Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What feature would you want the web to “force” next, after HTTPS?

news.ycombinator.com

Post reply on HN
Print view View original

271–279 of 279 posts

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#271

Post by kuschku »

schlarpc wrote: post #37
syncerr wrote: post #5

I'd vote for DNS-over-HTTPS or similar tech. Encrypting domain name resolution should help mitigate a gateway or proxy (Comcast) from knowing or blocking sites you visit.

SNI puts the DNS names you're connecting to in plaintext at the start of every TLS connection. Running your DNS over an encrypted channel won't stop someone from knowing or blocking the sites you connect to.

Luckily, from 2018 on, SNI will be mostly unnecessary, as LE will support Wildcard certificates, with DNS verification, for many domains in a single certificate.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#272

Post by ryan-allen »

roryisok wrote: post #231
ryan-allen wrote: post #109

Earlier quoted context omitted.

That'd be hilarious and tragic. Most of the internet would be flagged slow.

And that would force devs to change them

Devs aren't usually the ones in charge. Imaging trying to explain to an exec that you need to remove the analytics code from their website to speed it up for end users, not gonna happen!

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#274

Post by rmrfrmrf »

topranks wrote: post #239
rmrfrmrf wrote: post #149

Earlier quoted context omitted.

I feel like I need more training for IPv6. For a long time, I've thought that it was a simple thing to enable and allow (and often our servers are dual stack). It turns out, though, that unless you really know what you're doing on the server side (i.e. overriding the horrible defaults for IPv6 resource allocation), you can end up with an inexplicably slow server that spits out bizarre errors. Anyone here have any rec…

More on the network side myself, and I thought I had v6 down, or at least the basics. What kind of resource allocation problems did you have on dual-stacked hosts? Windows/Linux/Other??

For example, in Debian 7, routes.max_size is dynamically allocated for ipv4 and hard-coded to 4096 for ipv6. I eventually figured it out after searching for a while, but that's not something I'd expect to have to do (having been used to ipv4 working decently out of the box).

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#275

Post by kyledrake »

krallja wrote: post #169
kyledrake wrote: post #100

Ability to mark HTTPS site as "not secure" using HTTP headers if it's asking for things like logins and passwords. Would be useful for things like free static HTML web hosts and CDNs for combating phishing. Could be something put in CSP.

Is that different from CSP form-action?

Yes. This wouldn't prevent a form from working, what it would do is warn the user that this site shouldn't be asking you for a password and may be trying to do a bad thing, instead of just showing a green bar and a "security lock" with the word secure on it.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#276

Post by lousken »

roryisok wrote: post #233
lousken wrote: post #47

Working version without javascript (unless it's crucial for the website). No opacity 0 animations, javascript only menus etc.

This should get more votes. It should be an internet requirement that a website has to be functional and readable without Js. I don't know how this could be implemented though

Just include with style tag where it would include those fixes (regarding opacity), menus without js are not a problem in new browsers, css3 is powerful enough. There's even a repo with common elements done without a line of js - see https://github.com/you-dont-need/You-Dont-Need-JavaScript

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#277

Post by ktta »

syncerr wrote: post #5

I'd vote for DNS-over-HTTPS or similar tech. Encrypting domain name resolution should help mitigate a gateway or proxy (Comcast) from knowing or blocking sites you visit.

There's DNSCurve by djb which does pretty much that.

https://dnscurve.org/

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#278

Post by tscs37 »

kuschku wrote: post #271
schlarpc wrote: post #37

Earlier quoted context omitted.

SNI puts the DNS names you're connecting to in plaintext at the start of every TLS connection. Running your DNS over an encrypted channel won't stop someone from knowing or blocking the sites you connect to.

Luckily, from 2018 on, SNI will be mostly unnecessary, as LE will support Wildcard certificates, with DNS verification, for many domains in a single certificate.

SNI will still be necessary for when you have multiple servers under one IP (until IPv4 is deprecated, this is necessary), for example on a shared host (which might even have shared IPs under IPv6).

IIRC there are some ways SNI will be encrypted with TLS 1.3 so it's not a problem to begin with.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#279

Post by tscs37 »

c-smile wrote: post #184

Adding support of Internet Message Body Format (a.k.a. MIME) to browsers [1]. MIME is a format that can contain html/css/script/images/etc in single file (or stream). Thus the whole web application can be served as a single stream by the server. Yet emails (that are MIME files) can be opened by browsers as natively supported documents. [1] MIME : https://tools.ietf.org/html/rfc2045

You mean like .mhtml in Chrome?
Post reply on HN