3 ms·
Indeed they are compatible. However HTTPS is often unnecessary, particularly in a smaller organisation, but browsers mandate significant unnecessary complexity
by rlpb 2y ago
Indeed they are compatible. However HTTPS is often unnecessary, particularly in a smaller organisation, but browsers mandate significant unnecessary complexity there. In that sense, brwosers are not suited to this use in those scenarios.
- therealpygon 2y agoAnd it is even more trivial in a small organization to install a Trusted Root for internally signed certificates on their handful of machines. Laziness isn’t a browser issue.
- rlpb 2y agoHow is that supposed to work for an IoT device that wants to work out of the box using one of these HTTPS-only browser APIs?
- metanonsense 2y agoI am not saying I‘d do this, but in theory you could deploy a single reverse proxy in front of your HTTP-only devices and restrict traffic accordingly.
- tedivm 2y agoI really don't see many scenarios where HTTPS isn't needed for at least some internal services.
- donnachangstein 2y agoThen, I'm afraid, you work in a bubble. A static page that hosts documentation on an internal network does not need encryption. The added overhead of certificate maintenance (and investigating when it does and will break) is simply not worth the added cost. Of course the workaround most shops do nowadays is just hide the HTTP servers behind a load balancer doing SSL termination with a wildcard cert. An added layer of complexity (and now single point of failure) just to appease the WebPKI crybabies.
- brendoelfrendo 2y agoSure it does! You may not need confidentiality, but what about integrity?
- donnachangstein 2y agoIt's a very myopic take. Someone that has seized control of your core network such that they were capable of modifying traffic, is not going to waste precious time or access modifying the flags of ls on your man page server. They will focus on more valuable things. Just because something is possible in theory doesn't make it likely or worth the time invested. You can put 8 locks on the door to your house but most people suffice with just one. Someone could remove a piece of mail from your unlocked rural mailbox, modify it and put it back. Do you trust the mail carrier as much as the security of your internal network? But it's not really a concern worth investing resources into for most.
- growse 2y ago> Someone that has seized control of your core network such that they were capable of modifying traffic, is not going to waste precious time or access modifying the flags of ls on your man page server. They will focus on more valuable things. Ah, the "both me and my attackers agree on what's important" fallacy. What if they modify the man page response to include drive-by malware?
- imroot 2y agoWhat overhead? Just about every web server these days supports ACME -- some natively, some via scripts, and you can set up your own internal CA using something like step-ca that speaks ACME if you don't want your certs going out to the transparency log. The last few companies I've worked at had no http behind the scenes -- everything, including service-to-service communications was handled via https. It's a hard requirement for just about everything financial, healthcare, and sensitive these days.
- donnachangstein 2y ago
- freeopinion 2y agoIf only browsers could understand something besides HTTPS. Somebody should invent something called HTTP that is like HTTPS without certificates.
- SoftTalker 2y agoModern browsers default to trying https first.
- recursive 2y agoCool. And when they invent it, it should have browser parity with respect to which API features and capabilities are available, so that we don't need to use HTTPS just so things like `getUserMedia` work. https://www.digicert.com/blog/https-only-features-in-browsers https://www.digicert.com/blog/https-only-features-in-browser...
- noselasd 2y agoThere’s enough APIs limited to secure contexts that many internal apps become unfeasible.