4 ms·

HTTP/1.1 on TLS works perfectly fine.

doublerabbit 3y ago
Your missing the point. In that browsers insist that you now -must- have HTTPS. And that if you wish to serve an static HTTP website over HTTP you can not without a glaring "This site is unsafe" thrown in your face.
- computerfriend 3y ago
  > The removal attempt of HTTP/1.1 is the biggest censorship in history. You're missing the point, which is that this statement has nothing to do with TLS.
- labcomputer 3y ago
  That's because it is unsafe. Without HTTPS, an attacker can inject arbitrary malicious javascript into the page. The only context in which plain HTTP is ok on today's internet is when you a loading a page from your own server on the same LAN, behind a firewall, when you are reasonably sure that nobody else is in you network.
  - doublerabbit 3y ago
    > That's because it is unsafe. Without HTTPS, an attacker can inject arbitrary malicious javascript into the page. No they can't. If they can inject malicious content then you should fix the exploits on your platform. HTTPS isn't going to save you. If exploitable under HTTP hey can do the same under HTTPS. So, How is a static webpage of "hello world" unsafe? <html> <body> hello world <a href ref="byesantiy.html"> sigh </a> </body> <html> Replace hello world with whatever information. My father stores his studies in HTML, no GETs, POST requests. Just a href to the next page. Unless you have actual access to the html file.. You tell me, why should I require cert for that following syntax? You don't.
    - precommunicator 3y ago
      Now try connecting to public wifi with that. Doing a MiTM and replacing anything with anything else is super easy. Just put a router with some Linux distro acting as extender (or mobile connection AP) with the same name and you can change traffic on any non-HTTPS website. Or not even a public wifi. Someone can put a device somewhere between your home and ISP and MiTM attack you the same way as above. Oh, and I will just show you fake e.g. Google login page, not just replace the context. And you are tired and just want to use the web... You won't notice the unsecured connection.
      - doublerabbit 3y ago
        Yes, however the website is still inherently secure outside of those scenarios. If you were visit that page on an network that is not MiTM the website is still secure. There is no requirement for SSL. The scenarios you listed can even make HTTPS insecure. The users laptop is infected with a virus, their antivirus software has been exploited with a bogus root cert.
        labcomputer 3y ago
        > The scenarios you listed can even make HTTPS insecure. You don't understand what HTTPS does, then. HTTPS is specifically designed to counter MITM attacks, so it is, in fact, not insecure in the scenarios listed by the parent comment. > If you were visit that page on an network that is not MiTM the website is still secure. There is no requirement for SSL. That is really only relevant when you and your sever are on the same LAN, behind a firewall, and you are reasonably sure that you don't have an intruder (like I mentioned upthread). When you are browsing a server across the public internet, you should assume you are being MITM'd. With HTTP (not S), the MITM attacker does not need to be between you and the server. If they can guess the TCP sequence number and when you are browsing, the MITM can inject (or replace) arbitrary content into the pages you load.
        doublerabbit 3y ago
        Yes, and with those scenarios if your root certificate has been maliciously modified https isn't going to save you either
  - extraduder_ire 3y ago
    I don't think http is going away in the short term, anyway. Too many captive portals exist that aren't going to get upgraded to https any time soon. I'd appreciate if self-signed certs of some kinds weren't so alerty though. Though, that might inspire false confidence.
  - phendrenad2 3y ago
    > That's because it is unsafe Safety and freedom are natural enemies.

Your missing the point. In that browsers insist that you now -must- have HTTPS. And that if you wish to serve an static HTTP website over HTTP you can not without a glaring "This site is unsafe" thrown in your face.

computerfriend 3y ago
> The removal attempt of HTTP/1.1 is the biggest censorship in history. You're missing the point, which is that this statement has nothing to do with TLS.
labcomputer 3y ago
That's because it is unsafe. Without HTTPS, an attacker can inject arbitrary malicious javascript into the page. The only context in which plain HTTP is ok on today's internet is when you a loading a page from your own server on the same LAN, behind a firewall, when you are reasonably sure that nobody else is in you network.
- doublerabbit 3y ago
  > That's because it is unsafe. Without HTTPS, an attacker can inject arbitrary malicious javascript into the page. No they can't. If they can inject malicious content then you should fix the exploits on your platform. HTTPS isn't going to save you. If exploitable under HTTP hey can do the same under HTTPS. So, How is a static webpage of "hello world" unsafe? <html> <body> hello world <a href ref="byesantiy.html"> sigh </a> </body> <html> Replace hello world with whatever information. My father stores his studies in HTML, no GETs, POST requests. Just a href to the next page. Unless you have actual access to the html file.. You tell me, why should I require cert for that following syntax? You don't.
  - precommunicator 3y ago
    Now try connecting to public wifi with that. Doing a MiTM and replacing anything with anything else is super easy. Just put a router with some Linux distro acting as extender (or mobile connection AP) with the same name and you can change traffic on any non-HTTPS website. Or not even a public wifi. Someone can put a device somewhere between your home and ISP and MiTM attack you the same way as above. Oh, and I will just show you fake e.g. Google login page, not just replace the context. And you are tired and just want to use the web... You won't notice the unsecured connection.
    - doublerabbit 3y ago
      Yes, however the website is still inherently secure outside of those scenarios. If you were visit that page on an network that is not MiTM the website is still secure. There is no requirement for SSL. The scenarios you listed can even make HTTPS insecure. The users laptop is infected with a virus, their antivirus software has been exploited with a bogus root cert.
      - labcomputer 3y ago
        > The scenarios you listed can even make HTTPS insecure. You don't understand what HTTPS does, then. HTTPS is specifically designed to counter MITM attacks, so it is, in fact, not insecure in the scenarios listed by the parent comment. > If you were visit that page on an network that is not MiTM the website is still secure. There is no requirement for SSL. That is really only relevant when you and your sever are on the same LAN, behind a firewall, and you are reasonably sure that you don't have an intruder (like I mentioned upthread). When you are browsing a server across the public internet, you should assume you are being MITM'd. With HTTP (not S), the MITM attacker does not need to be between you and the server. If they can guess the TCP sequence number and when you are browsing, the MITM can inject (or replace) arbitrary content into the pages you load.
        doublerabbit 3y ago
        Yes, and with those scenarios if your root certificate has been maliciously modified https isn't going to save you either
- extraduder_ire 3y ago
  I don't think http is going away in the short term, anyway. Too many captive portals exist that aren't going to get upgraded to https any time soon. I'd appreciate if self-signed certs of some kinds weren't so alerty though. Though, that might inspire false confidence.
- phendrenad2 3y ago
  > That's because it is unsafe Safety and freedom are natural enemies.