81–90 of 321 posts
This. A long thread mostly advocating HTTPS everywhere and only one mention of this. Would any of the knowledgeable HTTPS advocates here care to comment on it?
Earlier quoted context omitted.
> developers who just want their software to work. Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. > they either don't know or don't care about all the effort and pain they're creating You have not been paying attention to the hundreds of tools available to make HTTPS painless. > until someone at Big G decided they weren't. And Mozilla. And countle…
> Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. Except most big orgs now employ MitM tools like BlueCoat to sniff SSL connections too. > You have not been paying attention to the hundreds of tools available to make HTTPS painless. I have, and they don't. They make it easier, but you know what's truly painless? Hosting an html file over HTTP. What…
The content of your site is irrelevant. We do know that your lack of concern for your user's safety is a problem though.
I also wish that managing certs was better, but until then, passing negative externalities to your users is pretty sleazy.
Earlier quoted context omitted.
> The preferable end-of-life date for ACMEv1 should be never. As would be the preferable end-of-life date for SSLv3 and HTTP.
The SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren'…
Earlier quoted context omitted.
> developers who just want their software to work. Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. > they either don't know or don't care about all the effort and pain they're creating You have not been paying attention to the hundreds of tools available to make HTTPS painless. > until someone at Big G decided they weren't. And Mozilla. And countle…
> Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. Except most big orgs now employ MitM tools like BlueCoat to sniff SSL connections too. > You have not been paying attention to the hundreds of tools available to make HTTPS painless. I have, and they don't. They make it easier, but you know what's truly painless? Hosting an html file over HTTP. What…
Without TLS how do YOU know that the user is receiving your static resume. Any MitM can tamper with the connection and replace your content with something malicious. With properly configured TLS that's simply not possible (with the exception you describe in corporate settings where BlueCoat's cert has to be added to the machine's trust store in order for that sniffing to be possible). Hopefully in the future even that wont be possible.
DNS providers and domain name registration companies are probably going to get pestered about API access for updating TXT DNS records now... :)
I never understood why DNS providers are so reluctant to offer standards-based access, like nsupdate(1). It's easy to set up, it can do everything, it's secure, requires no custom anything and it just works.
Like *.subdomain.example.org?
Earlier quoted context omitted.
The service is great, but they're really the only free SSL cert game in town. As more sites start using their certs, they'll wind up becoming a single point of failure.
They are not the only CA that issues certificates for free. For example, AlwaysOnSSL[0] was on HN a few days ago[1], with some important differences (as pointed out in the HN comments) [0] https://alwaysonssl.com/ [1] https://news.ycombinator.com/item?id=16566031
Earlier quoted context omitted.
> developers who just want their software to work. Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. > they either don't know or don't care about all the effort and pain they're creating You have not been paying attention to the hundreds of tools available to make HTTPS painless. > until someone at Big G decided they weren't. And Mozilla. And countle…
> Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. Except most big orgs now employ MitM tools like BlueCoat to sniff SSL connections too. > You have not been paying attention to the hundreds of tools available to make HTTPS painless. I have, and they don't. They make it easier, but you know what's truly painless? Hosting an html file over HTTP. What…
Literally in the time you've spent thinking about and composing your reply you could have implemented free, secure TLS for your users.
Earlier quoted context omitted.
The SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren'…
My favorite part of the internet were always the small hobyist websites. The guy that has an encyclopedic database about Grateful Dead trivia, the other guy that collects pictures of plants. Those people are independent, they're not technical and their 90s looking websites are going to go under because of blanket security policies that don't concern them.