4 ms·

> HTTPS gives only limited privacy protection, an eavesdropper can still see your IP address and the server you are trying to reach. It is not TOR. This is wha

> HTTPS gives only limited privacy protection, an eavesdropper can still see your IP address and the server you are trying to reach. It is not TOR. This is what I've dubbed the "perfect is the enemy of good" fallacy, and it's frustratingly common around here. Technology Connections calls it "but sometimes". A surprising number of otherwise educated and rational people are entirely prepared to argue that because a solution is partial that means it is useless and we'd be better off without anything at all. It feels weird that I even have to say this, but: sometimes a partial solution covers most of the solution space that actually matters in the real world and it's okay that it's incomplete. I'd rather an attacker see my IP address and the server I'm trying to reach than that they be able to see all of my communications with a server.

shiomiru 3y ago
You must consider the use cases, though. With Gopher, if an attacker knows who connected to which server, they can normally deduce the transmitted content too, since (IME) gopherholes tend to be structured as static blogs. Gopher is not the Web, you aren't going to buy stuff or log into your bank account, you will mainly be downloading & reading plain text. And there is an easily overlooked benefit of no encryption for a niche protocol: it's much easier to implement in resource constrained environments, e.g. very old computers. The Web doesn't compete in this area, so it's perfect for a smaller alternative like Gopher.
- giantrobot 3y ago
  > The Web doesn't compete in this area, so it's perfect for a smaller alternative like Gopher. This is just the goofiest assertion. Old computers have been in the Web since both the Web and those computers were new. You can transfer the same plain text content over HTTP as you can Gopher. It takes very little in the way of resources to handle HTTP 1.1 on the client side.
  - chongli 3y ago
    Have you tried browsing the web recently on a vintage computer running a 90’s browser? It works on only a minority of sites. The vast majority are broken due to either https or JavaScript. So yes, in principle you can use the web on those old devices but it really doesn’t work in practice. The strong desire for gopher is for a protocol where every server you might want to connect to actually works on your ancient client.
    - giantrobot 3y ago
      If you're going to be constrained to a tiny subset of servers running gopher, you can constrain yourself to web servers catering to old clients. Gopher adds nothing there, it's just a less capable protocol than HTTP. I'm not opposed to someone running a gopher server for fun. I don't hate the protocol. There's just a really strange meme that gopher somehow facilitates something the Web does not. If you want a hierarchy of directories with documents, the web can do that and be used by the software everyone already has in their pocket.
      - immibis 3y ago
        I think the advantage for them is having a guarantee. If it's Gopher, then it works. No trial and error needed.
      - chongli 3y ago
        I think the draw of gopher is that one hundred percent of gopher servers work on old clients. Whereas with http you just don’t know. A website that works fine on an old browser can link to a website that doesn’t. That makes the whole thing feel broken. So the desire for gopher is the desire for something reliable, consistent, self-contained, and separate from the web.
    - jstanley 3y ago
      > Have you tried browsing the web recently on a vintage computer running a 90’s browser? It works on only a minority of sites. Compared to gopher which works on even fewer?
hulitu 3y ago
> 'd rather an attacker see my IP address and the server I'm trying to reach than that they be able to see all of my communications with a server. Are you sure the attacker is not able to see "all of my communications with a server" ? Do you trust CAs with your data ?
- jstanley 3y ago
  No, I'm not sure. But if I weren't using TLS I would be sure that they definitely could! This is exactly the type of argument the post you replied to was talking about. If one option might be vulnerable, and the other is definitely vulnerable, then obviously pick the one that isn't definitely vulnerable.
- brokenmachine 3y ago
  I'm unsure precisely how TLS works - Could a compromised CA read all the data between my PC and a server they signed for?

shiomiru 3y ago

You must consider the use cases, though. With Gopher, if an attacker knows who connected to which server, they can normally deduce the transmitted content too, since (IME) gopherholes tend to be structured as static blogs. Gopher is not the Web, you aren't going to buy stuff or log into your bank account, you will mainly be downloading & reading plain text. And there is an easily overlooked benefit of no encryption for a niche protocol: it's much easier to implement in resource constrained environments, e.g. very old computers. The Web doesn't compete in this area, so it's perfect for a smaller alternative like Gopher.

giantrobot 3y ago
> The Web doesn't compete in this area, so it's perfect for a smaller alternative like Gopher. This is just the goofiest assertion. Old computers have been in the Web since both the Web and those computers were new. You can transfer the same plain text content over HTTP as you can Gopher. It takes very little in the way of resources to handle HTTP 1.1 on the client side.
- chongli 3y ago
  Have you tried browsing the web recently on a vintage computer running a 90’s browser? It works on only a minority of sites. The vast majority are broken due to either https or JavaScript. So yes, in principle you can use the web on those old devices but it really doesn’t work in practice. The strong desire for gopher is for a protocol where every server you might want to connect to actually works on your ancient client.
  - giantrobot 3y ago
    If you're going to be constrained to a tiny subset of servers running gopher, you can constrain yourself to web servers catering to old clients. Gopher adds nothing there, it's just a less capable protocol than HTTP. I'm not opposed to someone running a gopher server for fun. I don't hate the protocol. There's just a really strange meme that gopher somehow facilitates something the Web does not. If you want a hierarchy of directories with documents, the web can do that and be used by the software everyone already has in their pocket.
    - immibis 3y ago
      I think the advantage for them is having a guarantee. If it's Gopher, then it works. No trial and error needed.
    - chongli 3y ago
      I think the draw of gopher is that one hundred percent of gopher servers work on old clients. Whereas with http you just don’t know. A website that works fine on an old browser can link to a website that doesn’t. That makes the whole thing feel broken. So the desire for gopher is the desire for something reliable, consistent, self-contained, and separate from the web.
  - jstanley 3y ago
    > Have you tried browsing the web recently on a vintage computer running a 90’s browser? It works on only a minority of sites. Compared to gopher which works on even fewer?

hulitu 3y ago

> 'd rather an attacker see my IP address and the server I'm trying to reach than that they be able to see all of my communications with a server. Are you sure the attacker is not able to see "all of my communications with a server" ? Do you trust CAs with your data ?

jstanley 3y ago
No, I'm not sure. But if I weren't using TLS I would be sure that they definitely could! This is exactly the type of argument the post you replied to was talking about. If one option might be vulnerable, and the other is definitely vulnerable, then obviously pick the one that isn't definitely vulnerable.
brokenmachine 3y ago
I'm unsure precisely how TLS works - Could a compromised CA read all the data between my PC and a server they signed for?