4 ms·

HTTP/1.1 support is the last bastion between the web and complete corporate control. Once the megacorp browsers and man in the middle companies like Cloudflare

HTTP/1.1 support is the last bastion between the web and complete corporate control. Once the megacorp browsers and man in the middle companies like Cloudflare drop HTTP/1.1 we will no longer be able to host a website without the continued approval of a third party corporation. HTTP/2 and HTTP/3 implemenations require the use of CA based TLS. Just to preempt misunderstanding: HTTPS is great. But HTTPS only, with no option for HTTP is very much worse than HTTP+HTTPS for human people. Despite being great for for profit companies and institutions.

MuffinFlavored 4y ago
> HTTP/2 and HTTP/3 implemenations require the use of CA based TLS. You can't do LetsEncrypt?
- acdha 4y ago
  You can. You can also continue to use private CAs, which presumably could be used to add more options if something happens to Let’s Encrypt.
- PenguinCoder 4y ago
  Not for LAN only personal websites.
  - sli 4y ago
    Why not just self-sign for that? Outside of using it to test configurations or deployments, SSL seems a lot less necessary if it's just inside a LAN and all the clients are known.
    - PenguinCoder 4y ago
      Some services don't work without HTTPS or transport security. Sometimes, I want transport security on traffic for various reasons. Current mainstream browsers are also refusing to connect to 'self signed certificate' HTTPS sites because they're 'insecure' and continually are disallowing you the user to bypass these 'protections'.
  - diarrhea 4y ago
    Dumb question, but how is HTTP important on local, switched networks? I have a single switch and don’t fear local MitM. I was under the impression basic HTTP is mostly fine then. Other parties, even on that same switch, won’t be able to listen in (a network hub would allow this).
    - sdfhbdf 4y ago
      Some web features are only available on HTTPS and browser really discourage users from entering websites with self-signed certificates. See: https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts/features_restricted_to_secure_contexts https://developer.mozilla.org/en-US/docs/Web/Security/Secure...
    - PenguinCoder 4y ago
      I don't get what you're asking. Why is HTTP/S important?? I don't know how to answer that for you. Security is important regardless of where it is at. Defense in depth, at multiple layers. I don't fear MITM on a local only HTTPS server, I might not trust other devices/traffic on my network that scoop up _everything_ it can, and being in plaintext, would expose more than I want. I trust my services and devices. I don't trust everything on the network especially devices that are not mine, or that I have no control over (set top boxes, Roku TVs, Sec Cameras/NVRs, etc). Of course I have other controls and protections in place, but I trust and WANT LOCAL HTTPS on my services in addition to those.
      - diarrhea 4y ago
        > I don't fear MITM on a local only HTTPS server > I trust my services and devices That is exactly the point. You trust your local, possibly dumb aka unmanaged switch. It's a little piece of silicone with no funny business going on. Now if you plug a trusted device A as well as an untrusted device B in, the untrusted device won't see any traffic meant for device A: https://wiki.wireshark.org/CaptureSetup/Ethernet#switched-ethernet https://wiki.wireshark.org/CaptureSetup/Ethernet#switched-et... Point being: as long as you trust all network devices from a trusted machine to another, on a switched Ethernet network, no other device will see any of that traffic at all, on a fundamental, low OSI level. It's not even about HTTP/S at that point yet. All this is untrue for WiFi, where you will want HTTPS indeed. I'm not advocating against HTTPS at all. I use it as much as possible. But it might actually not be necessary, locally under the right circumstances.
- csomar 4y ago
  Let'sEncrypt is still a third-party entity.
- superkuh 4y ago
  From my original comment, >Just to preempt misunderstanding: HTTPS is great. But HTTPS only, with no option for HTTP is very much worse than HTTP+HTTPS for human people. Despite being great for for profit companies and institutions. Using LE is great. It's problematic that literally everyone uses it but it's better than it not existing. But using LE does not solve the problem of not being able to use plain HTTP.
deleted 4y ago
[deleted]
e12e 4y ago
> HTTP/2 and HTTP/3 implemenations require the use of CA based TLS. Well, the standard doesn't, but the browser(s?) implantation(s) do?: https://http2.github.io/faq/#does-http2-require-encryption https://http2.github.io/faq/#does-http2-require-encryption
- superkuh 4y ago
  Very few people are going to be setting the compile time options for the libraries that implement HTTP/3 to enable plain HTTP/3 (no one has for HTTP/2). So Google, MS, Apple, etc not supporting plain HTTP/3 is a defacto standard more powerful than the spec Google/MS openwashed through the IETF.
avx56 4y ago
Honestly I don't think browsers will drop HTTP/1 anytime soon because it's inconvenient/impossible to do HTTPS on a local network. I mean, Chrome shows Not Secure on http connections, but not on localhost, and it doesn't mean much anyway. Which is FINE. I mean, maybe input[type=password] gets an alert on HTTP? Just a thought.
exitheone 4y ago
Nothing prevents you from using a self signed cert. It adds security for local deployments as well because you either trust the local CA or your browser tells you that someone has owned your network
- PenguinCoder 4y ago
  > Nothing prevents you from using a self signed cert. With the various web browsers continuing to disallow or blar warnings about "SELF SIGNED CERT", this is not true. There's a lot of _current issues_ trying to access a self signed HTTPS site using mainstream browsers because they know better than you do.
  - exitheone 4y ago
    That is just an implementation detail. It's trivial to create your own local CA, put it into the trust store of your device, use a cert signed by it and be done with it.
- superkuh 4y ago
  I've been using self-signed certs on my websites for 20 years. Part of the problem is that the HTTP/3 implementations do not allow the use of self signed certs. CA based only.
  - exitheone 4y ago
    That is just an implementation detail. It's trivial to create your own local CA, put it into the trust store of your device, use a cert signed by it and be done with it.
    - superkuh 4y ago
      And that's fine if it's only you and some friends using it. But if I want a random person on the other side of the world to be able to search for $topic and load my website it's not gonna work. For the last decade or so I've gotten about 1k hits per day on my self-signed HTTP+HTTPS site. Random people will click past the scare tactics of modern browsers re: self signed if the topic is already technical and the demographic understands browsers are stupid. But all these people would be unable to visit under HTTP/2 or HTTP/3 only.
est 4y ago
> But HTTPS only, with no option for HTTP is very much worse Have to agree with this. Been playing with `window.addEventListener('devicemotion')` recently, that shit is https only, which means I can't debug it on a simple localhost. WTF.
- diarrhea 4y ago
  Try a quick and dirty local reverse proxy like Caddy. It provides self-signed localhost TLS, trusted on the OS level (if you agree) such that the browser is none the wiser.
  - est 4y ago
    That's not quick n' dirty, that's a lot of hassle. I want write index.html and open the local file in a browser and that's it.
- tgv 4y ago
  $ python -m http.server then connect to :8000
  - est 4y ago
    that's not TLS
- marvinblum 4y ago
  https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert
astrange 4y ago
Tell your browser to stop putting up warnings about self-signed TLS then. I don’t think this is a conspiracy by Big TLS. Rather I think people are mad ISPs are injecting ads into their websites.
opportune 4y ago
HTTP/1.1 is never going away. Cloud vendors will need to support it approximately forever because so many applications are not HTTP/2 compliant, and technically not even HTTP/1.1 compliant (because of things like header casing) in a way that precludes “down casting” after ingress without a lot of hacky workarounds.

MuffinFlavored 4y ago

> HTTP/2 and HTTP/3 implemenations require the use of CA based TLS. You can't do LetsEncrypt?

acdha 4y ago
You can. You can also continue to use private CAs, which presumably could be used to add more options if something happens to Let’s Encrypt.
PenguinCoder 4y ago
Not for LAN only personal websites.
- sli 4y ago
  Why not just self-sign for that? Outside of using it to test configurations or deployments, SSL seems a lot less necessary if it's just inside a LAN and all the clients are known.
  - PenguinCoder 4y ago
    Some services don't work without HTTPS or transport security. Sometimes, I want transport security on traffic for various reasons. Current mainstream browsers are also refusing to connect to 'self signed certificate' HTTPS sites because they're 'insecure' and continually are disallowing you the user to bypass these 'protections'.
- diarrhea 4y ago
  Dumb question, but how is HTTP important on local, switched networks? I have a single switch and don’t fear local MitM. I was under the impression basic HTTP is mostly fine then. Other parties, even on that same switch, won’t be able to listen in (a network hub would allow this).
  - sdfhbdf 4y ago
    Some web features are only available on HTTPS and browser really discourage users from entering websites with self-signed certificates. See: https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts/features_restricted_to_secure_contexts https://developer.mozilla.org/en-US/docs/Web/Security/Secure...
  - PenguinCoder 4y ago
    I don't get what you're asking. Why is HTTP/S important?? I don't know how to answer that for you. Security is important regardless of where it is at. Defense in depth, at multiple layers. I don't fear MITM on a local only HTTPS server, I might not trust other devices/traffic on my network that scoop up _everything_ it can, and being in plaintext, would expose more than I want. I trust my services and devices. I don't trust everything on the network especially devices that are not mine, or that I have no control over (set top boxes, Roku TVs, Sec Cameras/NVRs, etc). Of course I have other controls and protections in place, but I trust and WANT LOCAL HTTPS on my services in addition to those.
    - diarrhea 4y ago
      > I don't fear MITM on a local only HTTPS server > I trust my services and devices That is exactly the point. You trust your local, possibly dumb aka unmanaged switch. It's a little piece of silicone with no funny business going on. Now if you plug a trusted device A as well as an untrusted device B in, the untrusted device won't see any traffic meant for device A: https://wiki.wireshark.org/CaptureSetup/Ethernet#switched-ethernet https://wiki.wireshark.org/CaptureSetup/Ethernet#switched-et... Point being: as long as you trust all network devices from a trusted machine to another, on a switched Ethernet network, no other device will see any of that traffic at all, on a fundamental, low OSI level. It's not even about HTTP/S at that point yet. All this is untrue for WiFi, where you will want HTTPS indeed. I'm not advocating against HTTPS at all. I use it as much as possible. But it might actually not be necessary, locally under the right circumstances.
csomar 4y ago
Let'sEncrypt is still a third-party entity.
superkuh 4y ago
From my original comment, >Just to preempt misunderstanding: HTTPS is great. But HTTPS only, with no option for HTTP is very much worse than HTTP+HTTPS for human people. Despite being great for for profit companies and institutions. Using LE is great. It's problematic that literally everyone uses it but it's better than it not existing. But using LE does not solve the problem of not being able to use plain HTTP.

deleted 4y ago

[deleted]

e12e 4y ago

> HTTP/2 and HTTP/3 implemenations require the use of CA based TLS. Well, the standard doesn't, but the browser(s?) implantation(s) do?: https://http2.github.io/faq/#does-http2-require-encryption https://http2.github.io/faq/#does-http2-require-encryption

superkuh 4y ago
Very few people are going to be setting the compile time options for the libraries that implement HTTP/3 to enable plain HTTP/3 (no one has for HTTP/2). So Google, MS, Apple, etc not supporting plain HTTP/3 is a defacto standard more powerful than the spec Google/MS openwashed through the IETF.

avx56 4y ago

Honestly I don't think browsers will drop HTTP/1 anytime soon because it's inconvenient/impossible to do HTTPS on a local network. I mean, Chrome shows Not Secure on http connections, but not on localhost, and it doesn't mean much anyway. Which is FINE. I mean, maybe input[type=password] gets an alert on HTTP? Just a thought.

exitheone 4y ago

Nothing prevents you from using a self signed cert. It adds security for local deployments as well because you either trust the local CA or your browser tells you that someone has owned your network

PenguinCoder 4y ago
> Nothing prevents you from using a self signed cert. With the various web browsers continuing to disallow or blar warnings about "SELF SIGNED CERT", this is not true. There's a lot of _current issues_ trying to access a self signed HTTPS site using mainstream browsers because they know better than you do.
- exitheone 4y ago
  That is just an implementation detail. It's trivial to create your own local CA, put it into the trust store of your device, use a cert signed by it and be done with it.
superkuh 4y ago
I've been using self-signed certs on my websites for 20 years. Part of the problem is that the HTTP/3 implementations do not allow the use of self signed certs. CA based only.
- exitheone 4y ago
  That is just an implementation detail. It's trivial to create your own local CA, put it into the trust store of your device, use a cert signed by it and be done with it.
  - superkuh 4y ago
    And that's fine if it's only you and some friends using it. But if I want a random person on the other side of the world to be able to search for $topic and load my website it's not gonna work. For the last decade or so I've gotten about 1k hits per day on my self-signed HTTP+HTTPS site. Random people will click past the scare tactics of modern browsers re: self signed if the topic is already technical and the demographic understands browsers are stupid. But all these people would be unable to visit under HTTP/2 or HTTP/3 only.

est 4y ago

> But HTTPS only, with no option for HTTP is very much worse Have to agree with this. Been playing with `window.addEventListener('devicemotion')` recently, that shit is https only, which means I can't debug it on a simple localhost. WTF.

diarrhea 4y ago
Try a quick and dirty local reverse proxy like Caddy. It provides self-signed localhost TLS, trusted on the OS level (if you agree) such that the browser is none the wiser.
- est 4y ago
  That's not quick n' dirty, that's a lot of hassle. I want write index.html and open the local file in a browser and that's it.
tgv 4y ago
$ python -m http.server then connect to :8000
- est 4y ago
  that's not TLS
marvinblum 4y ago
https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert

astrange 4y ago

Tell your browser to stop putting up warnings about self-signed TLS then. I don’t think this is a conspiracy by Big TLS. Rather I think people are mad ISPs are injecting ads into their websites.

opportune 4y ago

HTTP/1.1 is never going away. Cloud vendors will need to support it approximately forever because so many applications are not HTTP/2 compliant, and technically not even HTTP/1.1 compliant (because of things like header casing) in a way that precludes “down casting” after ingress without a lot of hacky workarounds.