4 ms·
Why would you need SSL/HTTPS for a casual game like this?
by perryizgr8 5y ago
Why would you need SSL/HTTPS for a casual game like this?
- Gigachad 5y agoIt's free to set up. Justify why it can't be https.
- perryizgr8 5y agoLots of things are free. Doesn't mean you need to do them. The burden of justification lies on the people advocating for adding complexity and dependency to a simple system.
- Gigachad 5y agoIt’s not complex. You click a button on GitHub. So gaining a decent amount of security and privacy easily justifies the work of clicking a button.
- nix23 5y agoThe Vagrantfile, but otherwise your right.
- josephg 5y agoBecause plenty of unscrupulous ISPs and governments log unencrypted web traffic. Some ISPs use that information for advertising, or inject custom javascript into unencrypted web pages their customers visit for who knows what reason. HTTPS is free and stops most of these tricks from working. You can still sniff the domain name via DNS or SNI, but HTTPS blocks attackers from seeing the URL you're visiting, or seeing the traffic the server sends back. It also stops people from doing MITM attacks on the connection. Its 2022. HTTPS is fast, it works great and its free. Use it everywhere.
- perryizgr8 5y ago> Because plenty of unscrupulous ISPs and governments log unencrypted web traffic. Ok. Not relevant here. I don't care if my ISP knows I'm learning SELinux. And they would know that even with HTTPS. > Some ISPs use that information for advertising, or inject custom javascript into unencrypted web pages Sounds like an ISP problem. Buy service from a better one. No need to impose SSL on the website for this. > HTTPS is free Absolutely not. It takes time and effort to set up. And then maintain forever. Plus you're introducing an unnecessary dependency on multiple third parties. > HTTPS is fast HTTP is faster.
- Hikikomori 5y ago>Sounds like an ISP problem. Buy service from a better one. No need to impose SSL on the website for this. Just move I guess.
- perryizgr8 5y agoOr don't. It's not a problem that needs to be solved server-side.
- josephg 5y agoIt is a problem to solve over the wire, because we should assume at this point that bytes over the internet are monitored. Both in the east (Great Firewall of China) and the west (NSA + Snowden). I don't want my ISP or my government knowing which websites I'm visiting, what apps I open on my phone or, really anything else about me without a court order. Insecure-by-default is a bad default. To protect users, traffic over the internet should always be encrypted. Even if you don't care, as a user I care. And thankfully the people in charge of our software, protocols and ecosystem are slowly forcing the issue on our behalf: - Unencrypted http will eventually be deprecated from web browsers. (Newer browser features are already banned in insecure contexts). - iOS forbids applications from making unencrypted HTTP connections. - The IETF more or less requires new protocols to be secure. We'll see more of this over time. Its a good thing. Get on board.
- josephg 5y ago
- f1codz 5y agoWhat is the concern with these logs? Do they contain end user information? May be IP, anything else?
- f1codz 5y agoAlso technology wise its not 2022 everywhere, if you know what i mean. Many poorer nations suffer from inferior infrastructure, which could mean slower loading / processing times for https based webpages. I remember reading an article along these lines a few years ago when arguing against using https absolutely everywhere.
- hexo 5y agoNope. SSL was pretty okay performance-wise 15 years ago. So no, we don't know what you mean. 'Poorer' infrastructure excuse is void. If we cared about performance we'd get rid of almost all javascript, not https.
- josephg 5y agoYep. Also http2 more than makes up for the performance difference. And http2 requires TLS.