5 ms·

> I mentioned this above, but when was Debian ever doing this? I They are still doing it! On my system (this one's not Debian, but KDE Neon) $ cat /etc/a

> I mentioned this above, but when was Debian ever doing this? I They are still doing it! On my system (this one's not Debian, but KDE Neon) $ cat /etc/apt/sources.list deb http://archive.ubuntu.com/ubuntu/ focal main restricted universe multiverse deb http://security.ubuntu.com/ubuntu/ focal-security main restricted universe multiverse > That's not what HTTPS protects against, HTTPS is designed to protect against MITM attacks That need a MITM Which is a specific type of attack. If you are running a network where that's not possible, you're fine. > LetsEncrypt pretty much only cares whether or not you control the domain you say you control LetsEncrypt is pretty much an advanced tool, for advanced users > I don't personally like when companies do this, but it's not breaking HTTPS. It's breaking confidentiality. Which is one of the features of HTTPS In a corporate network MITM attacks are not that easy to pull off. So basically HTTPS main feature is encryption of content in that context. > Carrots and spinach are not a health panacea, but that doesn't mean I'm obligated to eat dirt instead. first of all, carrots and spinach are a panacea. Secondly, HTTP is not dirt. Like SMTP is not dirt and IRC is not dirt and FTP is not dirt and TFTP is not dirt > But that doesn't mean HTTP is secure. an ex nobody said HTTP is secure, but it's not inherently insecure, like every plain text protocol it's plain text. it's the network that is insecure, MITM is not an exclusive of HTTP. If the network is secure, HTTP is secure. In my kubernetes clusters, TLS is terminated at load balancer and PODS talk to each other using plain simple HTTP. Wasting energy on useless cryptography "just because" is not very smart IMO.

danShumway 4y ago
> They are still doing it! No, they're not! Debian uses PGP and signature verification to protect against MITM attacks because it is critically important for software downloads to be protected against MITM attacks. Now, Debian does not use HTTPS in specific to protect against MITM attacks because they have another method baked into the package managers that people are using. It does not follow that HTTP is secure, it's not. It follows that you can use an insecure protocol to deliver software if you bolt the same security features on top of it. You're looking at someone who has come up with an alternative way to protect users from MITM attacks and thus doesn't use HTTPS, and the conclusion you're drawing is, "I don't need to be concerned about MITM attacks." That's not the right lesson to draw from this. Is your publicly facing site being accessed by software that automatically checks data integrity using a set of pre-shared keys? No, and no normal person is going to manually do that check when they visit your site, so you need HTTPS. > If you are running a network where that's not possible, If your website is accessible to normal browsers on the public Internet, than you're not on a network where that's not possible. > LetsEncrypt is pretty much an advanced tool, for advanced users Most free hosts I've looked at recently from Github pages to Netlify have automatic background SSL management for free with zero configuration from the user. If you're running your own server, then you're an advanced user, but even in that situation LetsEncrypt is one of the easiest SSL setups I've ever used. Any situation where you're using a host who can't manage SSL for you is also probably a situation where you're using a host who can't manage things like DNS or hosting for you, at which point, yeah, I expect you to be able to run a command line tool. If you can install Wordpress on a server, you can use LetsEncrypt. If you can't install Wordpress on a server, you should be using a managed host, and they should install LetsEncrypt. > It's breaking confidentiality. Which is one of the features of HTTPS No, HTTPS encrypts data according to the certificate authority. While I don't like networks effectively doing MITM attacks on their own users, it is not the fault of HTTPS that it trusts the authorities that the user's device tells it to trust, any more than it's the fault of Debian if you import an untrustworthy key/repo into package manager. I was kind of leaving privacy off the table here since you were championing Debian and Debian has substantial privacy issues with software downloads. But if you want to go down that route, than sure, another weakness of HTTP is that it allows tons of network snooping that really shouldn't be possible even for "innocuous" sites that claim they don't have private data on them. > first of all, carrots and spinach are a panacea. This is a complete sidenote, but either you don't understand what "panacea" means or you're at risk of Vitamin B12 deficiency. Carrots and spinach are not cure-alls for health, no. > If the network is secure It's not. Not if it's accessible from a browser on the public Internet. > Wasting energy on useless cryptography "just because" is not very smart IMO. Rejecting basically free cryptography that substantially improves security just because people are determined to be the last holdouts on a move that pretty much every security professional recommends is cutting off one's nose to spite one's face. People being so concerned about centralization that they start sending messages in plain-text and start arguing with people online that sending messages in plain-text is somehow better for decentralization is at best misguided.
- peoplefromibiza 4y ago
  > Now, Debian does not use HTTPS so YES, they are still doing it. thanks for confirming. Anyway, how do you donwnload those PGP keys in your opinion? http://subkeys.pgp.net/keys/ http://subkeys.pgp.net/keys/ http://pgp.mit.edu/ http://pgp.mit.edu/ http://keyserver.ubuntu.org http://keyserver.ubuntu.org Why they do it? because the heavy cryptographic computation this way is done on the client, saving computer cycles on the packages mirrors that more often than not are kept alive by volunteers using their own money and time. > If your website is accessible to normal browsers on the public Internet, than you're not on a network where that's not possible. *If you are running a network where that's not possible,* again, thanks for confirming it. anyway, I could not care about MITM attacks if my website is my personal blog, running on a PI in my living room. It's the network job to ensure security from MITM, not the website owners'. > Most free hosts I've looked at recently from Github pages to Netlify have automatic background SSL management for free with zero configuration from the user And now you have to trust them too, it's not "your personal website" anymore. Talking about trusting trust... your solution is more delegation to unknown entities. Doesn't sound so convincing to me. > No, HTTPS encrypts data according to the certificate authority No, HTTPS works with self signed certs too, it's browsers that don't want you to and show a scary popup like this https://help.univention.com/uploads/default/original/2X/5/5e21d0d7f0ead7b8da9da323cd1db0d7ee72428b.png https://help.univention.com/uploads/default/original/2X/5/5e... Which is not even true, the connection is private, it is simply privately private and not "trusted" by any know CA. which could not be a problem if I trust the website and who runs it. But, again, the scary warning page will scare people away, while the connection is working as intended. > I was kind of leaving privacy off the table You are confusing privacy with secrecy. HTTPS is not private, the connections being made are still visible. > you don't understand what "panacea" means I'm Italian with Greek roots, we literally invented the word. Its original meaning is "plants that cure everything". That's why my remarks. It's still a plant name! (https://www.google.com/search?q=p%C3%A0nace https://www.google.com/search?q=p%C3%A0nace) > Rejecting basically free cryptography that substantially improves security Yeah, I imagine you lock yourself in your house and set the alarm every time you exit from a room and then disable it every time you enter, after unlocking the door. I'm sure you do it, it's free, it improves security! > People being so concerned about centralization that they start sending messages in plain-text and start arguing with people online that sending messages in plain-text is somehow better for decentralization is at best misguided. I know how you feel in your paranoia fueled World and I feel for you, but I tell you, dear friend, that you're wrong. Nobody said what you're saying they did. Use the easier solution available given the circumstances is simply sign of intellect. You're not stupid, I'm sure of it, so why you acting like you were?

danShumway 4y ago

> They are still doing it! No, they're not! Debian uses PGP and signature verification to protect against MITM attacks because it is critically important for software downloads to be protected against MITM attacks. Now, Debian does not use HTTPS in specific to protect against MITM attacks because they have another method baked into the package managers that people are using. It does not follow that HTTP is secure, it's not. It follows that you can use an insecure protocol to deliver software if you bolt the same security features on top of it. You're looking at someone who has come up with an alternative way to protect users from MITM attacks and thus doesn't use HTTPS, and the conclusion you're drawing is, "I don't need to be concerned about MITM attacks." That's not the right lesson to draw from this. Is your publicly facing site being accessed by software that automatically checks data integrity using a set of pre-shared keys? No, and no normal person is going to manually do that check when they visit your site, so you need HTTPS. > If you are running a network where that's not possible, If your website is accessible to normal browsers on the public Internet, than you're not on a network where that's not possible. > LetsEncrypt is pretty much an advanced tool, for advanced users Most free hosts I've looked at recently from Github pages to Netlify have automatic background SSL management for free with zero configuration from the user. If you're running your own server, then you're an advanced user, but even in that situation LetsEncrypt is one of the easiest SSL setups I've ever used. Any situation where you're using a host who can't manage SSL for you is also probably a situation where you're using a host who can't manage things like DNS or hosting for you, at which point, yeah, I expect you to be able to run a command line tool. If you can install Wordpress on a server, you can use LetsEncrypt. If you can't install Wordpress on a server, you should be using a managed host, and they should install LetsEncrypt. > It's breaking confidentiality. Which is one of the features of HTTPS No, HTTPS encrypts data according to the certificate authority. While I don't like networks effectively doing MITM attacks on their own users, it is not the fault of HTTPS that it trusts the authorities that the user's device tells it to trust, any more than it's the fault of Debian if you import an untrustworthy key/repo into package manager. I was kind of leaving privacy off the table here since you were championing Debian and Debian has substantial privacy issues with software downloads. But if you want to go down that route, than sure, another weakness of HTTP is that it allows tons of network snooping that really shouldn't be possible even for "innocuous" sites that claim they don't have private data on them. > first of all, carrots and spinach are a panacea. This is a complete sidenote, but either you don't understand what "panacea" means or you're at risk of Vitamin B12 deficiency. Carrots and spinach are not cure-alls for health, no. > If the network is secure It's not. Not if it's accessible from a browser on the public Internet. > Wasting energy on useless cryptography "just because" is not very smart IMO. Rejecting basically free cryptography that substantially improves security just because people are determined to be the last holdouts on a move that pretty much every security professional recommends is cutting off one's nose to spite one's face. People being so concerned about centralization that they start sending messages in plain-text and start arguing with people online that sending messages in plain-text is somehow better for decentralization is at best misguided.

peoplefromibiza 4y ago
> Now, Debian does not use HTTPS so YES, they are still doing it. thanks for confirming. Anyway, how do you donwnload those PGP keys in your opinion? http://subkeys.pgp.net/keys/ http://subkeys.pgp.net/keys/ http://pgp.mit.edu/ http://pgp.mit.edu/ http://keyserver.ubuntu.org http://keyserver.ubuntu.org Why they do it? because the heavy cryptographic computation this way is done on the client, saving computer cycles on the packages mirrors that more often than not are kept alive by volunteers using their own money and time. > If your website is accessible to normal browsers on the public Internet, than you're not on a network where that's not possible. *If you are running a network where that's not possible,* again, thanks for confirming it. anyway, I could not care about MITM attacks if my website is my personal blog, running on a PI in my living room. It's the network job to ensure security from MITM, not the website owners'. > Most free hosts I've looked at recently from Github pages to Netlify have automatic background SSL management for free with zero configuration from the user And now you have to trust them too, it's not "your personal website" anymore. Talking about trusting trust... your solution is more delegation to unknown entities. Doesn't sound so convincing to me. > No, HTTPS encrypts data according to the certificate authority No, HTTPS works with self signed certs too, it's browsers that don't want you to and show a scary popup like this https://help.univention.com/uploads/default/original/2X/5/5e21d0d7f0ead7b8da9da323cd1db0d7ee72428b.png https://help.univention.com/uploads/default/original/2X/5/5e... Which is not even true, the connection is private, it is simply privately private and not "trusted" by any know CA. which could not be a problem if I trust the website and who runs it. But, again, the scary warning page will scare people away, while the connection is working as intended. > I was kind of leaving privacy off the table You are confusing privacy with secrecy. HTTPS is not private, the connections being made are still visible. > you don't understand what "panacea" means I'm Italian with Greek roots, we literally invented the word. Its original meaning is "plants that cure everything". That's why my remarks. It's still a plant name! (https://www.google.com/search?q=p%C3%A0nace https://www.google.com/search?q=p%C3%A0nace) > Rejecting basically free cryptography that substantially improves security Yeah, I imagine you lock yourself in your house and set the alarm every time you exit from a room and then disable it every time you enter, after unlocking the door. I'm sure you do it, it's free, it improves security! > People being so concerned about centralization that they start sending messages in plain-text and start arguing with people online that sending messages in plain-text is somehow better for decentralization is at best misguided. I know how you feel in your paranoia fueled World and I feel for you, but I tell you, dear friend, that you're wrong. Nobody said what you're saying they did. Use the easier solution available given the circumstances is simply sign of intellect. You're not stupid, I'm sure of it, so why you acting like you were?