3 ms·

Re [1]: No TLS? :(

• vinc 2y ago
  Good question, there's no TLS support inside MOROS so its website must be available over HTTP, especially when I self-host it. That's not the case currently so I could also have HTTPS but I'm using Dokku and last time I tried the Let's Encrypt plugin would redirect HTTP to HTTPS automatically, which is annoying. Edit: I set up CloudFlare in front of the server and there's now a working HTTPS version along with the HTTP version accessible from inside MOROS. This should also work when I'll use again the web server inside the OS. Thanks for prompting me to look into it!
• bigstrat2003 2y ago
  There's nothing sensitive, therefore there is no reason to use TLS.
  • 0xFF0123 2y ago
    Other than the build and download links?
  • appendix-rock 2y ago
    No! Stop! Why won’t this one die! MITMing is a two way street. I could intercept sensitive data, or I could shove something in that tricks the user (phishing, etc), exploits the user agent, and more!. “You only need encryption for the sensitive stuff” is what we did, poorly, in the late ‘00s / early ‘10s, and it was rightfully proven to be a bad idea. There’s a reason why browsers treat HTTP the way they currently do, and it isn’t because they’ve been co-opted by Big Certificate Authority. EDIT: and as the other commenter says, there are download links.
    • tcfhgj 2y ago
      You don't need encryption to prevent something shoved into it without detection
      • XorNot 2y ago
        No but we have no "httpv" protocol scheme to require signatures but not encryption Which IMO has been a huge mistake since breaking caching proxies for networks because we want to prove authenticity and have to do secrecy as well has been quite silly.
      • aaronmdjones 2y ago
        No, but you do need authentication, and TLS does both.