4 ms·
It's quite ironic that the "Foundations of Computer Science" are hosted on an HTTP server without TLS. I was lucky enough to have gone to a university system (
by beebmam 5y ago
It's quite ironic that the "Foundations of Computer Science" are hosted on an HTTP server without TLS.
I was lucky enough to have gone to a university system (UC) which gave me an opportunity to learn the fundamentals of computer science, but when I see major universities (like Stanford) operate public HTTP sites without TLS, I can't be anything other than disappointed.
It's 2022, there's really no excuse to operate public HTTP sites without TLS (with minor exceptions). Even self-signed certificate HTTPS would be far better than HTTP without TLS.
- bananabiscuit 5y agoWhy is it important for this particular site to use https or tls?
- wackafooe 5y agoPlease explain your reasoning. Why would this site need HTTPS?
- falcor84 5y agoI don't think any explanation about a particular site is needed. I came to believe that we in HN all agreed that mass surveillance is bad and that promoting HTTPS everywhere is the least we can do make surveillance more difficult. Just as no one would want government agents following them around as they go about their day attending university lectures, and just as we wouldn't be happy with that agent asking us "Why, what do you have to hide?", we also shouldn't be comfortable with having our visit to resources on stanford.edu be open to surveillance by every node on the network. In a world where even example.com uses TLS, we can surely expect the same from all Stanford subdomains.
- Zababa 5y agoJust to push back on your first paragraph, there is no "we in HN". HN is composed of individual people with various degrees of belief in "HTTPS everywhere" and "mass Surveillance is bad", especially since many people here benefit directly or indirectly from money from mass surveillance.
- pasquinelli 5y agothere are many we's in hn emerging from the headlines we choose to click on.
- Supermancho 5y agoAll sites should be using HTTPS. Your phone doesn't audibly broadcast your emails as you send them, your snail mail doesn't come in completely transparent envelopes, and your doors have locks on them. It's minimal security to prevent the injection/filtering of information via MITM and consistent identity (for whatever that's worth). Take just a moment to think about what the site could look like from China without HTTPS, if the CCP was interested: Chapter 12 Propositional Logic Chapter 13 Responsible State Guidance Chapter 14 Using Logic to Design Computer Components Chapter 15 Predicate Logic Now it appears that a notable US institution supporting CCP-sponsored oversight, because someone was too lazy to use a self signed cert.
- jldugger 5y ago> Your phone doesn't audibly broadcast your emails as you send them Funnily enough I used to know a blind woman who would use the iOS screen reader at like 4x speed when doing email. > your snail mail doesn't come in completely transparent envelopes You mean like post cards? > and your doors have locks on them. Fair =)
- mburee 5y agoWhy would it need encryption? The only convincing argument would be stuff like as insertions by ISPs and so on but that's extremely uncommon. Additionally everyone and their mother seems to be a CA these days...
- beebmam 5y agoThere's more to HTTPS than just data integrity promises. One of the most popular topics on Hacker News is privacy, so I'd imagine people here would understand why virtually all public websites should be HTTPS only.
- qsort 5y agoAh yes, the obvious privacy implications of reading topics in elementary computer science. You are right that virtually all public websites should be HTTPS only. Serving static, non-sensitive data is the use case that "virtually" is there for.
- beebmam 5y agoIs there any reason to be so sarcastic here, other your desire to engage in bad faith here? There are good reasons to make the paths that people request on public websites private to the client & server, even when that content is seemingly not interesting (to you) to gather for snooping purposes.
- NikolaeVarius 5y agoIts always entertaining to see users claiming bad faith when they are engaging in bad faith themselves. Please list the good reasons that are relevant for a fully publically accessible page of information that contains nothing that asks for usernames/passwords or whatever.
- 533474 5y agoDon't feed the troll
- Kranar 5y agoI feel like in the absence of an overwhelming justification, your comment is just derailing the topic and attracting unnecessary attention.
- gryn 5y agonot ironic at all, you're just confusing (theoretical) "Computer Science" with "Software Engineering" industry best practices.
- btian 5y ago> Even self-signed certificate HTTPS would be far better than HTTP without TLS In what way?