6 ms·

I would be happy to port some patterns to Glicol (https://glicol.org/ https://glicol.org/) only suggestion: support https...

phyzix5761 2y ago
Honest question. What is the current obsession with https for things that don't need to be secure like looking at drum patterns?
- chaosprint 2y ago
  there is a login
  - phyzix5761 2y ago
    For the login I completely understand but most pages don't need to be secured in my opinion.
    - binarysneaker 2y ago
      Secure it all vs secure just the login...may as well do it all.
    - rubendev 2y ago
      If you only secure the login you will be sending your session cookies unencrypted for the other pages and they can be intercepted and used to impersonate you.
- CPLX 2y ago
  Browsers seem to lose their mind when presented with not HTTPS content these days right?
  - phyzix5761 2y ago
    Exactly
  - hirako2000 2y ago
    Perhaps they shouldn't but that forced the hands of many who would have otherwise dragged their feet for another century. I get bothered by it, Chrome doesn't even allow to confirm and proceed at the boom of the warning page anymore, but there is some flag you may disable if you feel safe about all your visits. Hopefully Google will start flagging ipv4 servers too. And one day block them by default.
- pacifika 2y ago
  Interest based advertising.
- ctxc 2y ago
  I would rather everyone use HTTPS than have them individually decide if it "needs to be secure".
  - phyzix5761 2y ago
    Why is that?
    - kadoban 2y ago
      The downsides of being secure are a 5 minute setup, once. The thought process of "should this be secure?" is 10 minutes even if the answer is obvious. So why bother? Just be secure and move on.
      - otabdeveloper4 2y ago
        Https does nothing for security. Its purpose is to authenticate financial transaction packets, not to be "secure". (Whatever that means.)
        g105b 2y ago
        You need 9 more minutes of thought process.
        otabdeveloper4 2y ago
        No, I need exactly 0 seconds to process empty buzzwords in the vein of "add Frobnozz to your TCP/IP, Frobnozz increases security bigly!".
        kadoban 2y ago
        There are zero buzzwords. I was just being vague because again, the cost of just flipping https on is negligible, it's literally more work to have this conversation and work out all of the details of exactly what attacks you're protected against. It is never worth asking "should I even do https?" The only variation worth considering is "is https enough?" And even then, start with https and then build on top.
- whstl 2y ago
  For me: wi-fi and mobile providers injecting ads. Rarer these days but still happens.
- IAmGraydon 2y ago
  There's a login, but also if you aren't https, you're going to be seriously de-ranked by search engines like Google.
- jtafurth 2y ago
  I worked for an authority that issued digital certificates for SSL and digital signatures. It's not only about providing encryption but also about trust, when a top level entity issues a SSL certificate, a number of identity validations are carried out, adding an extra layer or confidence on that website. This may seem inconsequential for static websites without PII, however most browsers consider it important as it reduces the risk for all parties involved when encrypted communication is used and the content providers has taken basic steps for Identity verification. There are logic flaws with this approach to security imo, but it's the most commonly used technique at the moment.
  - sergiotapia 2y ago
    you didn't answer the _why do we need all that for a drum beat making website_?
    - jdiez17 2y ago
      Unauthenticated http is a vector for opportunistic malware. They don’t target specific websites, just inject evil.js wherever.
      - otabdeveloper4 2y ago
        You ISP sniffing and MiTMing traffic on the wire is the least likely vector of malware injection. ISP's are usually serious businesses with reputations and don't hack their own customers.
        latexr 2y ago
        That “usually” is doing a ton of work. I remember Vodafone injecting scripts into webpages many years ago. While trying to find a source, I bumped into other shenanigans. https://www.simpleanalytics.com/blog/vodafone-deutsche-telekom-to-introduce-persistent-user-tracking https://www.simpleanalytics.com/blog/vodafone-deutsche-telek...
- lemax 2y ago
  ISPs / other middlemen can monitor and modify unencrypted traffic. In Egypt, Syria and Turkey for example ISP’s injected malware into unencrypted sites that led people to install spyware when attempting to download legitimate programs (link). Other state actors have changed the content of news media, etc. Without HTTPS you lose the ability to trust the integrity of a given webpage. https://www.bitdefender.com/en-us/blog/hotforsecurity/turkish-egyptian-isps-help-local-government-conduct-massive-spyware-operation https://www.bitdefender.com/en-us/blog/hotforsecurity/turkis...
- webprofusion 2y ago
  Chrome labelled sites as Not Secure if they didn't user https since 2018. Most people didn't like that label showing on their website address, so it was a clever way to shift everyone. Years before that the free certificate authority Let's Encrypt was established (there are now several more), so for most people using https with your website is just configuration, not an extra cost. On top of that some http protocol versions are now https only.
- MisterTea 2y ago
  Would you trust handing a sack full of money to a stranger and tell them to bring it to the bank for you or do you hire an armored car service? We need https because the modern web browser isn't a trustworthy or secure program. A web browser isn't a sandbox so code can be injected into an insecure http stream to force the browser to compromise the machine it is running on. This is just the state of the internet - there are literal highwaymen in the form of malicious routers and other networking hardware on the internet. https is unfortunately the ony way to ensure the highway for your data is secure and the data arriving to you is trustworthy. The only way to avoid this is to use a browser like netsurf that eliminates the insecure modernity or dont use the web.
- pbreit 2y ago
  That ship has sailed. http has been retired.
  - bigstrat2003 2y ago
    It hasn't been retired. Using HTTPS everywhere is cargo cult nonsense. Most sites do not benefit from it, and the push to have it everywhere is obnoxious as hell.
    - hirako2000 2y ago
      It was obnoxious, let's encrypt solved that from the operator's perspective. Man in the middle attacks are very real. A good ratio of routers get hacked during manufacture, or have a backdoor that get exploited by other hackers. an http hits make these exploit even easier to execute. Public WiFi are often insecure, https works around that problem (for the most part). From an attacker perspective, widespread https has become obnoxious, yes.
    - GuinansEyebrows 2y ago
      The prevalence of good advice is obnoxious? Or is it the five minutes' labor of setting up https for your services that annoys you?
wesz 2y ago
Woah, nice work dude. I had to regenerate ssl certificate, ovh says it's done but it will probably take some time to take effect.
- 0_-_0 2y ago
  [flagged]
- deleted 2y ago
  [deleted]
dr_kiszonka 2y ago
Hi! I was very confused about Glycol until I discovered that the desktop version of your site shows way more information than the mobile one. At least in Chrome for Android, you can only select demos to play and click the GitHub link. And GitHub recommends visiting glicol.org, so why do so many people rave about Glycol? Now I know :) I was wondering if you would be adding any IDE-like features. I like a few features in Sonic-Pi and noticed a few attempts to make a VS Code plugin for it. (I wish I could contribute myself, but my music production skills are atrocious and I mostly rely on GUI-based software to carry me.) Congrats on an awesome project! (And you, OP, too!)
- chaosprint 2y ago
  there is also a cli: https://github.com/glicol/glicol-cli https://github.com/glicol/glicol-cli
  - dr_kiszonka 2y ago
    You are not an IDE person, are you? : ) Sonic's default one has a few very useful features. Although, I personally don't like its keyboard shortcuts and they don't seem to be editable.
xingwu 2y ago
What a rabbit hole and a great use of my precious hour after I put my kid to sleep, thanks for sharing!!

phyzix5761 2y ago

Honest question. What is the current obsession with https for things that don't need to be secure like looking at drum patterns?

chaosprint 2y ago
there is a login
- phyzix5761 2y ago
  For the login I completely understand but most pages don't need to be secured in my opinion.
  - binarysneaker 2y ago
    Secure it all vs secure just the login...may as well do it all.
  - rubendev 2y ago
    If you only secure the login you will be sending your session cookies unencrypted for the other pages and they can be intercepted and used to impersonate you.
CPLX 2y ago
Browsers seem to lose their mind when presented with not HTTPS content these days right?
- phyzix5761 2y ago
  Exactly
- hirako2000 2y ago
  Perhaps they shouldn't but that forced the hands of many who would have otherwise dragged their feet for another century. I get bothered by it, Chrome doesn't even allow to confirm and proceed at the boom of the warning page anymore, but there is some flag you may disable if you feel safe about all your visits. Hopefully Google will start flagging ipv4 servers too. And one day block them by default.
pacifika 2y ago
Interest based advertising.
ctxc 2y ago
I would rather everyone use HTTPS than have them individually decide if it "needs to be secure".
- phyzix5761 2y ago
  Why is that?
  - kadoban 2y ago
    The downsides of being secure are a 5 minute setup, once. The thought process of "should this be secure?" is 10 minutes even if the answer is obvious. So why bother? Just be secure and move on.
    - otabdeveloper4 2y ago
      Https does nothing for security. Its purpose is to authenticate financial transaction packets, not to be "secure". (Whatever that means.)
      - g105b 2y ago
        You need 9 more minutes of thought process.
        otabdeveloper4 2y ago
        No, I need exactly 0 seconds to process empty buzzwords in the vein of "add Frobnozz to your TCP/IP, Frobnozz increases security bigly!".
        kadoban 2y ago
        There are zero buzzwords. I was just being vague because again, the cost of just flipping https on is negligible, it's literally more work to have this conversation and work out all of the details of exactly what attacks you're protected against. It is never worth asking "should I even do https?" The only variation worth considering is "is https enough?" And even then, start with https and then build on top.
whstl 2y ago
For me: wi-fi and mobile providers injecting ads. Rarer these days but still happens.
IAmGraydon 2y ago
There's a login, but also if you aren't https, you're going to be seriously de-ranked by search engines like Google.
jtafurth 2y ago
I worked for an authority that issued digital certificates for SSL and digital signatures. It's not only about providing encryption but also about trust, when a top level entity issues a SSL certificate, a number of identity validations are carried out, adding an extra layer or confidence on that website. This may seem inconsequential for static websites without PII, however most browsers consider it important as it reduces the risk for all parties involved when encrypted communication is used and the content providers has taken basic steps for Identity verification. There are logic flaws with this approach to security imo, but it's the most commonly used technique at the moment.
- sergiotapia 2y ago
  you didn't answer the _why do we need all that for a drum beat making website_?
  - jdiez17 2y ago
    Unauthenticated http is a vector for opportunistic malware. They don’t target specific websites, just inject evil.js wherever.
    - otabdeveloper4 2y ago
      You ISP sniffing and MiTMing traffic on the wire is the least likely vector of malware injection. ISP's are usually serious businesses with reputations and don't hack their own customers.
      - latexr 2y ago
        That “usually” is doing a ton of work. I remember Vodafone injecting scripts into webpages many years ago. While trying to find a source, I bumped into other shenanigans. https://www.simpleanalytics.com/blog/vodafone-deutsche-telekom-to-introduce-persistent-user-tracking https://www.simpleanalytics.com/blog/vodafone-deutsche-telek...
lemax 2y ago
ISPs / other middlemen can monitor and modify unencrypted traffic. In Egypt, Syria and Turkey for example ISP’s injected malware into unencrypted sites that led people to install spyware when attempting to download legitimate programs (link). Other state actors have changed the content of news media, etc. Without HTTPS you lose the ability to trust the integrity of a given webpage. https://www.bitdefender.com/en-us/blog/hotforsecurity/turkish-egyptian-isps-help-local-government-conduct-massive-spyware-operation https://www.bitdefender.com/en-us/blog/hotforsecurity/turkis...
webprofusion 2y ago
Chrome labelled sites as Not Secure if they didn't user https since 2018. Most people didn't like that label showing on their website address, so it was a clever way to shift everyone. Years before that the free certificate authority Let's Encrypt was established (there are now several more), so for most people using https with your website is just configuration, not an extra cost. On top of that some http protocol versions are now https only.
MisterTea 2y ago
Would you trust handing a sack full of money to a stranger and tell them to bring it to the bank for you or do you hire an armored car service? We need https because the modern web browser isn't a trustworthy or secure program. A web browser isn't a sandbox so code can be injected into an insecure http stream to force the browser to compromise the machine it is running on. This is just the state of the internet - there are literal highwaymen in the form of malicious routers and other networking hardware on the internet. https is unfortunately the ony way to ensure the highway for your data is secure and the data arriving to you is trustworthy. The only way to avoid this is to use a browser like netsurf that eliminates the insecure modernity or dont use the web.
pbreit 2y ago
That ship has sailed. http has been retired.
- bigstrat2003 2y ago
  It hasn't been retired. Using HTTPS everywhere is cargo cult nonsense. Most sites do not benefit from it, and the push to have it everywhere is obnoxious as hell.
  - hirako2000 2y ago
    It was obnoxious, let's encrypt solved that from the operator's perspective. Man in the middle attacks are very real. A good ratio of routers get hacked during manufacture, or have a backdoor that get exploited by other hackers. an http hits make these exploit even easier to execute. Public WiFi are often insecure, https works around that problem (for the most part). From an attacker perspective, widespread https has become obnoxious, yes.
  - GuinansEyebrows 2y ago
    The prevalence of good advice is obnoxious? Or is it the five minutes' labor of setting up https for your services that annoys you?

wesz 2y ago

Woah, nice work dude. I had to regenerate ssl certificate, ovh says it's done but it will probably take some time to take effect.

0_-_0 2y ago
[flagged]
deleted 2y ago
[deleted]

dr_kiszonka 2y ago

Hi! I was very confused about Glycol until I discovered that the desktop version of your site shows way more information than the mobile one. At least in Chrome for Android, you can only select demos to play and click the GitHub link. And GitHub recommends visiting glicol.org, so why do so many people rave about Glycol? Now I know :) I was wondering if you would be adding any IDE-like features. I like a few features in Sonic-Pi and noticed a few attempts to make a VS Code plugin for it. (I wish I could contribute myself, but my music production skills are atrocious and I mostly rely on GUI-based software to carry me.) Congrats on an awesome project! (And you, OP, too!)

chaosprint 2y ago
there is also a cli: https://github.com/glicol/glicol-cli https://github.com/glicol/glicol-cli
- dr_kiszonka 2y ago
  You are not an IDE person, are you? : ) Sonic's default one has a few very useful features. Although, I personally don't like its keyboard shortcuts and they don't seem to be editable.

xingwu 2y ago

What a rabbit hole and a great use of my precious hour after I put my kid to sleep, thanks for sharing!!