3 ms·

I would argue that with mandated TLS, there is no such thing as "full self-hosting" any longer if you want to be part of the web. Everyone is beholden to a CA s

I would argue that with mandated TLS, there is no such thing as "full self-hosting" any longer if you want to be part of the web. Everyone is beholden to a CA somehow

superkuh 2y ago
Everyone's home internet connection now is very fast. They are very capable of hosting a static website of files in folders from home as a human person without CAs being involved. And it's much safer than, say, running Chrome w/javascript on and visiting a random website.
- immibis 2y ago
  Except they aren't fully capable, because it's considered insecure and certain features are disabled, and all options to bypass this was deliberately made extremely difficult to bypass. It would be even worse if Mozilla's original plan had succeeded - making TLS completely mandatory on the Internet, so that http URLs would only be accepted for localhost and RFC1918 IP addresses.
  - superkuh 2y ago
    Yes, people stuck using a corporate browser might have trouble accessing non-corporate websites because of those browser's loses of capability. It sucks. HTTP webservers are fully capable but realistically every human person should do HTTP+HTTPS for the best of both worlds. Regardless, for HTTP there's an entire 'year 2000's web' worth of people out there using browsers that can access the non-corporate web. As the corporate web diverges with things like stateful HTTP extensions, UDP HTTP, and CA TLS only implementations (if not spec) there's no need to switch to a niche protocol like Gemini. Just making a normal website on the web is enough to bring back the old small web environment. As a human person not operating under a profit motive and just doing things for kicks this is just fine. A silver lining like how usenet is actually good again now that most people don't get it from their ISP.
    - immibis 2y ago
      Corporate browsers such as (checks notes) Firefox and all of its forks.
      - superkuh 2y ago
        Yes, Mozilla is very corporate. These days it's primary design considerations are about executing javascript to buy things or watch DRM media. It's use cases cannot allow for it being a web browser for human persons. It uses cases are all about commerce now. But there are fine Firefox forks that split off before it just became a chrome copy.
- sidewndr46 2y ago
  Chrome, Brave & other browsers now refuse to download content from HTTP websites. In the coming years, HTTP will be fully deprecated on consumer platforms for browsing the web
striking 2y ago
Sign your own CA and add it to your devices? You don't have to trust the default set or be trusted by the default set.
- immibis 2y ago
  Self-hosting a website means other people can use your website. That person is right. Let's Encrypt controls the web now, and we only put up with it because it's acting altruistically right now. But that's also how we used to treat Reddit and Twitter and Freenode and how we still treat Discord and Hacker News. Only in one of these cases did users manage to wrestle power back when the owners turned sour, and that was only possible because the ruler forgot to pay his keys, so they defected.
  - sidewndr46 2y ago
    No one seems to realize that Lets Encrypt is a single point of failure now. You compromise them and you compromise a huge percentage of traffic on the web. Their root CA can't really be revoked either unless you want to turn off most of the internet. Not that big CAs would ever suggest anything like that in the name of "security"
CodesInChaos 2y ago
You need to ask central authorities to issue you a public IP, and almost certainly a domain name as well. I don't see how requiring a TLS certificate on top of that changes much.
- sidewndr46 2y ago
  You most definitely don't need a domain name and I have never been "issued" and IP in my life. It's assigned by my ISP for the duration indicated by DHCP.

I would argue that with mandated TLS, there is no such thing as "full self-hosting" any longer if you want to be part of the web. Everyone is beholden to a CA somehow

superkuh 2y ago

Everyone's home internet connection now is very fast. They are very capable of hosting a static website of files in folders from home as a human person without CAs being involved. And it's much safer than, say, running Chrome w/javascript on and visiting a random website.

immibis 2y ago
Except they aren't fully capable, because it's considered insecure and certain features are disabled, and all options to bypass this was deliberately made extremely difficult to bypass. It would be even worse if Mozilla's original plan had succeeded - making TLS completely mandatory on the Internet, so that http URLs would only be accepted for localhost and RFC1918 IP addresses.
- superkuh 2y ago
  Yes, people stuck using a corporate browser might have trouble accessing non-corporate websites because of those browser's loses of capability. It sucks. HTTP webservers are fully capable but realistically every human person should do HTTP+HTTPS for the best of both worlds. Regardless, for HTTP there's an entire 'year 2000's web' worth of people out there using browsers that can access the non-corporate web. As the corporate web diverges with things like stateful HTTP extensions, UDP HTTP, and CA TLS only implementations (if not spec) there's no need to switch to a niche protocol like Gemini. Just making a normal website on the web is enough to bring back the old small web environment. As a human person not operating under a profit motive and just doing things for kicks this is just fine. A silver lining like how usenet is actually good again now that most people don't get it from their ISP.
  - immibis 2y ago
    Corporate browsers such as (checks notes) Firefox and all of its forks.
    - superkuh 2y ago
      Yes, Mozilla is very corporate. These days it's primary design considerations are about executing javascript to buy things or watch DRM media. It's use cases cannot allow for it being a web browser for human persons. It uses cases are all about commerce now. But there are fine Firefox forks that split off before it just became a chrome copy.
sidewndr46 2y ago
Chrome, Brave & other browsers now refuse to download content from HTTP websites. In the coming years, HTTP will be fully deprecated on consumer platforms for browsing the web

striking 2y ago

Sign your own CA and add it to your devices? You don't have to trust the default set or be trusted by the default set.

immibis 2y ago
Self-hosting a website means other people can use your website. That person is right. Let's Encrypt controls the web now, and we only put up with it because it's acting altruistically right now. But that's also how we used to treat Reddit and Twitter and Freenode and how we still treat Discord and Hacker News. Only in one of these cases did users manage to wrestle power back when the owners turned sour, and that was only possible because the ruler forgot to pay his keys, so they defected.
- sidewndr46 2y ago
  No one seems to realize that Lets Encrypt is a single point of failure now. You compromise them and you compromise a huge percentage of traffic on the web. Their root CA can't really be revoked either unless you want to turn off most of the internet. Not that big CAs would ever suggest anything like that in the name of "security"

CodesInChaos 2y ago

You need to ask central authorities to issue you a public IP, and almost certainly a domain name as well. I don't see how requiring a TLS certificate on top of that changes much.

sidewndr46 2y ago
You most definitely don't need a domain name and I have never been "issued" and IP in my life. It's assigned by my ISP for the duration indicated by DHCP.