4 ms·

Can we please not restrict APIs to https only ? My game system requires http because it serves pages from your home computer/console to your phone's browser on

Can we please not restrict APIs to https only ? My game system requires http because it serves pages from your home computer/console to your phone's browser on the local network http://docs.happyfuntimes.net http://docs.happyfuntimes.net Either that or please suggest a viable workaround

the8472 11y ago
I think the "new APIs only on https" plan has exceptions for lan-local addresses or at least for localhost.
- greggman 11y ago
  that doesn't help. The phones don't connect to localhost they connect to a PC
  - the8472 11y ago
    user overrides are also an option: http://www.w3.org/TR/powerful-features/#development-environments http://www.w3.org/TR/powerful-features/#development-environm...
    - greggman 11y ago
      That's not really a solution either. You really expect your house guests or people visiting a museum or event to do a technical reconfiguring of their phone just to interact with the installation or game?
      - the8472 11y ago
        I would think that museum should be able to get a SSL cert. But yeah, "SSL-only" kinda breaks the end-to-end principle since we have no mechanism to assign SSL certs to endpoints on demand. So it seems flawed on a conceptual level.
        greggman 11y ago
        Most of these types of exhibits are created by art students and shown at events and happen to be run by museums. Neither the students nor anyone at the museum have any tech experience whatsoever. As the system is now it works for them. But when HTTPS is required they'll all be S.O.L.
- hobarrera 11y ago
  What if my home computer has a public IP address (which it does, since I use IPv6 only)? It's not always so simple. There's also the option of my phone connecting to my home pc while it uses 4G (while the PC uses the land connection).
  - the8472 11y ago
    then just white-list those addresses?
deleted 11y ago
[deleted]
DiThi 11y ago
I think it's feasible to have a domain with certificate for resolving any ip, using dnsmasq as DNS resolver for that domain, combining this https://pfigue.github.io/blog/2013/12/06/configuring-dnsmasq-to-serve-my-own-domain-name-zone/ https://pfigue.github.io/blog/2013/12/06/configuring-dnsmasq... (but without --server) and this https://stackoverflow.com/questions/28204678/dns-service-to-dynamically-resolve-subdomain-to-a-custom-ip-address https://stackoverflow.com/questions/28204678/dns-service-to-... (specifically, the "synth-domain" parameter, maybe limiting it to LAN ip addresses) I haven't tried it.
- greggman 11y ago
  I'm not really sure how that would help. Wouldn't all the phones be getting their DNS from the local router? How would that work without having each users have to configure DNS on their phones? Also how does running DNS server help? I don't expect people to know how to configure their router to point to some DNS server running on their local PC. Maybe I'm mis-understanding the suggested solution
  - DiThi 11y ago
    The application redirects to <local https host>, and to make the certificate valid, have a wildcard *.example.com. With the DNS server you can have e.g. https://192-168-0-7.example.com/ https://192-168-0-7.example.com/ resolve to 192.168.0.7. All of this, of course, only if there are some desired HTTPS-only features in the browser.
moron4hire 11y ago
Couldn't you host over HTTPS locally with a self-signed certificate? I've done it with my own, similar, locally hosted stuff.
- rockdoe 11y ago
  That would require users to install his cert as trusted, though.
  - moron4hire 11y ago
    Ah, right, and I forgot how much the mobile browsers' UIs suck for this. On desktop it's just "yeah, I know what I'm doing <click>". On mobile they invoke threats and hide everything under barely visible links.
- acbart 11y ago
  It's a pain, and I've yet to find any good guides. I'm actually in a fix right now because I want to develop over localhost, but need this Flask site to work on HTTPS. I'm sure it's possible, but I have yet to find any guides or examples that make it straightforward. I love that we're moving towards security, but I wish it was easier...
sp332 11y ago
It also requires people to buy a domain before they can host a website. This is already a bad idea, and it makes even less sense as IPv6 deployment picks up and more people use clever IPv6 addresses instead of hostnames.

the8472 11y ago

I think the "new APIs only on https" plan has exceptions for lan-local addresses or at least for localhost.

greggman 11y ago
that doesn't help. The phones don't connect to localhost they connect to a PC
- the8472 11y ago
  user overrides are also an option: http://www.w3.org/TR/powerful-features/#development-environments http://www.w3.org/TR/powerful-features/#development-environm...
  - greggman 11y ago
    That's not really a solution either. You really expect your house guests or people visiting a museum or event to do a technical reconfiguring of their phone just to interact with the installation or game?
    - the8472 11y ago
      I would think that museum should be able to get a SSL cert. But yeah, "SSL-only" kinda breaks the end-to-end principle since we have no mechanism to assign SSL certs to endpoints on demand. So it seems flawed on a conceptual level.
      - greggman 11y ago
        Most of these types of exhibits are created by art students and shown at events and happen to be run by museums. Neither the students nor anyone at the museum have any tech experience whatsoever. As the system is now it works for them. But when HTTPS is required they'll all be S.O.L.
hobarrera 11y ago
What if my home computer has a public IP address (which it does, since I use IPv6 only)? It's not always so simple. There's also the option of my phone connecting to my home pc while it uses 4G (while the PC uses the land connection).
- the8472 11y ago
  then just white-list those addresses?

deleted 11y ago

[deleted]

DiThi 11y ago

I think it's feasible to have a domain with certificate for resolving any ip, using dnsmasq as DNS resolver for that domain, combining this https://pfigue.github.io/blog/2013/12/06/configuring-dnsmasq-to-serve-my-own-domain-name-zone/ https://pfigue.github.io/blog/2013/12/06/configuring-dnsmasq... (but without --server) and this https://stackoverflow.com/questions/28204678/dns-service-to-dynamically-resolve-subdomain-to-a-custom-ip-address https://stackoverflow.com/questions/28204678/dns-service-to-... (specifically, the "synth-domain" parameter, maybe limiting it to LAN ip addresses) I haven't tried it.

greggman 11y ago
I'm not really sure how that would help. Wouldn't all the phones be getting their DNS from the local router? How would that work without having each users have to configure DNS on their phones? Also how does running DNS server help? I don't expect people to know how to configure their router to point to some DNS server running on their local PC. Maybe I'm mis-understanding the suggested solution
- DiThi 11y ago
  The application redirects to <local https host>, and to make the certificate valid, have a wildcard *.example.com. With the DNS server you can have e.g. https://192-168-0-7.example.com/ https://192-168-0-7.example.com/ resolve to 192.168.0.7. All of this, of course, only if there are some desired HTTPS-only features in the browser.

moron4hire 11y ago

Couldn't you host over HTTPS locally with a self-signed certificate? I've done it with my own, similar, locally hosted stuff.

rockdoe 11y ago
That would require users to install his cert as trusted, though.
- moron4hire 11y ago
  Ah, right, and I forgot how much the mobile browsers' UIs suck for this. On desktop it's just "yeah, I know what I'm doing <click>". On mobile they invoke threats and hide everything under barely visible links.
acbart 11y ago
It's a pain, and I've yet to find any good guides. I'm actually in a fix right now because I want to develop over localhost, but need this Flask site to work on HTTPS. I'm sure it's possible, but I have yet to find any guides or examples that make it straightforward. I love that we're moving towards security, but I wish it was easier...

sp332 11y ago

It also requires people to buy a domain before they can host a website. This is already a bad idea, and it makes even less sense as IPv6 deployment picks up and more people use clever IPv6 addresses instead of hostnames.