3 ms·
TLS is not bad, but CA TLS is for the vast majority of human persons on the internet. It makes things very fragile and only last a couple years max without cons
by superkuh 2y ago
TLS is not bad, but CA TLS is for the vast majority of human persons on the internet. It makes things very fragile and only last a couple years max without constant mantainence. This is okay for commerce and institutions but for human websites it is devestating. Human persons just don't have the same use cases or threat models as a megacorp and cargo culting megacorp style solutions to everyone is bad.
- foobiekr 2y agoThe threat model of plain http is about the user (and injected content) and not the server. Plain http is a threat to users. Has it really been so many years since people used to do tcp injections and walk around coffee shops or whatever returning results faster than the internet server and injecting goatse? You guys have forgotten who tls protects.
- superkuh 2y agoNope, you've just applied your application model of the web to the web as a whole. Most websites are not actually applications and the risk of "injected content" to people with javascript turned off is very, very low. The risk comes from the absolutely bonkers corporate/institutional use cases of automatically executing all random unverified programs sent to you. When you remove this crazy use case suddenly all the problems (and bonkers requirements) go away. Seeing a goatse is not the end of the world and actual MITM injection attacks like you describe are rather rare now. I miss when wifi use to be open and that issue mattered.
- foobiekr 2y agoThe average user does not have JavaScript turned off. Plain http sites are a risk to their users.