4 ms·

I love such focused, cooperative and mature tools. They do one thing well, play nicely and keep their promises. however, using lighttpd due to https.

mananaysiempre 4y ago
Why not a separate TLS terminator like Hitch[1]? (Why do people in general insist that TLS be built and linked into everything?) [1] https://hitch-tls.org/ https://hitch-tls.org/
- mro_name 4y ago
  yes, that would be it. I thought of stunnel. But that's extra moving parts.
  - mananaysiempre 4y ago
    The scale goes from “less moving parts” to “more focused”; the optimal point varies, but I don’t think you can get away from the fact that those are in opposition. Of course, the usual vernacular meaning of “more focused” is “does less things I don’t need”, but that’s not unrelated: because everyone needs a different subset of things, the more things a given piece of software needs the larger, on average, the proportion of those that you don’t need; so running more pieces of (less feature-rich) software seems necessary in order for having less stuff you don’t need or understand overall. (In the specific case of TLS, I get additional warm fuzzies from being sure that, however screwed up the web server is, it cannot be confused[1] into revealing the secret keys when it does not have access to them in the first place. I don’t know to which extent this is actually important, though. A factotum[2]-like approach is a compromise that gives the web server the ephemeral keys in exchange for not having to pass the entirety of the traffic through the terminator, but I’m not aware of any practical implementations except for the one Akamai, disgustingly, patented[3] 10 years after the actual invention.) [1] http://www.cap-lore.com/CapTheory/ConfusedDeputy.html http://www.cap-lore.com/CapTheory/ConfusedDeputy.html [2] https://www.usenix.org/conference/11th-usenix-security-symposium/security-plan-9 https://www.usenix.org/conference/11th-usenix-security-sympo... or http://doc.cat-v.org/plan_9/4th_edition/papers/auth http://doc.cat-v.org/plan_9/4th_edition/papers/auth [3] https://patents.google.com/patent/US9531685B2 https://patents.google.com/patent/US9531685B2 (wow, I though this was the Cloudflare patent, but that one, https://patents.google.com/patent/US8782774B1 https://patents.google.com/patent/US8782774B1, is even more trivial)
    - mro_name 4y ago
      > warm fuzzies from being sure that, however screwed up the web server is, it cannot be confused[1] into revealing the secret keys when it does not have access to them in the first place. indeed a big one. THE big one. Usually I do watch out for 'https' in CGIs which requires the webserver to know. Need it e.g. to build absolute URLs https://codeberg.org/mro/geohash/src/branch/master/lib/cgi.ml#L95 https://codeberg.org/mro/geohash/src/branch/master/lib/cgi.m...

mananaysiempre 4y ago

Why not a separate TLS terminator like Hitch[1]? (Why do people in general insist that TLS be built and linked into everything?) [1] https://hitch-tls.org/ https://hitch-tls.org/

mro_name 4y ago
yes, that would be it. I thought of stunnel. But that's extra moving parts.
- mananaysiempre 4y ago
  The scale goes from “less moving parts” to “more focused”; the optimal point varies, but I don’t think you can get away from the fact that those are in opposition. Of course, the usual vernacular meaning of “more focused” is “does less things I don’t need”, but that’s not unrelated: because everyone needs a different subset of things, the more things a given piece of software needs the larger, on average, the proportion of those that you don’t need; so running more pieces of (less feature-rich) software seems necessary in order for having less stuff you don’t need or understand overall. (In the specific case of TLS, I get additional warm fuzzies from being sure that, however screwed up the web server is, it cannot be confused[1] into revealing the secret keys when it does not have access to them in the first place. I don’t know to which extent this is actually important, though. A factotum[2]-like approach is a compromise that gives the web server the ephemeral keys in exchange for not having to pass the entirety of the traffic through the terminator, but I’m not aware of any practical implementations except for the one Akamai, disgustingly, patented[3] 10 years after the actual invention.) [1] http://www.cap-lore.com/CapTheory/ConfusedDeputy.html http://www.cap-lore.com/CapTheory/ConfusedDeputy.html [2] https://www.usenix.org/conference/11th-usenix-security-symposium/security-plan-9 https://www.usenix.org/conference/11th-usenix-security-sympo... or http://doc.cat-v.org/plan_9/4th_edition/papers/auth http://doc.cat-v.org/plan_9/4th_edition/papers/auth [3] https://patents.google.com/patent/US9531685B2 https://patents.google.com/patent/US9531685B2 (wow, I though this was the Cloudflare patent, but that one, https://patents.google.com/patent/US8782774B1 https://patents.google.com/patent/US8782774B1, is even more trivial)
  - mro_name 4y ago
    > warm fuzzies from being sure that, however screwed up the web server is, it cannot be confused[1] into revealing the secret keys when it does not have access to them in the first place. indeed a big one. THE big one. Usually I do watch out for 'https' in CGIs which requires the webserver to know. Need it e.g. to build absolute URLs https://codeberg.org/mro/geohash/src/branch/master/lib/cgi.ml#L95 https://codeberg.org/mro/geohash/src/branch/master/lib/cgi.m...