5 ms·

Shaming people for not having HTTPS on their blog is not a great look. :/

chowells 4y ago
I don't see the problem. HTTPS is basic internet hygiene. It's no worse than telling people they should mind their body odor when they're in a space with a lot of other people. Possibly indelicate, but undoubtedly true.
- hsbauauvhabzb 4y ago
  Exactly what risk does it have being on a low profile blog?
  - oddlama 4y ago
    I for example just wouldn't like anyone to be able to see what data I exchange with any server, be it small profile blog or a login page.
    - BeefWellington 4y ago
      I for example just wouldn't like anyone to be able to see what data I exchange with any server, be it small profile blog or a login page. Note: It's really, "see and modify undetected" what data you are exchanging with any server.
  - handsclean 4y ago
    It results in your browsing history being tracked and sometimes sold by your access point and ISP at a page level instead of just domain level, results in injected ads and banners on some access points, results in injected trackers on Verizon, and more broadly it permits unknown third parties to alter the content of your website.
    - mccorrinall 4y ago
      If someone wants to track you, they can just mark the frame. Marking packets isn’t anything new,
  - cesarb 4y ago
    Will it always be a "low profile blog"? It just got on the front page of HN, which is not exactly "low profile". As for what risk, two words: Great Cannon. For those who don't know, it's a well-known MITM attacker which injects JavaScript code on non-HTTPS pages, the injected JavaScript being used to do distributed denial of service attacks on other sites. Using HTTPS protects against these kinds of attacks.
- rizky05 4y ago
- bitwize 4y ago
  Your analogy is flawed because this is Hackernews and, superior beings that we are, we understand body odor to be a symptom of a microbiome that's out of whack due to "modern life". Accordingly, we don't bathe in order to cultivate healthy skin bacteria; some of us wallow in mud instead.
  - chowells 4y ago
    I'm not sure you read what I wrote. At no point did I say to bathe, or in fact proffer any treatment at all for body odor. I merely pointed out that refusing to deal with it when you're in close quarters with a large number of people is antisocial. If somehow wallowing in mud treats it for someone, then that's what they should be doing. The problem is knowing how to solve it and refusing to do so.
Dylan16807 4y ago
Noting an amusing interaction with the context isn't shaming. Though if someone can set it up in less than 15 minutes, and doesn't, I reserve the right to snark. It's not a bad look in cases like that.
- pvorb 4y ago
  You can do it in 15 minutes if you've already done it before. If you didn't, you'd be very lucky doing it in such a short time frame.
  - Ferret7446 4y ago
  - sgtnoodle 4y ago
    I set it up for my home server maybe a year ago. I'm not a web developer or system admin, but I am a highly experienced software engineer with a deep understanding of network protocols. The documentation didn't seem the greatest, basically being, "copy/paste this if you use Apache." My particular configuration was quirkier than the example assumed, and I had to go through a few rounds of troubleshooting. It definitely wasn't trivial.
    - intelVISA 4y ago
      > but I am a highly experienced software engineer with a deep understanding of network protocols Thank you for your service
      - sgtnoodle 4y ago
        Lol, thanks. I rarely work on stuff exposed to the Internet. I've implemented multiple bare metal IP stacks from scratch, including Ethernet, DHCP, ARP, ICMP, and UDP. I've run real-time safety critical packets over TCP links. I've tunneled IP traffic through the international space station. I've done unforgivable things with iptables and awk. The funny thing is that IPv6 short-circuits my brain. Why do I have four addresses, and where did they come from? Why isn't there a link-local address for loopback and wireguard?
seanp2k2 4y ago
What traffic between a blog without user auth for comments needs to be encrypted? Why? I understand that Let’s Encrypt exists and it’s “easy” to set up (for people with root access to the system hosting their site + a decent level of technical sysadmin proficiency)
- vlovich123 4y ago
  So that middlemen can’t spy on which part of the blog you’re visiting / alter the content of the blog / inject ads. There’s also all sorts of vulnerabilities that crop up if you use HTTP and HTTPS on the same site. All of this was present in the 90s and early 2000s so not really theoretical attacks.
  - bayindirh 4y ago
    > inject ads. If you believe that your ISP or a middleman can't inject ads without breaking the S in HTTPS, I have a bridge to sell you. They can just push the content into a frame and inject the content outside that frame. I encountered this more than once.
    - cortesoft 4y ago
      That is not possible. You would get a cert mismatch error.
      - bayindirh 4y ago
        The overall connection will drop to "mixed status", but the inner frame will still be HTTPS. My ISP used to do that when they started deploying DPI hardware as a technology demo. They'll hijack your traffic and inject full ads w/o redirection or added (bill) warning banners or ads sporadically to retrieved pages. My mobile carrier sometimes injects SMS & Notifications arriving to my modem if they find the chance w/o disturbing the connection too much. So, having a HTTPS connection doesn't make it tamper resistant, but tamper evident, at most.
hnbad 4y ago
Fun fact: HTTPS is implicitly required by the GDPR because the user agent metadata is considered PII and websites are required to implement best current practices, which includes HTTPS. There is no exemption for (public) personal websites as they're still providing a publicly accessible service and processing PII to do so. The same goes for a privacy policy for that matter.

I don't see the problem. HTTPS is basic internet hygiene. It's no worse than telling people they should mind their body odor when they're in a space with a lot of other people. Possibly indelicate, but undoubtedly true.

hsbauauvhabzb 4y ago
Exactly what risk does it have being on a low profile blog?
- oddlama 4y ago
  I for example just wouldn't like anyone to be able to see what data I exchange with any server, be it small profile blog or a login page.
  - BeefWellington 4y ago
    I for example just wouldn't like anyone to be able to see what data I exchange with any server, be it small profile blog or a login page. Note: It's really, "see and modify undetected" what data you are exchanging with any server.
- handsclean 4y ago
  It results in your browsing history being tracked and sometimes sold by your access point and ISP at a page level instead of just domain level, results in injected ads and banners on some access points, results in injected trackers on Verizon, and more broadly it permits unknown third parties to alter the content of your website.
  - mccorrinall 4y ago
    If someone wants to track you, they can just mark the frame. Marking packets isn’t anything new,
- cesarb 4y ago
  Will it always be a "low profile blog"? It just got on the front page of HN, which is not exactly "low profile". As for what risk, two words: Great Cannon. For those who don't know, it's a well-known MITM attacker which injects JavaScript code on non-HTTPS pages, the injected JavaScript being used to do distributed denial of service attacks on other sites. Using HTTPS protects against these kinds of attacks.
rizky05 4y ago
bitwize 4y ago
Your analogy is flawed because this is Hackernews and, superior beings that we are, we understand body odor to be a symptom of a microbiome that's out of whack due to "modern life". Accordingly, we don't bathe in order to cultivate healthy skin bacteria; some of us wallow in mud instead.
- chowells 4y ago
  I'm not sure you read what I wrote. At no point did I say to bathe, or in fact proffer any treatment at all for body odor. I merely pointed out that refusing to deal with it when you're in close quarters with a large number of people is antisocial. If somehow wallowing in mud treats it for someone, then that's what they should be doing. The problem is knowing how to solve it and refusing to do so.

Dylan16807 4y ago

Noting an amusing interaction with the context isn't shaming. Though if someone can set it up in less than 15 minutes, and doesn't, I reserve the right to snark. It's not a bad look in cases like that.

pvorb 4y ago
You can do it in 15 minutes if you've already done it before. If you didn't, you'd be very lucky doing it in such a short time frame.
- Ferret7446 4y ago
- sgtnoodle 4y ago
  I set it up for my home server maybe a year ago. I'm not a web developer or system admin, but I am a highly experienced software engineer with a deep understanding of network protocols. The documentation didn't seem the greatest, basically being, "copy/paste this if you use Apache." My particular configuration was quirkier than the example assumed, and I had to go through a few rounds of troubleshooting. It definitely wasn't trivial.
  - intelVISA 4y ago
    > but I am a highly experienced software engineer with a deep understanding of network protocols Thank you for your service
    - sgtnoodle 4y ago
      Lol, thanks. I rarely work on stuff exposed to the Internet. I've implemented multiple bare metal IP stacks from scratch, including Ethernet, DHCP, ARP, ICMP, and UDP. I've run real-time safety critical packets over TCP links. I've tunneled IP traffic through the international space station. I've done unforgivable things with iptables and awk. The funny thing is that IPv6 short-circuits my brain. Why do I have four addresses, and where did they come from? Why isn't there a link-local address for loopback and wireguard?

seanp2k2 4y ago

What traffic between a blog without user auth for comments needs to be encrypted? Why? I understand that Let’s Encrypt exists and it’s “easy” to set up (for people with root access to the system hosting their site + a decent level of technical sysadmin proficiency)

vlovich123 4y ago
So that middlemen can’t spy on which part of the blog you’re visiting / alter the content of the blog / inject ads. There’s also all sorts of vulnerabilities that crop up if you use HTTP and HTTPS on the same site. All of this was present in the 90s and early 2000s so not really theoretical attacks.
- bayindirh 4y ago
  > inject ads. If you believe that your ISP or a middleman can't inject ads without breaking the S in HTTPS, I have a bridge to sell you. They can just push the content into a frame and inject the content outside that frame. I encountered this more than once.
  - cortesoft 4y ago
    That is not possible. You would get a cert mismatch error.
    - bayindirh 4y ago
      The overall connection will drop to "mixed status", but the inner frame will still be HTTPS. My ISP used to do that when they started deploying DPI hardware as a technology demo. They'll hijack your traffic and inject full ads w/o redirection or added (bill) warning banners or ads sporadically to retrieved pages. My mobile carrier sometimes injects SMS & Notifications arriving to my modem if they find the chance w/o disturbing the connection too much. So, having a HTTPS connection doesn't make it tamper resistant, but tamper evident, at most.

hnbad 4y ago

Fun fact: HTTPS is implicitly required by the GDPR because the user agent metadata is considered PII and websites are required to implement best current practices, which includes HTTPS. There is no exemption for (public) personal websites as they're still providing a publicly accessible service and processing PII to do so. The same goes for a privacy policy for that matter.