3 ms·

> No support for encryption nor compression in the protocol. I consider it a feature. Compression adds complexity. Not only you have to implement compression

by GuB-42 2y ago

> No support for encryption nor compression in the protocol. I consider it a feature. Compression adds complexity. Not only you have to implement compression itself, but also a way to communicate what type of compression you want. It also makes the protocol less readable though packet dumps and make using simple tools like netcat more complex. Simplicity is a big reason for using Gopher. Encryption adds a lot of complexity, same argument, but ten times worse. In addition to complexity, I don't really like the idea of HTTPS-style encryption for a niche like this, for the following reasons: - HTTPS gives only limited privacy protection, an eavesdropper can still see your IP address and the server you are trying to reach. It is not TOR. - The signature aspect only ensures you are connecting to the right server, not that the content has been tempered with. It is not PGP. - Encryption is useful to send secrets, like passwords or credit card numbers. Why would you want use passwords? Isn't the big idea to make information publicly available? Why hide things behind passwords? And why would you want to send a credit card number, do you want e-commerce on your platform? Not having encryption is a way to ensure all information on your small network is freely accessible and stays this way. And if you disagree with regard to encryption, maybe take a look at Gemini. 1 and 2 are good points.

woodruffw 2y ago
> The signature aspect only ensures you are connecting to the right server, not that the content has been tempered with. It is not PGP. The “T” in TLS stands for “transport.” It absolutely does guarantee that the content has not been tampered with, unless you don’t trust the website itself (in which case you would trust the PGP key no more or less than you would the website’s certificate). But regardless, this kind of argument against encryption is just plain bad: there are all kinds of things you might want to do on the Internet that don’t involve passwords or “secret” information that a passive adversary (like a government or ISP) shouldn’t be able to observe. The contents of the political websites you visit, for example. This is especially true on our modern Internet, where observing individual endpoint IPs doesn’t really tell the passive adversary much (thanks to CGNAT and SNI/multiple sites hosted on the same IP).
throw10920 2y ago
> {Compression, encryption} adds complexity. There's very little downside to making those optional, and significant upside. Communication technologies without both of those things are no more than toys.
- vundercind 2y ago
  Looks toward the nearest university library
  - Calavar 2y ago
    Predigital libraries offered both these things. Compression: Microfilm. Encryption: Well, not encryption exactly, but encryption is just an end to a means, which is privacy of communication. Libraries offer private reading rooms and generally refuse to release lending history to any random person who asks.
    - vundercind 2y ago
      Yeah, I mean you can come up with some nonsense to make anything “true” but books generally don’t have encryption or compression and are some of the best communication technology ever. Among a whole bunch of others. The original assertion that communication technologies without both(!) those things are “toys” is just weird nonsense. [edit] downvoting will not make this: > Communication technologies without both [encryption and compression] are no more than toys. Anything but a stupendously and obviously incorrect claim. How about street signs? Letters? Newspapers? PA systems FFS? All toys I guess.
      - chongli 2y ago
        Wikipedia is roughly analogous to a university library and notice that Wikipedia connects with https by default now. Why should we care that our connection to Wikipedia is encrypted (assuming we’re not going to log in)? Because encryption protects our privacy when browsing the encyclopedia. In a physical library your privacy is protected by logistics: if someone wants to spy on what you’re reading they need to actually travel to the library or otherwise set up some kind of physical surveillance there. Unencrypted communications over the internet do not present any logistical challenge whatsoever for would-be snoops. All unencrypted traffic can be scooped up and catalogued automatically to build a detailed dossier on all users. This sort of dragnet surveillance was never feasible at physical libraries.
lolinder 2y ago
> HTTPS gives only limited privacy protection, an eavesdropper can still see your IP address and the server you are trying to reach. It is not TOR. This is what I've dubbed the "perfect is the enemy of good" fallacy, and it's frustratingly common around here. Technology Connections calls it "but sometimes". A surprising number of otherwise educated and rational people are entirely prepared to argue that because a solution is partial that means it is useless and we'd be better off without anything at all. It feels weird that I even have to say this, but: sometimes a partial solution covers most of the solution space that actually matters in the real world and it's okay that it's incomplete. I'd rather an attacker see my IP address and the server I'm trying to reach than that they be able to see all of my communications with a server.
- shiomiru 2y ago
  You must consider the use cases, though. With Gopher, if an attacker knows who connected to which server, they can normally deduce the transmitted content too, since (IME) gopherholes tend to be structured as static blogs. Gopher is not the Web, you aren't going to buy stuff or log into your bank account, you will mainly be downloading & reading plain text. And there is an easily overlooked benefit of no encryption for a niche protocol: it's much easier to implement in resource constrained environments, e.g. very old computers. The Web doesn't compete in this area, so it's perfect for a smaller alternative like Gopher.
  - giantrobot 2y ago
    > The Web doesn't compete in this area, so it's perfect for a smaller alternative like Gopher. This is just the goofiest assertion. Old computers have been in the Web since both the Web and those computers were new. You can transfer the same plain text content over HTTP as you can Gopher. It takes very little in the way of resources to handle HTTP 1.1 on the client side.
    - chongli 2y ago
      Have you tried browsing the web recently on a vintage computer running a 90’s browser? It works on only a minority of sites. The vast majority are broken due to either https or JavaScript. So yes, in principle you can use the web on those old devices but it really doesn’t work in practice. The strong desire for gopher is for a protocol where every server you might want to connect to actually works on your ancient client.

by GuB-42 2y ago

woodruffw 2y ago

> The signature aspect only ensures you are connecting to the right server, not that the content has been tempered with. It is not PGP. The “T” in TLS stands for “transport.” It absolutely does guarantee that the content has not been tampered with, unless you don’t trust the website itself (in which case you would trust the PGP key no more or less than you would the website’s certificate). But regardless, this kind of argument against encryption is just plain bad: there are all kinds of things you might want to do on the Internet that don’t involve passwords or “secret” information that a passive adversary (like a government or ISP) shouldn’t be able to observe. The contents of the political websites you visit, for example. This is especially true on our modern Internet, where observing individual endpoint IPs doesn’t really tell the passive adversary much (thanks to CGNAT and SNI/multiple sites hosted on the same IP).

throw10920 2y ago

> {Compression, encryption} adds complexity. There's very little downside to making those optional, and significant upside. Communication technologies without both of those things are no more than toys.

vundercind 2y ago
Looks toward the nearest university library
- Calavar 2y ago
  Predigital libraries offered both these things. Compression: Microfilm. Encryption: Well, not encryption exactly, but encryption is just an end to a means, which is privacy of communication. Libraries offer private reading rooms and generally refuse to release lending history to any random person who asks.
  - vundercind 2y ago
    Yeah, I mean you can come up with some nonsense to make anything “true” but books generally don’t have encryption or compression and are some of the best communication technology ever. Among a whole bunch of others. The original assertion that communication technologies without both(!) those things are “toys” is just weird nonsense. [edit] downvoting will not make this: > Communication technologies without both [encryption and compression] are no more than toys. Anything but a stupendously and obviously incorrect claim. How about street signs? Letters? Newspapers? PA systems FFS? All toys I guess.
    - chongli 2y ago
      Wikipedia is roughly analogous to a university library and notice that Wikipedia connects with https by default now. Why should we care that our connection to Wikipedia is encrypted (assuming we’re not going to log in)? Because encryption protects our privacy when browsing the encyclopedia. In a physical library your privacy is protected by logistics: if someone wants to spy on what you’re reading they need to actually travel to the library or otherwise set up some kind of physical surveillance there. Unencrypted communications over the internet do not present any logistical challenge whatsoever for would-be snoops. All unencrypted traffic can be scooped up and catalogued automatically to build a detailed dossier on all users. This sort of dragnet surveillance was never feasible at physical libraries.

lolinder 2y ago

> HTTPS gives only limited privacy protection, an eavesdropper can still see your IP address and the server you are trying to reach. It is not TOR. This is what I've dubbed the "perfect is the enemy of good" fallacy, and it's frustratingly common around here. Technology Connections calls it "but sometimes". A surprising number of otherwise educated and rational people are entirely prepared to argue that because a solution is partial that means it is useless and we'd be better off without anything at all. It feels weird that I even have to say this, but: sometimes a partial solution covers most of the solution space that actually matters in the real world and it's okay that it's incomplete. I'd rather an attacker see my IP address and the server I'm trying to reach than that they be able to see all of my communications with a server.

shiomiru 2y ago
You must consider the use cases, though. With Gopher, if an attacker knows who connected to which server, they can normally deduce the transmitted content too, since (IME) gopherholes tend to be structured as static blogs. Gopher is not the Web, you aren't going to buy stuff or log into your bank account, you will mainly be downloading & reading plain text. And there is an easily overlooked benefit of no encryption for a niche protocol: it's much easier to implement in resource constrained environments, e.g. very old computers. The Web doesn't compete in this area, so it's perfect for a smaller alternative like Gopher.
- giantrobot 2y ago
  > The Web doesn't compete in this area, so it's perfect for a smaller alternative like Gopher. This is just the goofiest assertion. Old computers have been in the Web since both the Web and those computers were new. You can transfer the same plain text content over HTTP as you can Gopher. It takes very little in the way of resources to handle HTTP 1.1 on the client side.
  - chongli 2y ago
    Have you tried browsing the web recently on a vintage computer running a 90’s browser? It works on only a minority of sites. The vast majority are broken due to either https or JavaScript. So yes, in principle you can use the web on those old devices but it really doesn’t work in practice. The strong desire for gopher is for a protocol where every server you might want to connect to actually works on your ancient client.