3 ms·

Which is, in my opinion, good I am sick of seing all kind of unsecure websites (or other things over TLS) as well as private CA Those things should not be put

Which is, in my opinion, good I am sick of seing all kind of unsecure websites (or other things over TLS) as well as private CA Those things should not be put in production. If people cannot willingly work properly, then their life should be made harder and harder.

afavour 3y ago
Nope. It should be possible to set up infrastructure to serve web content without being beholden to a certificate authority. By all means there can be a bunch of warnings whenever anyone tries to access it but it should still be possible.
- JackSlateur 3y ago
  But you can : you can do whatever horrors you want, privately. You want your own browser with specific compiled-options ? Then do it and deploy it on your private perimeter. However, if you want to expose something publicly, then your own ideas matters less than the interests of your clients (at least, this is how I see things) : so exposing to the internet something without TLS or with a self-signed / private CA certificates is something that should be denied (those three propositions are the same, if you think about it).
  - superkuh 3y ago
    These kinds of security mindsets exist because browsers have been made extremely insecure these days by encouraging and even setting the default behavior to automatically execute random programs downloaded from random places while at the same time exposing bare metal functionality for speed. This incredibly insecure business use case has made it so using a browser for merely surfing the web is dangerous and that's why CA TLS is required. But if you just turn JS off... it's fine. There is so much more to the web than just business web applications selling things or institutional/government websites with private information. There are human people on the web and their use cases matter too. HTTP/3 disregards them. It's fine for now but when Chrome removes HTTP/1.1 for "security reasons" it's not going to be fine.
    - JackSlateur 3y ago
      These kinds of security mindsets exist because, as a network architect, I know at least a couple of ways to put myself between you and your destination, and from there to read and/or rewrite your unencrypted data. Of course, if I manage any network between you and your destination, things get a lot more easier. I do not want my coworkers to do that on any of my communications, nor my family, nor anybody. The only known way to prevent this is encryption. And no, it has nothing to do with browsers : the same applies to my emails, ssh, IRC and whatever.
      - superkuh 3y ago
        Yes. And there's almost zero risk to such (ARP poisoning? dns poisoning? etc) MITM attacks when you turn off javascript and don't blindly execute all programs sent to you as an end user. The problem with MITM attacks is when you execute programs or exchange money or other private information. The risks when viewing public documents that don't require execution is minimal. That's my point. One use case "web app stores" ruins everything for everyone by requiring the mindset you advocate for as browser defaults. But the entire justification goes away if the end user just turns off JS auto-execute. It's not intrinsic to all use cases for the web or even most. EDIT: Mentioning wikipedia is missing the point. Of course there are cases where CA TLS should be used. I am not denying that. I am saying there are many cases with CA TLS makes things fragile and short lived and it is not needed: like personal websites run by a human person. And these use cases are not invalidated by the existence of yet another corporate person (wikimedia).
        JackSlateur 3y ago
        You are wrong. Let's take a wikipedia, without TLS nor JS. I can modify that page and the end user won't even know it is now a bunch of crap. MITM has nothing to do with read-only nor with local execution.
        GoblinSlayer 3y ago
        You can just put a bunch of crap in wikipedia itself, TLS doesn't help much here.
  - natoliniak 3y ago
    > you can do whatever horrors you want and i do. i run a personal static website over http. oh the horror.
- deleted 3y ago
  [deleted]

afavour 3y ago

Nope. It should be possible to set up infrastructure to serve web content without being beholden to a certificate authority. By all means there can be a bunch of warnings whenever anyone tries to access it but it should still be possible.

JackSlateur 3y ago
But you can : you can do whatever horrors you want, privately. You want your own browser with specific compiled-options ? Then do it and deploy it on your private perimeter. However, if you want to expose something publicly, then your own ideas matters less than the interests of your clients (at least, this is how I see things) : so exposing to the internet something without TLS or with a self-signed / private CA certificates is something that should be denied (those three propositions are the same, if you think about it).
- superkuh 3y ago
  These kinds of security mindsets exist because browsers have been made extremely insecure these days by encouraging and even setting the default behavior to automatically execute random programs downloaded from random places while at the same time exposing bare metal functionality for speed. This incredibly insecure business use case has made it so using a browser for merely surfing the web is dangerous and that's why CA TLS is required. But if you just turn JS off... it's fine. There is so much more to the web than just business web applications selling things or institutional/government websites with private information. There are human people on the web and their use cases matter too. HTTP/3 disregards them. It's fine for now but when Chrome removes HTTP/1.1 for "security reasons" it's not going to be fine.
  - JackSlateur 3y ago
    These kinds of security mindsets exist because, as a network architect, I know at least a couple of ways to put myself between you and your destination, and from there to read and/or rewrite your unencrypted data. Of course, if I manage any network between you and your destination, things get a lot more easier. I do not want my coworkers to do that on any of my communications, nor my family, nor anybody. The only known way to prevent this is encryption. And no, it has nothing to do with browsers : the same applies to my emails, ssh, IRC and whatever.
    - superkuh 3y ago
      Yes. And there's almost zero risk to such (ARP poisoning? dns poisoning? etc) MITM attacks when you turn off javascript and don't blindly execute all programs sent to you as an end user. The problem with MITM attacks is when you execute programs or exchange money or other private information. The risks when viewing public documents that don't require execution is minimal. That's my point. One use case "web app stores" ruins everything for everyone by requiring the mindset you advocate for as browser defaults. But the entire justification goes away if the end user just turns off JS auto-execute. It's not intrinsic to all use cases for the web or even most. EDIT: Mentioning wikipedia is missing the point. Of course there are cases where CA TLS should be used. I am not denying that. I am saying there are many cases with CA TLS makes things fragile and short lived and it is not needed: like personal websites run by a human person. And these use cases are not invalidated by the existence of yet another corporate person (wikimedia).
      - JackSlateur 3y ago
        You are wrong. Let's take a wikipedia, without TLS nor JS. I can modify that page and the end user won't even know it is now a bunch of crap. MITM has nothing to do with read-only nor with local execution.
        GoblinSlayer 3y ago
        You can just put a bunch of crap in wikipedia itself, TLS doesn't help much here.
- natoliniak 3y ago
  > you can do whatever horrors you want and i do. i run a personal static website over http. oh the horror.
deleted 3y ago
[deleted]