Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What feature would you want the web to “force” next, after HTTPS?

news.ycombinator.com

Post reply on HN
Print view View original

171–180 of 279 posts

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#171

Post by Untit1ed »

gcoda wrote: post #164

Ajax without JavaScript. Ability to send a response from server updating only part of DOM. Basically, react with virtual DOM on the server pushing diffs to user with http2 awesomness. There will be no need for JS on most sites, can be adapted to current frameworks, and with preload/prefetch it might be very fast. * U can prefetch progress bar / loading state for example, and redirect to partial url of a real content

That sounds awesome, but how could you do it without either:

  - Client sends the entirety of what it has to the server so the server can do the diff
  - Server sends the entirety of the new page to the client so it can do the diff
  - Server is constantly keeping track of the last thing that the user looked at so it can send the diff for the next page

?

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#172

Post by harryh »

cwp wrote: post #163

Add SRV lookups to the HTTP standard. There's a tremendous amount of complexity and cost attached to the fact that browsers look up the IP address of the hostname and then connect to port 80. First, it's true that you can specify another port in the URL, but nobody does that because it's ugly and hard to remember. If you want to be able to send people to your website, you need to be able to tell people what the url i…

This means you can't put multiple websites on a single server with a single IP address

Huh? This isn't true. A webserver can just look at the host header in a HTTP request and return a response for the appropriate domain.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#173

Post by jonnytran »

vfulco wrote: post #78

2FA everywhere, preferably with Yubikey (no connection but happy user)

There was a link just 2 days ago on HN [1] about how 2FA has already been forced, but it's a mess b/c every site does it differently and usually in a way that's not secure.

1: https://news.ycombinator.com/item?id=14735759

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#174

Post by girvo »

criddell wrote: post #51
notzorbo3 wrote: post #17

- A protocol for sites to get my public PGP key for server side use - The discontinuation of using SSL certificates for verification of website identities and a move to true fingerprinting ala SSH. - Deprecation of email or rather its insecurity. - Logins on websites with a public / private keypair ala SSH. - A resurgence in sites that let me pick my own anonymous username instead of Facebook, Google or Twitter login…

I love the encryption ideas. Do you know if PGP public/private key pairs can be used for ephemeral keys? I'd hate to rely on the same secret to store everything throughout time.

I haven't had my morning coffee, but I believe that lack of forward-secrecy is exactly the main drawback with PGP as a protocol; but it's been a while since I looked at it

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#176

Post by girvo »

swiley wrote: post #36
atirip wrote: post #8

JavaScript Standard Library created that every browser has "installed" and updated automatically.

I feel like the mess helps discourage it's use. I shouldn't need a Turing machine in order to read a text document.

While I agree with you, that ship has sailed I think. I'd rather see it take less bandwidth, less memory and less CPU time at least!

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#177

Post by tptacek »

cwp wrote: post #163

Add SRV lookups to the HTTP standard. There's a tremendous amount of complexity and cost attached to the fact that browsers look up the IP address of the hostname and then connect to port 80. First, it's true that you can specify another port in the URL, but nobody does that because it's ugly and hard to remember. If you want to be able to send people to your website, you need to be able to tell people what the url i…

There's two issues with this: first, it's not necessary, and second, it won't really work.

The first: it's true that only one (privileged) process can bind port 80 on a host. But that process can simply do what most front-end webservers do now, and reverse proxy to any number of other local hosts. IP addresses can be demultiplexed through the Host header, the way they have been for decades. That makes this a systems design problem, and not something that needs to be exposed in the standards.

Second, even if you could transparently run websites on port 9999, that wouldn't change the fact that a good number of networks filter everything but ports 80 and 443. Universal network accessibility would still put ports 80/443 at a premium.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#178

Post by MichaelGG »

cwp wrote: post #163

Add SRV lookups to the HTTP standard. There's a tremendous amount of complexity and cost attached to the fact that browsers look up the IP address of the hostname and then connect to port 80. First, it's true that you can specify another port in the URL, but nobody does that because it's ugly and hard to remember. If you want to be able to send people to your website, you need to be able to tell people what the url i…

You can run many sites on the same IP and port. TLS and HTTP both indicate the host name. (And for most installs, non port 80/443 might be nonstarter due to firewalls.)

Apex CNAMEs can be worked around in the server software - just dynamically resolve it into an IP. Cloudflare does this, for instance.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#179

Post by netcraft »

dmitrygr wrote: post #108
netcraft wrote: post #68

Earlier quoted context omitted.

Forgive me, but I just don't understand this sentiment at all. I understand your general frustration with over-engineered websites - but is it not your choice to visit that website? Do you not also have the ability to block javascript just like the scourge of flash websites before it? We aren't talking about vulnerabilities here though, youre just saying that there are websites out there that could do with less (or n…

Maybe im missing something You definitely are. Disable js and try browsing. Note the quadrupled battery life in your laptop.

I don't doubt improved battery life (although quadrupled seems like a stretch) - but I bet if you turned off images and video you'd have a similar improvement - but nobody is saying that pictures are ruining the web.

Again, arent you capable of choosing the websites you use? Are there websites you are required to spend extended amounts of time with that you want the browsers to step in and force them to use less javascript?

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#180

Post by tptacek »

adrianratnapala wrote: post #165
StavrosK wrote: post #142

Earlier quoted context omitted.

Client TLS certs already exist, and they are a massive pain for the average user.

So I have heard of client TLS authentication, but does it exist for the web (I mean just in principle, not whether it is really used). That is, do browsers support it? The thing is, if it is a massive pain for average users, then that is an own-goal. Look at SSH: there is no certification chain there. All you do is generate a keypair and then (here's the awkward bit) magic the pubkey over to the server. It would be e…

Yes, browsers have supported client certificates for decades and continue to today.
Post reply on HN