14 ms·

Google and HTTP (2018)

80 points by mpweiher 3y ago

odrling 3y ago
You could have a LetsEncrypt setup in less time than it takes to write this rant...
- davewiner 3y ago
  You should try Caddy -- it's even easier.
- bullen 3y ago
  No, and then when it's down you can't update the certificate.
  - josephcsible 3y ago
    No, there are other free CAs too, and ACME clients can let you enable automatic fallback, so you literally don't have to do anything to fix it: https://github.com/caddyserver/caddy/pull/3862 https://github.com/caddyserver/caddy/pull/3862
    - bullen 3y ago
      I don't want to run a certificate server. I serve nothing worth encrypting and never will. For auth. I use: https://datatracker.ietf.org/doc/html/rfc2289 https://datatracker.ietf.org/doc/html/rfc2289 Quantum safe for eternity.
forgotmypw17 3y ago
I agree, HTTP prioritizes accessibility and lack of central authority.
- bullen 3y ago
  Me too, DNS (UDP 53) is enough centralization. SMTP (TCP 25) and HTTP (TCP 80) are the pillars of the internet.
account42 3y ago
This just shows an empty page for me.
- anderspitman 3y ago
  Your browser is probably blocking it for not using HTTPS /s https://web.archive.org/web/20230704151648/http://this.how/googleAndHttp/ https://web.archive.org/web/20230704151648/http://this.how/g...
  - davewiner 3y ago
    Haha perfect demo! ;-)
LammyL 3y ago
I don’t think people remember the days when ISPs/free wifi hotspots would inject their own ads into the content of pages served over http, or replace urls on YouTube content to show lower resolution copies of videos.
- tlarkworthy 3y ago
  Still do in Germany
  - Semaphor 3y ago
    Who and where? How even, with the lack of http sites?
    - tlarkworthy 3y ago
      This German webhost does not include SSL in it's bare bones package without surcharge. Thus my kita had no SSL certificate, and thus I could detect my ISP or some hacked router injecting ads (Berlin) when I used that site. There are plenty of local http sites due to German's (reasonable) distrust of US companies and a propensity to roll their own https://m.all-inkl.com/webhosting/privat/#&ui-state=dialog https://m.all-inkl.com/webhosting/privat/#&ui-state=dialog
      - Semaphor 3y ago
        > thus I could detect my ISP or some hacked router injecting ads The later sounds far more plausible than an ISP trying to get sued to the ground.
- einr 3y ago
  This is not an argument in favour of a search engine/browser penalizing HTTP servers.
  - ddalex 3y ago
    I mean it's a free world, let's all use browsers and search engines that don't penalize HTTP
JackSlateur 3y ago
I find this post .. disturbing HTTPS is not only about "asking user for data" It is also: - preventing third party from spying on you - preventing third party from altering the content presented to the user Yes, yes, 20 years old websites do not have https Is running a 20 years old software a good idea, on the internet ? Of course not What is the point of this post ? I read the "why google really wants you to use https" and failed to find any sense in this Is this meaningless ?
- forgotmypw17 3y ago
  The privacy protection is a benefit, but it is balanced against accessibility, which is often more important, such as when trying to access important information on an older device.
  - josephcsible 3y ago
    How old is the last device you know of that supports insecure HTTP but not HTTPS?
    - sam_lowry_ 3y ago
      My Mikrotik routers? My Openwrt routers? Lots of networking equipment works over HTTP only, still. I am actually really pissed off that I can not use Chromium password manager to save HTTP credentials for these devices.
      - Railander 3y ago
        > Lots of networking equipment works over HTTP only, still. MikroTik has supported https for a very very long time, though it comes disabled by default and even if it didn't it wouldn't work because it requires the user creating/importing a cert to use with it. At least the cert manager is quite intricate and they have a video (assuming the device has a valid WAN IP) on how to set it up with letsencrypt.
      - josephcsible 3y ago
_9hey 3y ago
I hadn't put much thought into it until this post, sailing under the assumption that encrypted is always better. There is so much that this post got right. > It's like a massive book burning, at a much bigger scale than ever done before
- pixl97 3y ago
  No this is not, it's hyperbolic bullshit. The internet is not a passive medium. The information highway is actually a decent description, much like the road if people don't maintain their cars they become a danger, so the internet is the same.
whirlwin 3y ago
I don't get the author's hatred towards TLS. Does he/she not understand how it works?
pietro72ohboy 3y ago
It’s a lot of emotional arguments without any technical substance. I agree that for personal static information HTTP is good enough. Another good use case is the usage of HTTP for distribution of update packages for distorts like Debian since the OS can validate those packages using signatures. Other than that, HTTPS does make the web more secure and I don’t see a reason to rally against its widespread adoption.
- _9hey 3y ago
  It's not an argument against HTTPS, it's an argument to protect the relics of the past. Google doesn't provide access to results past the first 5 pages or so anyways, they have a track record for destroying the internet.
anderspitman 3y ago
While I do think this is an important conversation to have, and part of an even more important conversation about how much control Google/Chrome has over the web, I grudgingly disagree. I think signed data is table stakes for any communication over the internet, and encryption in most cases. Let's Encrypt/ACME make encryption accessible enough in theory. That said, we're not there yet. Domain names still need to be easier to buy and use, and more software should use ACME by default (like Caddy does).
lagt_t 3y ago
The author doesn't understand the scope of https and it shows. The victim complex is strong, calling that email "threatening".
aqibgatoo 3y ago
Yes, being a leader doesn't mean having authority over a protocol
Santosh83 3y ago
It isn't HTTPS that's the issue so much as centralisation under CAs. Self signed certificates should not throw up a warning on sites that don't deal with sensitive data.
- dimal123 3y ago
  [flagged]
- josephcsible 3y ago
  > Self signed certificates should not throw up a warning on sites that don't deal with sensitive data. I would have went with a slightly different suggestion: Self signed certificates should not throw up any warnings that wouldn't appear for the same site visited over insecure HTTP, since the latter is strictly more dangerous.
  - ComputerGuru 3y ago
    Absolutely. Submitted: https://news.ycombinator.com/item?id=36589269 https://news.ycombinator.com/item?id=36589269
  - woodruffw 3y ago
    > Self signed certificates should not throw up any warnings that wouldn't appear for the same site visited over insecure HTTP, since the latter is strictly more dangerous. For an unknown server, they're strictly equivalent: trusting a self-signed certificate is the canonical "private chat with the devil" example. You could argue that it prevents some other unknown adversary from reading your traffic on the line, but that's a weird threat model (why would an adversary even bother, when you'll accept any certificate they give you?). More fundamentally: a policy among browsers to trust self-signed certs if the only other option is HTTP is way easier for an adversary to MiTM: instead of attacking TLS itself, they can redirect your entire connection to an inauthentic server with a self-signed certificate. Not throwing up any warnings for that case would mean that browsers would automatically trust the inauthentic server.
    - 3y ago
aodonnell2536 3y ago
While I don’t necessarily agree with all the points in this article (it takes only a little more effort to make a site https rather than http), I do think comparing the complete deprecation of http to a wide scale book burning is on the nose. As the author said, many old http sites that have been on the web for more than a decade are rarely maintained, if at all. Removing access to these sites in totality would definitely take a large percentage of them offline for good. This should be avoided.
- josephcsible 3y ago
  If a Web server hasn't had any maintenance done to it since before the dawn of HTTPS, then it's probably since been hacked and defaced anyway.
- pixl97 3y ago
  I think of the internet more like a public highway and not a library. Things on the road must be maintained as to not be a danger to others.
  - aodonnell2536 3y ago
    Wholeheartedly disagree. People should be responsible for their own safety and well-being, and the internet is inarguably a global public library. Your argument is also adjacent, if not identical, to pro-censorship dogma, which I am against.
    - pixl97 3y ago
      "Oh crap, the library is DDOSing me... AGAIN!" Said no one.
      - aodonnell2536 3y ago
        Please elaborate on how the Internet is not a de facto public library
sholladay 3y ago
I love the creativity and historical value of the open web, but I don’t get this anti-HTTPS stance. These days, it is easy for site administrators to upgrade to HTTPS without modifying their content. Get a free certificate from Let’s Encrypt, set up redirects, and then add the Strict-Transport-Security header to further secure the site and reduce network traffic from the redirects. Your only new external dependency there is Let’s Encrypt, which is run by a non-profit. And if you’re ever unhappy with them, you can always switch to another provider and most people won’t even notice.
- paganel 3y ago
  Will that “non-profit” be ok with my site raving about Russia’s involvment in Ukraine? What about a fan website for the Iranian Ayatollah? Or a website describing in detail Taiwan’s vulnerable targets just as China is about to attack them? Chances are that the answer to all those questions is “no, the Western-run Let’s Encrypt will not be ok with all that” and if it were for the push to come to the shove (or whatever the expression is) they’ll be more than glad to invalidate that certificate (or worse, to compromise it without letting you know). Granted, the same thing will most probably happen with one’s DNS provider and with his/her ISP, but why have another dependency if one can avoid it?
  - sholladay 3y ago
    Let’s Encrypt was created in part to take humans out of the loop where possible. LE does not review your site and that is made obvious by the speed of getting a certificate and the automated renewals, etc. They aren’t aware of you unless there’s a technical error or you’ve made headline news. That said, I agree with you that there is some level of risk here, even if it is small. That’s why your ability to switch is so important. Even if they became aware of you and they decided to revoke your certificate, you would just switch providers. Because of that, they have no meaningful power over you. If it ever becomes difficult to switch, then things are getting bad. > or worse, to compromise it without letting you know What does that mean? The certificate either passes validation or it doesn’t. They aren’t able to change the content on your site or anything like that.
drewg123 3y ago
The point they they seem to omit is that TLS roughly doubles the cost to serve static content, assuming no hardware offloads are used. Roughly 40% of our CPU time on the Netflix CDN (on nodes w/o TLS offload NICs) is spent doing TLS crypto. I'm not saying I'm against TLS, far from it. But it does carry costs, and I'm surprised somebody so passionately against TLS would omit this argument.
- ComputerGuru 3y ago
  Probably because for static text sites the compute cost of TLS is negligible (and we're largely talking about either small personal blogs or the long tail of historic content, so traffic is already assumed to be minimal). In your case, TLS is rather unfortunate since you can just include a crypto hash (or merkle tree or whatever) of the payload in your HTTPS control connection, then just load your video payloads over HTTP and check for a mismatch client-side. Basically, Google is saying they don't trust "you" to get it right. The bigger problem with TLS is that it adds so much brittleness and complexity (do you know how many times I've broken ACME/LE python dependencies by accident?) and increases the time-to-first-byte for so many sites, especially if you're not getting your hands dirty with nginx and OpenSSL internals. (Even if you are tuning all the right knobs, one thing we didn't realize was that at some point using an EV SSL certificate (before Chrome removed the UI benefits of doing so) began causing a massive increase in TTFB that there doesn't (didn't?) seem to be any way to avoid, so we ended up moving to regular TLS/SSL certs w/ Let's Encrypt not for the free cost of entry but for the reduced initial connection time. I can't remember the exact details now as it's been some years, but I think with EV SSL there's a secondary cert or revocation lookup to a remote url even if you have correctly configured ocsp stapling.)
- jeffbee 3y ago
  But would that be relevant? In other words, are CDN nodes CPU-limited? Or, does the bulk encryption absorb otherwise unused CPU time? I would have imagined that most Netflix traffic is to clients that Netflix itself controls, like Roku apps or other first-party apps and not web browsers, so Netflix could choose against encryption for most streams.
  - 3y ago
geonnave 3y ago
The way the author begins the article makes you think Google is trying to s/HTTP/$NEW_PROPRIETARY_PROTOCOL/, although they just mean s/HTTP/HTTPS/.
- forgotmypw17 3y ago
  HTTPS may not be proprietary, but it comes with many of the same drawbacks: central control, lack of transparency, more difficult to debug, and less accessible in many circumstances.
  - SahAssar 3y ago
    > central control What central control? Your browser uses a trust store and there are multiple independent (but collaborating) groups that decide what CA:s to trust. The rest of your supposed drawbacks seem like they would be the same in any system with encryption, right?
    - forgotmypw17 3y ago
      You rely on one of several central authorities to grant a user access to your website (or be faced with a scary message about your site being insecure). Just because you can choose from one of several central authorities doesn't change the fact that you are reliant on them to authorize the user's ability to establish a network connection with you.
      - SahAssar 3y ago
        That means it is more like federated control IMO.
        forgotmypw17 3y ago
        Whatever you want to call it, it creates extra complexity, failure modes, and barriers to information access.
- 3y ago
beardog 3y ago
One point the author neglects is that merely browsing an informational site is sensitive depending on social and political context. Examples: * Woman views information on abortions or reproductive health care in a jurisdiction that persecutes over that * Queer person views information pertaining to LGBT services/issues in a jurisdiction or LAN that would punish them * Person views information on protests * Person reads the news about a crime[1] TLS does not solve this problem entirely (SNI/DNS leaks, traffic shape analysis) but it helps. I would not expect search engines/browsers to try to determine if a site publishes 'controversial' content especially since that depends on who you ask. [1] https://www.usatoday.com/story/news/politics/2021/06/05/fbi-withdraws-usa-today-subpoena-seeking-reader-identity/7561422002/ https://www.usatoday.com/story/news/politics/2021/06/05/fbi-...
- beardog 3y ago
  Also, American ISPs are allowed to sell your browsing information. https://www.howtogeek.com/724472/do-isps-track-and-sell-your-browsing-data/ https://www.howtogeek.com/724472/do-isps-track-and-sell-your...
- CaptainFever 3y ago
  As you mentioned, TLS doesn’t solve this problem entirely since the ISP can still see what domains you visit. For those use cases, people should really be using Tor instead. In that case, if the website is public, HTTPS doesn’t really serve a purpose since the exit node isn’t going to get any private information. Perhaps HTTPS does help if the sensitive information is hidden in a wide-ranging domain (e.g. Reddit, Twitter) and because support for it is so widespread. In those cases, HTTPS is likely already supported. However, if the politically sensitive but public information is on a small domain, such as a personal blog or informational topical site, HTTPS serves almost no purpose there since it’s obvious what your activities are from the domain. In that case, one should definitely rely on Tor.
jeffbee 3y ago
Dave Winer has made his whole career out of being wrong about things. Why stop now?
bmacho 3y ago
(2020)
ComputerGuru 3y ago
I had a different (and imho, more pressing) argument for rejecting the "all-or-nothing" approach Google has taken towards HTTPS, namely that it actually punishes basically all non-enterprise intranet/lan devices using TLS/SSL because it makes them harder to access than if they only used HTTP instead [0]. The question that Google seemed to ignore (and still does) is "how do you expect a newly unboxed network device to ship with a non-self-signed SSL certificate?" The workaround some manufacturers have come up with is more repulsive than the original (There was one Chinese manufacturer that tried to get a signed certificate for a domain, then mapped that domain to 192.168.0.1 and shipped the private ssl cert w/ every router iirc. TP-Link has their own weird workaround where they give you a domain to log in to the router instead of the IP, and their router MITMs the connection and redirects to HTTP.) Google forcing everyone to HTTPS is one thing, Google forcing everyone to HTTPs and universally treating self-signed HTTPS connections as scams is another. [0]: https://neosmart.net/blog/lets-stop-punishing-iot-devices-that-embrace-https-shall-we/ https://neosmart.net/blog/lets-stop-punishing-iot-devices-th...
- zokier 3y ago
  in theory it would be neat to have dhcp option for acme server, which would allow automatic provisioning (short-lived) certs to lan hosts. basically all the building blocks are there
- tialaramex 3y ago
  The specific thing that Chinese manufacturer was doing wrong was shipping everybody the same private key, which means Mallory gets given Alice's key. This trick but for individual devices is fine, even recommended. But of course if the keys are each different that costs more than shipping devices which are identical...
- SahAssar 3y ago
  I've implemented https for IoT devices in a similar way that plex did it. Basically every device got a cert for *.$MAC_ADDRESS.myiot.com and then the DNS for myiot.com would essentially bounce back 192_168_10_10.$MAC_ADDRESS.myiot.com to an A record for 192.168.10.10 You needed to know the IP for the device still (in our case we still had a central service keeping track of it), but the principle works. For cheap IoT I guess the cost of the certs can be too large though, we couldn't use letsencrypt due to limits on the number of certs per domain.
davewiner 3y ago
They're breaking the web. That's the point. All other arguments you're presenting about HTTPS being easy (it is, have you tried Caddy) are moot. It's the sites that were made before Google took over control that aren't maintained that are at issue. And the idea that a for-profit company that no one should trust is saying they're the only ones you have to trust. And the fact that many of us adopted the web because it was a platform that no company controlled. If it had been presented as Google's platform I would have run the other way and would have advised you to do the same. But now I'm invested. My freedom as a developer depends on the integrity of the web. And a web controlled by Google isn't the web. Google has a nasty habit of taking control of open protocols and then trashing them. Roll up your sleeves, make some quiet time and actually READ THE DOCUMENT. http://this.how/googleAndHttp http://this.how/googleAndHttp Breaking the web is the issue folks.
- nlewycky 3y ago
  I can't READ THE DOCUMENT because it isn't on the web. Do you have an https link? Or a mirror somewhere on the web?
  - gkbrk 3y ago
    Works on a few machines / connections I tried. Perhaps you should switch to a better browser or change your ISP if they don't let you visit websites that are on the web.
- pixl97 3y ago
  I click the link but it keeps showing me porn and asks for my Google username and password. That's some weird content to post to hackernews.
cutler 3y ago
Same way Google broke SMTP. Even SPF isn't enough anymore.
- LeonM 3y ago
  > Even SPF isn't enough anymore. SPF is a old and horribly broken standard, and should not be relied on for at least 10 years now. DKIM and DMARC is the way to go for outbound SMTP. Google didn't break SMTP, spammers did.
  - pixl97 3y ago
    Heh, so many anti-https people here that seem clueless the internet is not a safe place. There is always someone out there looking to exploit you on the net.
- jeroenhd 3y ago
  SPF was a bandaid on a flesh wound. SPF+DKIM+reverse PTR(+DMARC unless you like discovering your email hasn't been arriving for months) are almost good enough (except that DKIM doesn't sign the things you expect it to sign). Google and Microsoft still killed email with their unreliable spam filters, but SPF alone was never enough. SMTP still works fine though.
  - cutler 3y ago
    .... unless your mailserver's IP/network has been blacklisted by said behemoths.
    - LeonM 3y ago
      Given that you talk about 'even' implementing SPF, and now about IP blacklisting gives me the impression you haven't actually worked (or kept up with) email over the last 10 years. None of the major email service providers (or 'behemoths', as you call them) use IP blacklisting anymore. They abandoned that idea years ago. IP addresses are ephemeral, especially when IPv6 is used, so IP blacklisting simply does not work anymore. If we were to use IP based blacklisting we'd have blacklisted the entire IPv4 address space by now. Yes, like any other SMTP service they will block IP addresses momentarily if you misbehave, but never permanently. All major spam filters are content based, and reputation is always on the domain level, not IP level. If you properly configure your email infrastructure, and you don't spam, then deliverability really shouldn't be a problem.
TekMol 3y ago
It's not hard to convert to HTTPS and it doesn't cost a lot. I have to disagree. Certificates are still a pain in the butt. The reason is that the only free and "easy" solution is Let's Encrypt. And they make it a pain in the butt. You can get a certificate for domain.com by putting a file into domain.com/.well-known/ - so far so good. But you cannot get a wildcard certificate for domain.com this way. For no reason as far as I know. Who owns domain.com but not bla.domain.com? And I don't want all my subdomains listed in a public directory. So only a wildcard cert makes sense for me. Which means fiddling with DNS entries every 3 months. Or setting up some complex, brittle scheme to automatically update those every 3 months. Which then depends on the API of some name server provider. Which will work differently for every provider.
- woodruffw 3y ago
  There's general consensus in the Web PKI world that wildcards in certificates were a mistake. RFC 6125 has an entire section dedicated to security considerations[1]. > For no reason as far as I know. Who owns domain.com but not bla.domain.com? Many, many services[2]. DNS is fundamentally hierarchical, but not in a way that implies authority or control: the owners/operators of `com.` should not be able to obtain a wildcard certificate for `*.com.` and thereby read the traffic of `google.com`, `facebook.com`, etc. [1]: https://datatracker.ietf.org/doc/html/rfc6125#section-7.2 https://datatracker.ietf.org/doc/html/rfc6125#section-7.2 [2]: https://en.wikipedia.org/wiki/Public_Suffix_List https://en.wikipedia.org/wiki/Public_Suffix_List
zootboy 3y ago
Since we're already complaining about "New thing Bad, Old thing Better," why oh why does this blog require third-party JS from three separate domains (s3.amazonaws.com, fargo.io, and scripting.com) just to render a page of static text with minimal styling? The only user-visible thing I can see that uses JS is the section folding thing, which can be done with no JS using the <details> tag on modern-ish browsers, or a tiny chunk of inline JS if you want to support older browsers.
dang 3y ago
Discussed at the time: Google and HTTP - https://news.ycombinator.com/item?id=16461923 https://news.ycombinator.com/item?id=16461923 - Feb 2018 (58 comments)
2h 3y ago
dudes shitty website wont even load unless you allow JavaScript from these domains: fargo.io scripting.com
- wackget 3y ago
  Yeah seriously this is a joke. I just wrote [a comment](https://news.ycombinator.com/item?id=36593620 https://news.ycombinator.com/item?id=36593620) saying basically the same thing.
- amstan 3y ago
  Looks like scripting.com is from the same owner.
wackget 3y ago
I see a lot of hypocritical bullshit on Hacker News - a lot of it from websites which frustratingly lack HTTPS support - but this takes the cake. This has got to be some of the most hypocritical bullshit I've ever read. This all-text website, wherein the author espouses the benefits of "the open web" and rails against the corporate overlords who would destroy the web... this all-text website won't even load unless you enable third-party JavaScript access from FOUR external domains[1]. A fifth domain loads a font from - you guessed it - Google Fonts. This has got to be satire. [1](https://i.imgur.com/rKj4Xkv.png https://i.imgur.com/rKj4Xkv.png) P.S. Nobody's mentioned encryption as a means against against surveillance. You might be fine browsing websites openly in HTTP, but the poor soul in China might just appreciate transport-level encryption and encrypted DNS when they choose to read whatever innocuous pro-democracy blog their country has deemed unsuitable.
- galkk 3y ago
  Alas, in $CURRENT_YEAR I do think that for non-technical people the https can not guarantee no eyesdropping by government. In fact, I personally believe that in many countries this is already happening in one way or another. example from 2019: https://meduza-io.translate.goog/cards/zhiteley-kazahstana-zastavlyayut-ustanovit-natsionalnyy-sertifikat-bezopasnosti-chto-proishodit?_x_tr_sl=en&_x_tr_tl=ru&_x_tr_hl=en&_x_tr_pto=wapp https://meduza-io.translate.goog/cards/zhiteley-kazahstana-z...
- johnea 3y ago
  You're not wrong about the javascript, but that doesn't make you right about the https. This enforcement is ridiculous. I've wondered if I had chance at a law suite against goggle (and their lapdogs at mozzila foundation) for calling some of my domains "illegitimate" because I use self-signed certs. Just because I didn't pay twate, or get my cert from someone else who paid twate, doesn't mean my site is "illegitimate". Luckily for me, I'm not trying to launch the next twitverse. I use those domains for my own work, they're not out there to be popular. The article never delves into the world of small network attached devices, some of which are in use long long after their manufactures have been purchased and shut down by the same asshole trying to make you throw it out because it's encryption algorithms are too old, or, Oh No!!!, it uses http for it's webinterface. In the end, https only is goggle power play propped up by fanboi-ism...
Blahagun 3y ago
> That was because the networking standards prior to the web were complicated and not well documented. I have to disagree with this one. I have written networking applications with X Window UI in C from scratch only by reading man pages.

80 points by mpweiher 3y ago

odrling 3y ago

You could have a LetsEncrypt setup in less time than it takes to write this rant...

davewiner 3y ago
You should try Caddy -- it's even easier.
bullen 3y ago
No, and then when it's down you can't update the certificate.
- josephcsible 3y ago
  No, there are other free CAs too, and ACME clients can let you enable automatic fallback, so you literally don't have to do anything to fix it: https://github.com/caddyserver/caddy/pull/3862 https://github.com/caddyserver/caddy/pull/3862
  - bullen 3y ago
    I don't want to run a certificate server. I serve nothing worth encrypting and never will. For auth. I use: https://datatracker.ietf.org/doc/html/rfc2289 https://datatracker.ietf.org/doc/html/rfc2289 Quantum safe for eternity.

forgotmypw17 3y ago

I agree, HTTP prioritizes accessibility and lack of central authority.

bullen 3y ago
Me too, DNS (UDP 53) is enough centralization. SMTP (TCP 25) and HTTP (TCP 80) are the pillars of the internet.

account42 3y ago

This just shows an empty page for me.

anderspitman 3y ago
Your browser is probably blocking it for not using HTTPS /s https://web.archive.org/web/20230704151648/http://this.how/googleAndHttp/ https://web.archive.org/web/20230704151648/http://this.how/g...
- davewiner 3y ago
  Haha perfect demo! ;-)

LammyL 3y ago

I don’t think people remember the days when ISPs/free wifi hotspots would inject their own ads into the content of pages served over http, or replace urls on YouTube content to show lower resolution copies of videos.

tlarkworthy 3y ago
Still do in Germany
- Semaphor 3y ago
  Who and where? How even, with the lack of http sites?
  - tlarkworthy 3y ago
    This German webhost does not include SSL in it's bare bones package without surcharge. Thus my kita had no SSL certificate, and thus I could detect my ISP or some hacked router injecting ads (Berlin) when I used that site. There are plenty of local http sites due to German's (reasonable) distrust of US companies and a propensity to roll their own https://m.all-inkl.com/webhosting/privat/#&ui-state=dialog https://m.all-inkl.com/webhosting/privat/#&ui-state=dialog
    - Semaphor 3y ago
      > thus I could detect my ISP or some hacked router injecting ads The later sounds far more plausible than an ISP trying to get sued to the ground.
einr 3y ago
This is not an argument in favour of a search engine/browser penalizing HTTP servers.
- ddalex 3y ago
  I mean it's a free world, let's all use browsers and search engines that don't penalize HTTP

JackSlateur 3y ago

I find this post .. disturbing HTTPS is not only about "asking user for data" It is also: - preventing third party from spying on you - preventing third party from altering the content presented to the user Yes, yes, 20 years old websites do not have https Is running a 20 years old software a good idea, on the internet ? Of course not What is the point of this post ? I read the "why google really wants you to use https" and failed to find any sense in this Is this meaningless ?

forgotmypw17 3y ago
The privacy protection is a benefit, but it is balanced against accessibility, which is often more important, such as when trying to access important information on an older device.
- josephcsible 3y ago
  How old is the last device you know of that supports insecure HTTP but not HTTPS?
  - sam_lowry_ 3y ago
    My Mikrotik routers? My Openwrt routers? Lots of networking equipment works over HTTP only, still. I am actually really pissed off that I can not use Chromium password manager to save HTTP credentials for these devices.
    - Railander 3y ago
      > Lots of networking equipment works over HTTP only, still. MikroTik has supported https for a very very long time, though it comes disabled by default and even if it didn't it wouldn't work because it requires the user creating/importing a cert to use with it. At least the cert manager is quite intricate and they have a video (assuming the device has a valid WAN IP) on how to set it up with letsencrypt.
    - josephcsible 3y ago

_9hey 3y ago

I hadn't put much thought into it until this post, sailing under the assumption that encrypted is always better. There is so much that this post got right. > It's like a massive book burning, at a much bigger scale than ever done before

pixl97 3y ago
No this is not, it's hyperbolic bullshit. The internet is not a passive medium. The information highway is actually a decent description, much like the road if people don't maintain their cars they become a danger, so the internet is the same.

whirlwin 3y ago

I don't get the author's hatred towards TLS. Does he/she not understand how it works?

pietro72ohboy 3y ago

It’s a lot of emotional arguments without any technical substance. I agree that for personal static information HTTP is good enough. Another good use case is the usage of HTTP for distribution of update packages for distorts like Debian since the OS can validate those packages using signatures. Other than that, HTTPS does make the web more secure and I don’t see a reason to rally against its widespread adoption.

_9hey 3y ago
It's not an argument against HTTPS, it's an argument to protect the relics of the past. Google doesn't provide access to results past the first 5 pages or so anyways, they have a track record for destroying the internet.

anderspitman 3y ago

While I do think this is an important conversation to have, and part of an even more important conversation about how much control Google/Chrome has over the web, I grudgingly disagree. I think signed data is table stakes for any communication over the internet, and encryption in most cases. Let's Encrypt/ACME make encryption accessible enough in theory. That said, we're not there yet. Domain names still need to be easier to buy and use, and more software should use ACME by default (like Caddy does).

lagt_t 3y ago

The author doesn't understand the scope of https and it shows. The victim complex is strong, calling that email "threatening".

aqibgatoo 3y ago

Yes, being a leader doesn't mean having authority over a protocol

Santosh83 3y ago

It isn't HTTPS that's the issue so much as centralisation under CAs. Self signed certificates should not throw up a warning on sites that don't deal with sensitive data.

dimal123 3y ago
[flagged]
josephcsible 3y ago
> Self signed certificates should not throw up a warning on sites that don't deal with sensitive data. I would have went with a slightly different suggestion: Self signed certificates should not throw up any warnings that wouldn't appear for the same site visited over insecure HTTP, since the latter is strictly more dangerous.
- ComputerGuru 3y ago
  Absolutely. Submitted: https://news.ycombinator.com/item?id=36589269 https://news.ycombinator.com/item?id=36589269
- woodruffw 3y ago
  > Self signed certificates should not throw up any warnings that wouldn't appear for the same site visited over insecure HTTP, since the latter is strictly more dangerous. For an unknown server, they're strictly equivalent: trusting a self-signed certificate is the canonical "private chat with the devil" example. You could argue that it prevents some other unknown adversary from reading your traffic on the line, but that's a weird threat model (why would an adversary even bother, when you'll accept any certificate they give you?). More fundamentally: a policy among browsers to trust self-signed certs if the only other option is HTTP is way easier for an adversary to MiTM: instead of attacking TLS itself, they can redirect your entire connection to an inauthentic server with a self-signed certificate. Not throwing up any warnings for that case would mean that browsers would automatically trust the inauthentic server.
  - 3y ago

aodonnell2536 3y ago

While I don’t necessarily agree with all the points in this article (it takes only a little more effort to make a site https rather than http), I do think comparing the complete deprecation of http to a wide scale book burning is on the nose. As the author said, many old http sites that have been on the web for more than a decade are rarely maintained, if at all. Removing access to these sites in totality would definitely take a large percentage of them offline for good. This should be avoided.

josephcsible 3y ago
If a Web server hasn't had any maintenance done to it since before the dawn of HTTPS, then it's probably since been hacked and defaced anyway.
pixl97 3y ago
I think of the internet more like a public highway and not a library. Things on the road must be maintained as to not be a danger to others.
- aodonnell2536 3y ago
  Wholeheartedly disagree. People should be responsible for their own safety and well-being, and the internet is inarguably a global public library. Your argument is also adjacent, if not identical, to pro-censorship dogma, which I am against.
  - pixl97 3y ago
    "Oh crap, the library is DDOSing me... AGAIN!" Said no one.
    - aodonnell2536 3y ago
      Please elaborate on how the Internet is not a de facto public library

sholladay 3y ago

I love the creativity and historical value of the open web, but I don’t get this anti-HTTPS stance. These days, it is easy for site administrators to upgrade to HTTPS without modifying their content. Get a free certificate from Let’s Encrypt, set up redirects, and then add the Strict-Transport-Security header to further secure the site and reduce network traffic from the redirects. Your only new external dependency there is Let’s Encrypt, which is run by a non-profit. And if you’re ever unhappy with them, you can always switch to another provider and most people won’t even notice.

paganel 3y ago
Will that “non-profit” be ok with my site raving about Russia’s involvment in Ukraine? What about a fan website for the Iranian Ayatollah? Or a website describing in detail Taiwan’s vulnerable targets just as China is about to attack them? Chances are that the answer to all those questions is “no, the Western-run Let’s Encrypt will not be ok with all that” and if it were for the push to come to the shove (or whatever the expression is) they’ll be more than glad to invalidate that certificate (or worse, to compromise it without letting you know). Granted, the same thing will most probably happen with one’s DNS provider and with his/her ISP, but why have another dependency if one can avoid it?
- sholladay 3y ago
  Let’s Encrypt was created in part to take humans out of the loop where possible. LE does not review your site and that is made obvious by the speed of getting a certificate and the automated renewals, etc. They aren’t aware of you unless there’s a technical error or you’ve made headline news. That said, I agree with you that there is some level of risk here, even if it is small. That’s why your ability to switch is so important. Even if they became aware of you and they decided to revoke your certificate, you would just switch providers. Because of that, they have no meaningful power over you. If it ever becomes difficult to switch, then things are getting bad. > or worse, to compromise it without letting you know What does that mean? The certificate either passes validation or it doesn’t. They aren’t able to change the content on your site or anything like that.

drewg123 3y ago

The point they they seem to omit is that TLS roughly doubles the cost to serve static content, assuming no hardware offloads are used. Roughly 40% of our CPU time on the Netflix CDN (on nodes w/o TLS offload NICs) is spent doing TLS crypto. I'm not saying I'm against TLS, far from it. But it does carry costs, and I'm surprised somebody so passionately against TLS would omit this argument.

ComputerGuru 3y ago
Probably because for static text sites the compute cost of TLS is negligible (and we're largely talking about either small personal blogs or the long tail of historic content, so traffic is already assumed to be minimal). In your case, TLS is rather unfortunate since you can just include a crypto hash (or merkle tree or whatever) of the payload in your HTTPS control connection, then just load your video payloads over HTTP and check for a mismatch client-side. Basically, Google is saying they don't trust "you" to get it right. The bigger problem with TLS is that it adds so much brittleness and complexity (do you know how many times I've broken ACME/LE python dependencies by accident?) and increases the time-to-first-byte for so many sites, especially if you're not getting your hands dirty with nginx and OpenSSL internals. (Even if you are tuning all the right knobs, one thing we didn't realize was that at some point using an EV SSL certificate (before Chrome removed the UI benefits of doing so) began causing a massive increase in TTFB that there doesn't (didn't?) seem to be any way to avoid, so we ended up moving to regular TLS/SSL certs w/ Let's Encrypt not for the free cost of entry but for the reduced initial connection time. I can't remember the exact details now as it's been some years, but I think with EV SSL there's a secondary cert or revocation lookup to a remote url even if you have correctly configured ocsp stapling.)
jeffbee 3y ago
But would that be relevant? In other words, are CDN nodes CPU-limited? Or, does the bulk encryption absorb otherwise unused CPU time? I would have imagined that most Netflix traffic is to clients that Netflix itself controls, like Roku apps or other first-party apps and not web browsers, so Netflix could choose against encryption for most streams.
- 3y ago

geonnave 3y ago

The way the author begins the article makes you think Google is trying to s/HTTP/$NEW_PROPRIETARY_PROTOCOL/, although they just mean s/HTTP/HTTPS/.

forgotmypw17 3y ago
HTTPS may not be proprietary, but it comes with many of the same drawbacks: central control, lack of transparency, more difficult to debug, and less accessible in many circumstances.
- SahAssar 3y ago
  > central control What central control? Your browser uses a trust store and there are multiple independent (but collaborating) groups that decide what CA:s to trust. The rest of your supposed drawbacks seem like they would be the same in any system with encryption, right?
  - forgotmypw17 3y ago
    You rely on one of several central authorities to grant a user access to your website (or be faced with a scary message about your site being insecure). Just because you can choose from one of several central authorities doesn't change the fact that you are reliant on them to authorize the user's ability to establish a network connection with you.
    - SahAssar 3y ago
      That means it is more like federated control IMO.
      - forgotmypw17 3y ago
        Whatever you want to call it, it creates extra complexity, failure modes, and barriers to information access.
3y ago

beardog 3y ago

One point the author neglects is that merely browsing an informational site is sensitive depending on social and political context. Examples: * Woman views information on abortions or reproductive health care in a jurisdiction that persecutes over that * Queer person views information pertaining to LGBT services/issues in a jurisdiction or LAN that would punish them * Person views information on protests * Person reads the news about a crime[1] TLS does not solve this problem entirely (SNI/DNS leaks, traffic shape analysis) but it helps. I would not expect search engines/browsers to try to determine if a site publishes 'controversial' content especially since that depends on who you ask. [1] https://www.usatoday.com/story/news/politics/2021/06/05/fbi-withdraws-usa-today-subpoena-seeking-reader-identity/7561422002/ https://www.usatoday.com/story/news/politics/2021/06/05/fbi-...

beardog 3y ago
Also, American ISPs are allowed to sell your browsing information. https://www.howtogeek.com/724472/do-isps-track-and-sell-your-browsing-data/ https://www.howtogeek.com/724472/do-isps-track-and-sell-your...
CaptainFever 3y ago
As you mentioned, TLS doesn’t solve this problem entirely since the ISP can still see what domains you visit. For those use cases, people should really be using Tor instead. In that case, if the website is public, HTTPS doesn’t really serve a purpose since the exit node isn’t going to get any private information. Perhaps HTTPS does help if the sensitive information is hidden in a wide-ranging domain (e.g. Reddit, Twitter) and because support for it is so widespread. In those cases, HTTPS is likely already supported. However, if the politically sensitive but public information is on a small domain, such as a personal blog or informational topical site, HTTPS serves almost no purpose there since it’s obvious what your activities are from the domain. In that case, one should definitely rely on Tor.

jeffbee 3y ago

Dave Winer has made his whole career out of being wrong about things. Why stop now?

bmacho 3y ago

(2020)

ComputerGuru 3y ago

I had a different (and imho, more pressing) argument for rejecting the "all-or-nothing" approach Google has taken towards HTTPS, namely that it actually punishes basically all non-enterprise intranet/lan devices using TLS/SSL because it makes them harder to access than if they only used HTTP instead [0]. The question that Google seemed to ignore (and still does) is "how do you expect a newly unboxed network device to ship with a non-self-signed SSL certificate?" The workaround some manufacturers have come up with is more repulsive than the original (There was one Chinese manufacturer that tried to get a signed certificate for a domain, then mapped that domain to 192.168.0.1 and shipped the private ssl cert w/ every router iirc. TP-Link has their own weird workaround where they give you a domain to log in to the router instead of the IP, and their router MITMs the connection and redirects to HTTP.) Google forcing everyone to HTTPS is one thing, Google forcing everyone to HTTPs and universally treating self-signed HTTPS connections as scams is another. [0]: https://neosmart.net/blog/lets-stop-punishing-iot-devices-that-embrace-https-shall-we/ https://neosmart.net/blog/lets-stop-punishing-iot-devices-th...

zokier 3y ago
in theory it would be neat to have dhcp option for acme server, which would allow automatic provisioning (short-lived) certs to lan hosts. basically all the building blocks are there
tialaramex 3y ago
The specific thing that Chinese manufacturer was doing wrong was shipping everybody the same private key, which means Mallory gets given Alice's key. This trick but for individual devices is fine, even recommended. But of course if the keys are each different that costs more than shipping devices which are identical...
SahAssar 3y ago
I've implemented https for IoT devices in a similar way that plex did it. Basically every device got a cert for *.$MAC_ADDRESS.myiot.com and then the DNS for myiot.com would essentially bounce back 192_168_10_10.$MAC_ADDRESS.myiot.com to an A record for 192.168.10.10 You needed to know the IP for the device still (in our case we still had a central service keeping track of it), but the principle works. For cheap IoT I guess the cost of the certs can be too large though, we couldn't use letsencrypt due to limits on the number of certs per domain.

davewiner 3y ago

They're breaking the web. That's the point. All other arguments you're presenting about HTTPS being easy (it is, have you tried Caddy) are moot. It's the sites that were made before Google took over control that aren't maintained that are at issue. And the idea that a for-profit company that no one should trust is saying they're the only ones you have to trust. And the fact that many of us adopted the web because it was a platform that no company controlled. If it had been presented as Google's platform I would have run the other way and would have advised you to do the same. But now I'm invested. My freedom as a developer depends on the integrity of the web. And a web controlled by Google isn't the web. Google has a nasty habit of taking control of open protocols and then trashing them. Roll up your sleeves, make some quiet time and actually READ THE DOCUMENT. http://this.how/googleAndHttp http://this.how/googleAndHttp Breaking the web is the issue folks.

nlewycky 3y ago
I can't READ THE DOCUMENT because it isn't on the web. Do you have an https link? Or a mirror somewhere on the web?
- gkbrk 3y ago
  Works on a few machines / connections I tried. Perhaps you should switch to a better browser or change your ISP if they don't let you visit websites that are on the web.
pixl97 3y ago
I click the link but it keeps showing me porn and asks for my Google username and password. That's some weird content to post to hackernews.

cutler 3y ago

Same way Google broke SMTP. Even SPF isn't enough anymore.

LeonM 3y ago
> Even SPF isn't enough anymore. SPF is a old and horribly broken standard, and should not be relied on for at least 10 years now. DKIM and DMARC is the way to go for outbound SMTP. Google didn't break SMTP, spammers did.
- pixl97 3y ago
  Heh, so many anti-https people here that seem clueless the internet is not a safe place. There is always someone out there looking to exploit you on the net.
jeroenhd 3y ago
SPF was a bandaid on a flesh wound. SPF+DKIM+reverse PTR(+DMARC unless you like discovering your email hasn't been arriving for months) are almost good enough (except that DKIM doesn't sign the things you expect it to sign). Google and Microsoft still killed email with their unreliable spam filters, but SPF alone was never enough. SMTP still works fine though.
- cutler 3y ago
  .... unless your mailserver's IP/network has been blacklisted by said behemoths.
  - LeonM 3y ago
    Given that you talk about 'even' implementing SPF, and now about IP blacklisting gives me the impression you haven't actually worked (or kept up with) email over the last 10 years. None of the major email service providers (or 'behemoths', as you call them) use IP blacklisting anymore. They abandoned that idea years ago. IP addresses are ephemeral, especially when IPv6 is used, so IP blacklisting simply does not work anymore. If we were to use IP based blacklisting we'd have blacklisted the entire IPv4 address space by now. Yes, like any other SMTP service they will block IP addresses momentarily if you misbehave, but never permanently. All major spam filters are content based, and reputation is always on the domain level, not IP level. If you properly configure your email infrastructure, and you don't spam, then deliverability really shouldn't be a problem.

TekMol 3y ago

It's not hard to convert to HTTPS and it doesn't cost a lot. I have to disagree. Certificates are still a pain in the butt. The reason is that the only free and "easy" solution is Let's Encrypt. And they make it a pain in the butt. You can get a certificate for domain.com by putting a file into domain.com/.well-known/ - so far so good. But you cannot get a wildcard certificate for domain.com this way. For no reason as far as I know. Who owns domain.com but not bla.domain.com? And I don't want all my subdomains listed in a public directory. So only a wildcard cert makes sense for me. Which means fiddling with DNS entries every 3 months. Or setting up some complex, brittle scheme to automatically update those every 3 months. Which then depends on the API of some name server provider. Which will work differently for every provider.

woodruffw 3y ago
There's general consensus in the Web PKI world that wildcards in certificates were a mistake. RFC 6125 has an entire section dedicated to security considerations[1]. > For no reason as far as I know. Who owns domain.com but not bla.domain.com? Many, many services[2]. DNS is fundamentally hierarchical, but not in a way that implies authority or control: the owners/operators of `com.` should not be able to obtain a wildcard certificate for `*.com.` and thereby read the traffic of `google.com`, `facebook.com`, etc. [1]: https://datatracker.ietf.org/doc/html/rfc6125#section-7.2 https://datatracker.ietf.org/doc/html/rfc6125#section-7.2 [2]: https://en.wikipedia.org/wiki/Public_Suffix_List https://en.wikipedia.org/wiki/Public_Suffix_List

zootboy 3y ago

Since we're already complaining about "New thing Bad, Old thing Better," why oh why does this blog require third-party JS from three separate domains (s3.amazonaws.com, fargo.io, and scripting.com) just to render a page of static text with minimal styling? The only user-visible thing I can see that uses JS is the section folding thing, which can be done with no JS using the <details> tag on modern-ish browsers, or a tiny chunk of inline JS if you want to support older browsers.

dang 3y ago

Discussed at the time: Google and HTTP - https://news.ycombinator.com/item?id=16461923 https://news.ycombinator.com/item?id=16461923 - Feb 2018 (58 comments)

2h 3y ago

dudes shitty website wont even load unless you allow JavaScript from these domains: fargo.io scripting.com

wackget 3y ago
Yeah seriously this is a joke. I just wrote [a comment](https://news.ycombinator.com/item?id=36593620 https://news.ycombinator.com/item?id=36593620) saying basically the same thing.
amstan 3y ago
Looks like scripting.com is from the same owner.

wackget 3y ago

I see a lot of hypocritical bullshit on Hacker News - a lot of it from websites which frustratingly lack HTTPS support - but this takes the cake. This has got to be some of the most hypocritical bullshit I've ever read. This all-text website, wherein the author espouses the benefits of "the open web" and rails against the corporate overlords who would destroy the web... this all-text website won't even load unless you enable third-party JavaScript access from FOUR external domains[1]. A fifth domain loads a font from - you guessed it - Google Fonts. This has got to be satire. [1](https://i.imgur.com/rKj4Xkv.png https://i.imgur.com/rKj4Xkv.png) P.S. Nobody's mentioned encryption as a means against against surveillance. You might be fine browsing websites openly in HTTP, but the poor soul in China might just appreciate transport-level encryption and encrypted DNS when they choose to read whatever innocuous pro-democracy blog their country has deemed unsuitable.

galkk 3y ago
Alas, in $CURRENT_YEAR I do think that for non-technical people the https can not guarantee no eyesdropping by government. In fact, I personally believe that in many countries this is already happening in one way or another. example from 2019: https://meduza-io.translate.goog/cards/zhiteley-kazahstana-zastavlyayut-ustanovit-natsionalnyy-sertifikat-bezopasnosti-chto-proishodit?_x_tr_sl=en&_x_tr_tl=ru&_x_tr_hl=en&_x_tr_pto=wapp https://meduza-io.translate.goog/cards/zhiteley-kazahstana-z...
johnea 3y ago
You're not wrong about the javascript, but that doesn't make you right about the https. This enforcement is ridiculous. I've wondered if I had chance at a law suite against goggle (and their lapdogs at mozzila foundation) for calling some of my domains "illegitimate" because I use self-signed certs. Just because I didn't pay twate, or get my cert from someone else who paid twate, doesn't mean my site is "illegitimate". Luckily for me, I'm not trying to launch the next twitverse. I use those domains for my own work, they're not out there to be popular. The article never delves into the world of small network attached devices, some of which are in use long long after their manufactures have been purchased and shut down by the same asshole trying to make you throw it out because it's encryption algorithms are too old, or, Oh No!!!, it uses http for it's webinterface. In the end, https only is goggle power play propped up by fanboi-ism...

Blahagun 3y ago

> That was because the networking standards prior to the web were complicated and not well documented. I have to disagree with this one. I have written networking applications with X Window UI in C from scratch only by reading man pages.