Americans don't head over to a book shelf for their information these days, but more generally speaking it's not that farfetched of an idea at all. [0]https://nypost.com/2022/01/25/fight-club-ending-changed-in-china-as-government-censorship/ https://nypost.com/2022/01/25/fight-club-ending-changed-in-c...
eternityforest 5y ago
This is a good argument against YAGNI. If we thought 10 years ahead with our designs, the result might not be clean or beautiful, or even optimal, but it might well be better than constantly changing every piece of code we have.

by dusted 5y ago

Jaxan 5y ago

There is a reason to read Wikipedia via https: ISP can otherwise inject ads or even change the page. This has actually happened.

dusted 5y ago
That's not a good reason to take away my choice, and rob me of the opportunity to access this information on an older device if I wanted to.
- smackeyacky 5y ago
  Proxies like WeBone can solve that. https://github.com/atauenis/webone https://github.com/atauenis/webone I use it for a solaris install. https://smackeyacky.blogspot.com/2021/10/hacker-news-in-hotjavatm-for-solaris.html https://smackeyacky.blogspot.com/2021/10/hacker-news-in-hotj...
  - yesenadam 5y ago
    Wow, WebOne looks awesome, thank you! My second computer is a 2005 mac mini..and it can't see ~98% of the web. I'll try that.
  - dusted 5y ago
    I appreciate the effort, but there's something that rubs me the wrong way about the state of this "force the world to always encrypt and offer no alternative", the same beef I have with Gemini. "Take perfectly good protocol" -> "Wrap encryption around it" -> "Only offer encrypted version even though the plaintext version is right there" -> "Use third-party tool and extra infrastructure to unwrap perfectly good protocol before it can be used".
    - smackeyacky 5y ago
      I sympathise somewhat but unfortunately the popularity of the internet means those innocent days of unencrypted information have been made dangerous due to too many bad actors. Like usenet, it's gone, it's not coming back. We shrug and move on.
    - samatman 5y ago
      I mentioned this in another thread, but given a secure way to acquire public keys, MITM attacks can be fully mitigated with signatures rather than payload encryption. A tiny client doesn't have to bother checking this signature, anything capable of receiving encrypted data could be just as sure that the payload is byte-identical with the author's intention as TLS makes possible. The difference is everyone gets to read your postcard if they want, but I'm with you: if I have an AVR barely able to GET the weather report, and strip numbers out of it if the JSON schema doesn't change even slightly, what problem is going to arise from some bad actor reading that packet on the way in? If Mallory starts messing with my dumb Arduino garden I can set up a firewall that checks the signatures. It's progressive enhancement with graceful degradation.
- coldtea 5y ago
  Nobody took away your choice. You just need to implement/find SSL for that older device.
  - dusted 5y ago
    I think you've got something mixed up here, it's not that more effort is required by either party, it's just NOT to block port 80, and NOT write explicit redirect rules, and poof, stuff works.
    - coldtea 5y ago
      Some other party then has the extra effort of security, privacy, etc. support for those using 80 with modern computers and browsers...
      - dusted 5y ago
        I don't see how, moderns browsers are free to suggest https, users are free to use it, network admins are free to require it
- Someone 5y ago
  You may not need that extra protection (now), but society does. It’s just like all the other kinds of safety measures we expect, such as seat belts, regulations w.r.t. food safety, fire protection, standards for tool safety, etc. Nothing of that is needed, until you need it (I’ve never needed seat belts or airbags, for example, but can understand society requiring them) If the industry hadn’t forced the world to https, I think governments would have.

smackeyacky 5y ago

There is one reason I can think of for encrypting websites, it tells you the information is coming from where you expect and not an interloper. I agree its worth thinking about about serviceability and longevity but I can't help feeling like it would be like worrying about keeping a PDP 11 running for fifty years.

inter_netuser 5y ago
General Electric is actually commited to run PDP-11 for another 30 years, until 2050. And it’s already 52 years old, today. Seems like solved problem. https://m.slashdot.org/story/187671 https://m.slashdot.org/story/187671
samatman 5y ago
This purpose could be accomplished with a cryptographic signature of the plain text. Thin clients would have the option to just take the Internet's word for the provenance of the data, any system capable of running encryption algorithms can confirm they received the exact bytes the author intended. This would be an example of progressive enhancement, which has fallen out of favor.
upofadown 5y ago
Why should I value the information from one internet stranger over another? You can't authenticate if you don't know who anyone is. If someone is consistently changing the information then someone is going to notice. Just think about all that unauthenticated information in libraries. Anyone can replace pages in the books. Books can be substituted with completely fake copies. No one bothers to do this for the same reasons no one bothers to MITM connections to plain text web sites.
- treesknees 5y ago
  In a world where governments are even changing the ending to popular movies [0], how do you know that tampering with books and other sources of information aren't taking place? Perhaps you're speaking specifically about American libraries, probably because most Americans don't head over to a book shelf for their information these days, but more generally speaking it's not that farfetched of an idea at all. [0]https://nypost.com/2022/01/25/fight-club-ending-changed-in-china-as-government-censorship/ https://nypost.com/2022/01/25/fight-club-ending-changed-in-c...

eternityforest 5y ago

This is a good argument against YAGNI. If we thought 10 years ahead with our designs, the result might not be clean or beautiful, or even optimal, but it might well be better than constantly changing every piece of code we have.