6 ms·

HTTPS is great, of course, but there's still a place for plain HTTP. It is essential that HTTP continues to be universally supported (even behind the ridiculou

HTTPS is great, of course, but there's still a place for plain HTTP. It is essential that HTTP continues to be universally supported (even behind the ridiculous warnings that browsers put these days). There are several, independent reasons for that: 1. You can build a complete http server and client from scratch with a manageable number of lines of assembly code, as has been demonstrated many times. The innocent "s" in the protocol would be the largest part of that implementation if it was required. Let's allow simple harmless things to stay around. 2. For static http pages with permanent content, encryption is not really necessary. These pages are just like posters hanging on the wall. Of course third parties can "mitm" them and write over them, but it doesn't really matter. It's nice that we can still hang random posters around. 3. Setting-up an https server requires involving another party (the CA) that now holds some power over your content. Since the CA can now effectively shut down your site, they may succumb for pressure to do so. This has already happened. The widely used "let's encrypt" has been made to hold responsibility for the certificates that they issue to sites with problematic content, and they have removed certificates to these sites, which is tantamount to shutting them down. So far, this has just happened for neonazi content, which is alright to censor in my view; but I'm worried that other people will be alright with censoring content which I find reasonable.

couchand 4y ago
> Let's allow simple harmless things to stay around. On private networks only, please. Otherwise, they will not be harmless for long. > For static http pages with permanent content, encryption is not really necessary. Unless you actually care about receiving the true content. Which, if you intend to reach that site, you probably do. > now holds some power over your content. That's simply untrue. Complete FUD. > which is tantamount to shutting them down. No it is not. Stop whining and go home
- enriquto 4y ago
  > Unless you actually care about receiving the true content. Which, if you intend to reach that site, you probably do. Not always. My website is a sand castle in the beach. I take care of it and love it, but I don't mind if the wind takes it down, or if some kids destroy part of it, or if some idiot takes a photo of it and photoshops it in order to misrepresent my work. It is just a sand castle. However, I would feel really angry, frothing at the mouth angry, if I was forced to "register" my sand castle in some stupid place so that the passerby could be assured that it is mine, or otherwise not be allowed to build a sand castle at all. This is what I feel by being forced to use https just to store some irrelevant static files. Regarding CA and censorship, what I said is true and can be verified with a small amount of googling. I don't have the patience right now to do that for you, surely another HN reader can provide the relevant references if you are honestly interested.
  - couchand 4y ago
    If you're tending such a site as pure art project, fine. However, I suspect the site is there because you envision a community of potential users in this world. You are not "forced to register". You are asked by your community to make mutual assurances. The easiest system out there relies on a third party, true. There are other third parties, and you could make your own (the most popular one, you might be surprised to hear, didn't exist a few years ago). And there are other ideas of ways to make this mutual assurance. None have taken off in a big way yet, but I'd encourage you to look to them or think of other ways we could do it! Pretending that we don't need to make this mutual assurance to members of our community is not an option. If you don't like the easy way to do it, find another way.
    - Handytinge 4y ago
      > There are other third parties, and you could make your own (the most popular one, you might be surprised to hear, didn't exist a few years ago). Am I reading this right? Are you suggesting that because LetsEncrypt exists noe, the user should roll their own CA, and have it entrusted by all major browsers? That's obvious absurd and unachievable. Especially compared to the _existing and functional_ solution of HTTP.

couchand 4y ago

> Let's allow simple harmless things to stay around. On private networks only, please. Otherwise, they will not be harmless for long. > For static http pages with permanent content, encryption is not really necessary. Unless you actually care about receiving the true content. Which, if you intend to reach that site, you probably do. > now holds some power over your content. That's simply untrue. Complete FUD. > which is tantamount to shutting them down. No it is not. Stop whining and go home

enriquto 4y ago
> Unless you actually care about receiving the true content. Which, if you intend to reach that site, you probably do. Not always. My website is a sand castle in the beach. I take care of it and love it, but I don't mind if the wind takes it down, or if some kids destroy part of it, or if some idiot takes a photo of it and photoshops it in order to misrepresent my work. It is just a sand castle. However, I would feel really angry, frothing at the mouth angry, if I was forced to "register" my sand castle in some stupid place so that the passerby could be assured that it is mine, or otherwise not be allowed to build a sand castle at all. This is what I feel by being forced to use https just to store some irrelevant static files. Regarding CA and censorship, what I said is true and can be verified with a small amount of googling. I don't have the patience right now to do that for you, surely another HN reader can provide the relevant references if you are honestly interested.
- couchand 4y ago
  If you're tending such a site as pure art project, fine. However, I suspect the site is there because you envision a community of potential users in this world. You are not "forced to register". You are asked by your community to make mutual assurances. The easiest system out there relies on a third party, true. There are other third parties, and you could make your own (the most popular one, you might be surprised to hear, didn't exist a few years ago). And there are other ideas of ways to make this mutual assurance. None have taken off in a big way yet, but I'd encourage you to look to them or think of other ways we could do it! Pretending that we don't need to make this mutual assurance to members of our community is not an option. If you don't like the easy way to do it, find another way.
  - Handytinge 4y ago
    > There are other third parties, and you could make your own (the most popular one, you might be surprised to hear, didn't exist a few years ago). Am I reading this right? Are you suggesting that because LetsEncrypt exists noe, the user should roll their own CA, and have it entrusted by all major browsers? That's obvious absurd and unachievable. Especially compared to the _existing and functional_ solution of HTTP.