4 ms·

Ask Dang: What Has Happened with HN's HTTPS Recently?

5 points by eimrine 3y ago

I have an old Blackberry 9790 smartphone and this was my main device for reading HN while travelling. This smartphone has a peculiarity - it cannot read 99% of websites. No Google, Wikipedia and everything else you use every day. I know for sure that the problem is with HTTPS certificates, but I am not a networker to explain this in detail. Until recently, I could actively use HN - read, upvote and comment, no Algolia search of course. But today (perhaps a little earlier) this problem with website certificates on my BlackBerry also affected my favorite web-site. To give you a chance to figure out what my problem is, I’ll leave a few links that continue to work on this device: lesswrong.com vitalik.ca justine.lol caltech.edu cat-v.org Is it possible for HN to have at least some kind of read-only mirror for those who cannot use HTTPS?

elmerfud 3y ago
This doesn't seem like an HN problem, this seems like you're running an ancient device that's not been updated problem. For the car analogy equivalent this would be you complaining that you still want to drive your 1965 Impala but no one sells leaded gasoline anymore and thus you're destroying your engine because you don't want to have hardened valve seats installed. My suggestion is if you want to be technologically stuck in place would be to install your own proxy system that solves your problem rather than requiring the rest of the world to be stuck in place.
- eimrine 3y ago
  Leaded gasoline is still allowed for aircraft, racing cars, farm equipment, and marine engines. BTW as somebody who wants to make my own website, I would like to know what is so special about those websites.
  - elmerfud 3y ago
    Yes it's true you can still get leaded gasoline in some cases and you can still buy lead additive. My point was that it is very rare and for a daily driver it is for more convenient to update than to continue to try and force it to be generally available. As for the website changes there has been a big push over the last several years for https everywhere, but of course https has been around for a long long time. So in addition to https everywhere there has been insecurities found in many of the early methods used. All of the ssl-based methods are considered insecure at this point and I believe the general recommendation is nothing lower than TLS 1.1 at an absolute minimum for compatibility. There is also the certificate signature algorithms that have changed over time and so forth.
    - eimrine 3y ago
      HTML/WWW is made with an idea of a backward compatibility. I agree with no more using log in on this device because everyone gets able to intercept my password from my precious account with 1k+ karma. But there are no reasons to disallow HTTP read-only connections which ends up in multiplying amount of digital garbage on the planet. I love this dumbphone as the one providing the best sound of my interlocutor, and having exactly as much features as I need including ability to read HN but not rest of Internets. If I would not find a way to read HN on this device I just stop using it against my will.
      - elmerfud 3y ago
        The point of https everywhere isn't just to protect e-commerce or passwords or other potentially private-only information is the concept that everything that you do should remain a private conversation between you and the end host. Because there is a massive amount of eavesdropping and tampering of pages by service providers that happen a lot more than people realize and it's done totally transparently. So even for a site like HN if you want it to be read only are you sure that what you're reading is what was actually published? Backwards compatibility does not extend in perpetuity. It's also not reasonable to think that it should extend in perpetuity and that everyone else should be held back because you refuse to upgrade. As a website operator I would want to have a reasonable assurances that what I am transmitting is what will be received on the other side without being tampered or intercepted regardless of how private the communication may be.
        eimrine 3y ago
        I am OK if somebody like ISP will add his ads on the HN, typically it happens this way. I would agree that limits of technology is a thing if someone does something more interesting like replacing all pro-Lisp topics with pro-Java ones. But even in latter situation at least I have an ability to change Wi-Fi/GSM connection while in no-HTTP world I just go south with no good reason. Isn't HN's webserver (nginx/apache/whatever) has open HTTP by default? Isn't there a good reason for this?
h2odragon 3y ago
Perhaps you could have your device use a proxy that can do the HTTPS unwrap for you? https://mitmproxy.org/ https://mitmproxy.org/ maybe?
- eimrine 3y ago
  As I understand this solution, all I need is some computer with static IP. My ISP offers static IP, but I am required to have a wifi router on every Internet connection I have an access to, which might do creating such a home server not an easy task. A free (as beer) MITM service for having an ability to connect to some websites might be a great deal for not only this device but even for some older devices in my collection. But of course your link is not such a service.
mtmail 3y ago
Wouldn't visiting HN with such an old device mean you cannot read most of the posted articles? I know some users go to the comments first but not being able to read the articles might lead to less quality comments (I'm not looking at OP's old comments to not bias myself).
- eimrine 3y ago
  Most of my HN activity is Ask HN. But my comments from this device is really lower-quality ones because I am not able to use a translator to English.
LinuxBender 3y ago
HN supports older and weaker ciphers [1] thus the score capped at "B" so not likely a cipher issue. HN's cert was updated on Sun, 27 Aug 2023 00:00:00 UTC so more likely the case is that your certificate store is out of date. I suspect you will need to find a way to manually update the CA root certificate store on your device for this site and many others to be reachable, probably somewhere on Blackberry's document site [2] or maybe this forum has solved this issue [3] or a Reddit Blackberry community perhaps. The risk of only updating the CA root store is that you will not get security patches for the OS and updated versions of your web browser that include security fixes. An ideal solution would be to find an open source OS that will run on the device but I have no idea if such a thing exists for that model. [1] - https://www.ssllabs.com/ssltest/analyze.html?d=news.ycombinator.com&hideResults=on https://www.ssllabs.com/ssltest/analyze.html?d=news.ycombina... [2] - https://blackberry-bold-9790.berrydoc.net/ https://blackberry-bold-9790.berrydoc.net/ [3] - https://forums.crackberry.com/ https://forums.crackberry.com/

Most websites will accept HTTP and then redirect to https. It's also not really about if you're okay with someone tampering with the content you're reading it's about assurances that the publisher can be reasonably assured what they're sending is what you're receiving. What you do with it after the fact they have no control over but this isn't simply about injecting ads it's about altering content in a way that the publisher did not intend. And it seems like an insane position to take to say you are fine with receiving content that you can have no reasonable assurance was not tampered with. Ultimately it's not your content it's the publisher's content. Again as a publisher I want to be reasonably sure what I send is what is going to be received. I take it based upon your position it would be reasonable to assume you are okay with libraries censoring out content in books or injecting new content in books. Also when you watch a movie the media player can arbitrarily cut, altar, or add new things to the content without your knowledge. Because this is the position you're taking by saying you are okay with content you are trying to consume to be altered without your knowledge. When this content is altered without your knowledge who will you get upset at? Because it's without your knowledge and so the only assumption would be it must be the content publisher who did this. I'm really having a difficult time determining if you're trolling or making an honest defense of using 15-year-old technology and expecting the world to additionally support 15-year-old insecure technology. Because this comes back to the original analogy of I want to use my 1965 Impala as my daily driver and refuse to upgrade it so I can use gasoline that does not cause mental illness through massive amounts of lead poisoning. The real problem you're having isn't that the piece of hardware is necessarily inadequate to do the task it's that the people who write the software for the hardware and do not allow you to continue to keep it current. So instead of making the argumentation that the world should remain in the past using insecure technologies your argument should be that when a manufacturer decides that they are going to end of life a product there should be legislation that requires all of the software to control that product become open sourced so I can continue to be maintained by the community should they continue to want to use it.

eimrine 3y ago
> Ultimately it's not your content it's the publisher's content. This is a dangerous reasoning which leads to such a sad things like TPM. > When this content is altered without your knowledge who will you get upset at? Because it's without your knowledge and so the only assumption would be it must be the content publisher who did this. The phone supports 2 sim cards plus Wi-Fi, so if somebody would replace all pro-Lisp articles with pro-Java ones, I just change a connection.
elmerfud 3y ago
Apparently there's a limit on replies to a thread. But indicating that it's the publisher's content and not yours is not a dangerous line of thought it is the common line of thought through which all copyright which has been a thing for many hundreds of years now is based upon. My point was simply about the publisher ensuring that the content that they publish is received as intended by you the consumer. You seem to be conflating that with a consumer doing what they want with it after they've received it. What we're talking about here is third parties that are neither the publisher or nor the consumer altering the content but still pretending it is the publishers original work. For many hundreds of years now this has been an egregious violation of copyright and nothing about an "in an iPhone world" changes that. Your argument seems to be based around the core principle of you don't care if a third party alters content that you're trying to consume that you may rely upon to be accurate. Additionally your argument seems to be based around the hubris that you would be able to detect the alteration and simply switch connection methodologies to get around it. That is a completely false premise to base your argument around. You have no assurances you would be able to detect the alteration and you would also have no assurances that simply changing from cell to Wi-Fi would get you around where the alteration is made because you have no idea where in the chain of connections the content has been altered. All of this is reasonably solved by using an and to end encrypted connection. Is it perfect, no, there is always ways to alter data inside the encrypted connection but these are difficult ways. So we're back to the idea of reasonable assurances that what was published is what is consumed. The fact that you do not care that content you're consuming is totally untrusted does not mean the rest of the world it needs to facilitate you and continuing to consume untrusted content. If you wish to pursue consuming totally untrusted content you're free to do so with many proxies because even your old device will support a proxy method that will allow you to continue to have untrusted content. As for the rest of the world we are far better off understanding that there is a reasonable assurance that what is published and what I'm consuming are the same thing.