4 ms·

For example, HTTPS-only in browsers and CA TLS only connections in HTTP/3 protocol libraries. It's near impossible to host a visitable website without getting p

For example, HTTPS-only in browsers and CA TLS only connections in HTTP/3 protocol libraries. It's near impossible to host a visitable website without getting permission from a third party corporation every 90 days. These things make sense for corporate/institutional/etc sites but make the barrier to entry, and especially mantainence over time, of personal websites much more difficult. To the point it really does keep people from running personal websites. And it also creates central mechanisms of control for those that do jump through the hoops. LetsEncrypt won't remain benevolent forever as it's popularity grows. Just look at what happened to dot org, and what's happening in the USA in general. HTTP+HTTPS is a fine solution for personal websites.

bruce511 2y ago
On the one hand, yes, certificates are issued by certificate authorities. And this is a critical part of the current web landscape. But, I'll counterpoint that LetsEncrypt isn't the only ACME provider. Should they behave badly others can step into the gap. The 90 day thing isn't a barrier. Certificates in general are automated- it's no harder to be HTTPS than HTTP. Promoting HTTPS and dropping HTTP is ultimately valuable to all sites, because it prevents HTML injection. Given that your reader will be accessing the web via an ISP it prevents that ISP from injecting things into your site. As an author of my own websites, I'm https only, and I think LE improves the indie web experience. There is a long chain of big companies between my site and my reader (Isp, LE, DNS, browser etc) but HTTPS offers me the best way of making sure the contect I create is the content delivered.
- superkuh 2y ago
  Why is dropping HTTP valuable? CA HTTPS is extremely fragile and will eventually break over even just a few years without mantainence. HTTP sites have no expiration date(s). HTTP+HTTPS is the best of both worlds. Unless your threat model includes targeted MITM attacks and your website requires the execution of javascript code.
  - aboardRat4 2y ago
    IPSs constantly inject ads and trackers into plain http. Maybe less so in the West, but on a permanent basis in the East.
  - ForTheKidz 2y ago
    I cannot overemphasize how dumb it is to allow your isp to see what you're doing.
    - superkuh 2y ago
      I feel the same way about letting a corporation control who can visit your site and when (CA TLS only). I personally tunnel to a VPS for browsing because my ISP, Comcast, will do MITM injections of javascript into HTTP pages. This notably used to break the Steam browser. So the best solution is HTTP+HTTPS on the server and using HTTPS till it inevitably breaks (for legal, technical, social, or other reason), then the HTTP is there to keep things accessible. I'm not anti-HTTPS. I'm anti-HTTPS-only. And you should be too if you care about human persons over corporate use cases.
charcircuit 2y ago
>make the barrier to entry, and especially mantainence over time, of personal websites much more difficult. All of this can be automated away.
- superkuh 2y ago
  Automation only hides the complexity. It doesn't solve it. Try using an acme1 client these days. Try using an older computer that has some LE expired root cert. etc. Over years it will break and then you've got a facefull of complexity.
  - charcircuit 2y ago
    Yes, it hides the complexity making it so that it is simple to the average person which keeps the barrier to entry low. Updates can be automated too.
    - superkuh 2y ago
      I suppose you're right, it does slightly lower the barrier to entry compared to doing all the cert stuff manually. But not compared to HTTP itself. Then the first time it breaks (and it always will over a few years) the barrier to continuation is even higher.
aboardRat4 2y ago
>For example, HTTPS-only in browsers and CA TLS only connections in HTTP/3 protocol libraries. It's near impossible to host a visitable website without getting permission from a third party corporation every 90 days. This is why cacert.org still has value and is worth trying to preserve, donate, and contribute.

bruce511 2y ago

On the one hand, yes, certificates are issued by certificate authorities. And this is a critical part of the current web landscape. But, I'll counterpoint that LetsEncrypt isn't the only ACME provider. Should they behave badly others can step into the gap. The 90 day thing isn't a barrier. Certificates in general are automated- it's no harder to be HTTPS than HTTP. Promoting HTTPS and dropping HTTP is ultimately valuable to all sites, because it prevents HTML injection. Given that your reader will be accessing the web via an ISP it prevents that ISP from injecting things into your site. As an author of my own websites, I'm https only, and I think LE improves the indie web experience. There is a long chain of big companies between my site and my reader (Isp, LE, DNS, browser etc) but HTTPS offers me the best way of making sure the contect I create is the content delivered.

superkuh 2y ago
Why is dropping HTTP valuable? CA HTTPS is extremely fragile and will eventually break over even just a few years without mantainence. HTTP sites have no expiration date(s). HTTP+HTTPS is the best of both worlds. Unless your threat model includes targeted MITM attacks and your website requires the execution of javascript code.
- aboardRat4 2y ago
  IPSs constantly inject ads and trackers into plain http. Maybe less so in the West, but on a permanent basis in the East.
- ForTheKidz 2y ago
  I cannot overemphasize how dumb it is to allow your isp to see what you're doing.
  - superkuh 2y ago
    I feel the same way about letting a corporation control who can visit your site and when (CA TLS only). I personally tunnel to a VPS for browsing because my ISP, Comcast, will do MITM injections of javascript into HTTP pages. This notably used to break the Steam browser. So the best solution is HTTP+HTTPS on the server and using HTTPS till it inevitably breaks (for legal, technical, social, or other reason), then the HTTP is there to keep things accessible. I'm not anti-HTTPS. I'm anti-HTTPS-only. And you should be too if you care about human persons over corporate use cases.

charcircuit 2y ago

>make the barrier to entry, and especially mantainence over time, of personal websites much more difficult. All of this can be automated away.

superkuh 2y ago
Automation only hides the complexity. It doesn't solve it. Try using an acme1 client these days. Try using an older computer that has some LE expired root cert. etc. Over years it will break and then you've got a facefull of complexity.
- charcircuit 2y ago
  Yes, it hides the complexity making it so that it is simple to the average person which keeps the barrier to entry low. Updates can be automated too.
  - superkuh 2y ago
    I suppose you're right, it does slightly lower the barrier to entry compared to doing all the cert stuff manually. But not compared to HTTP itself. Then the first time it breaks (and it always will over a few years) the barrier to continuation is even higher.

aboardRat4 2y ago

>For example, HTTPS-only in browsers and CA TLS only connections in HTTP/3 protocol libraries. It's near impossible to host a visitable website without getting permission from a third party corporation every 90 days. This is why cacert.org still has value and is worth trying to preserve, donate, and contribute.