3 ms·

I don't think you quite understood my point. Like said, HTTP+HTTPS in HTTP/3 would be perfect. Everyone could be happy and websites could have infinite unmaint

I don't think you quite understood my point. Like said, HTTP+HTTPS in HTTP/3 would be perfect. Everyone could be happy and websites could have infinite unmaintained lifetimes and anyone could visit without getting approval from a third party corporation every 3 months. But nope, the big tech companies, and even Mozilla, refuse to implement an HTTP/3 that supports HTTP+HTTPS. It's flabberghasting, unless you view it through the lens of the needs of commerce only. That is my point. *re: This is nonsense: So when I set up lets encrypt using an acme (1) client it should still work today? Oh wait, they dropped acme 1 support entirely and only support acme 2 now (and will again with acme 3). And that's ignoring that whatever acme client you pick is going to have breaking changes too over time (even if it's acme.sh!). Then there's the 2018 LE root cert expiration... then the 2024 one, then there's TLS version sun-setting...). It is not so non-sensical down in the weeds of actually hosting a 90-day cert CA TLS website over more than a few years. And just to note: I love LE. I use LE for some websites. I think it's great. I love HTTPS too. I just think HTTPS-only instead of HTTP+HTTPS is very damaging socially.

acdha 2y ago
Disagreement is not failure to understand. If you’re unable to rotate certificates on a decadal scale you aren’t in a position to run an internet-exposed service because anything will need at least some security updates over that kind of timeframe.
- superkuh 2y ago
  It seems like your premise here is that the web is only for "professionals". It is not. It is for everyone. HTTP/3 certainly agrees with you though.
  - acdha 2y ago
    I wouldn’t set the bar for “professional” so low but it’s really just incongruous to say that it’s somehow easy and democratic to take care of running a server, registering a domain, setting up DNS, and creating some kind of web application but following high-quality documentation to add an extra couple of lines of configuration magically transforms it into a major barrier. In most cases, you don’t even need to do it yourself since most hosting companies have some kind of recipe which covers most of the work.
    - superkuh 2y ago
      Your assumption that all that is needed does explain some things. Almost none of that is required and indeed, most of it would make things worse. Running a webserver is as simple as "apt install nginx", forwarding ports 80/443 on your router and saving a index.html to the webroot directory. HTML and files in directories live forever. And there's no need for a domain, DNS, or especially an "application". Just drag and drop myphoto.jpg to ~/www/ in your GUI file manager and you're ready to send the link, http://my.ip.is.here/myphoto.jpg http://my.ip.is.here/myphoto.jpg to friends. And it'll last forever with no security worries. nginx remote exploits are once a decade, if that. Sure you might have to re-link if your IP changes but that's not a problem. Sure you site will be inaccessible sometimes if your computer is off, but you're not sharing files to friends during that time so it's fine. The requirements of business use cases just don't apply. It's not "serious".
      - acdha 2y ago
        So you never need to patch that server? Your nginx, OpenSSL, etc. never need updates? Seriously, this is just embarrassing. If it’s too hard for you to add a couple lines of config to enable Let’s Encrypt (apt will get you Apache w/mod_md or Caddy, too), it’s also too hard to run the rest of the server - and neither are that hard.

acdha 2y ago

Disagreement is not failure to understand. If you’re unable to rotate certificates on a decadal scale you aren’t in a position to run an internet-exposed service because anything will need at least some security updates over that kind of timeframe.

superkuh 2y ago
It seems like your premise here is that the web is only for "professionals". It is not. It is for everyone. HTTP/3 certainly agrees with you though.
- acdha 2y ago
  I wouldn’t set the bar for “professional” so low but it’s really just incongruous to say that it’s somehow easy and democratic to take care of running a server, registering a domain, setting up DNS, and creating some kind of web application but following high-quality documentation to add an extra couple of lines of configuration magically transforms it into a major barrier. In most cases, you don’t even need to do it yourself since most hosting companies have some kind of recipe which covers most of the work.
  - superkuh 2y ago
    Your assumption that all that is needed does explain some things. Almost none of that is required and indeed, most of it would make things worse. Running a webserver is as simple as "apt install nginx", forwarding ports 80/443 on your router and saving a index.html to the webroot directory. HTML and files in directories live forever. And there's no need for a domain, DNS, or especially an "application". Just drag and drop myphoto.jpg to ~/www/ in your GUI file manager and you're ready to send the link, http://my.ip.is.here/myphoto.jpg http://my.ip.is.here/myphoto.jpg to friends. And it'll last forever with no security worries. nginx remote exploits are once a decade, if that. Sure you might have to re-link if your IP changes but that's not a problem. Sure you site will be inaccessible sometimes if your computer is off, but you're not sharing files to friends during that time so it's fine. The requirements of business use cases just don't apply. It's not "serious".
    - acdha 2y ago
      So you never need to patch that server? Your nginx, OpenSSL, etc. never need updates? Seriously, this is just embarrassing. If it’s too hard for you to add a couple lines of config to enable Let’s Encrypt (apt will get you Apache w/mod_md or Caddy, too), it’s also too hard to run the rest of the server - and neither are that hard.