Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Architecture of Open Source Applications

aosabook.org

Post reply on HN
Print view View original

21–28 of 28 posts

Re: The Architecture of Open Source Applications

#21

Post by criddell »

trabant00 wrote: post #18
MaxBarraclough wrote: post #14

Earlier quoted context omitted.

This topic crops up occasionally. With very few exceptions, all web content sent over the public Internet should be protected with HTTPS. The question isn't Why? , but Why haven't they bothered yet? There are plenty of reasons to use HTTPS [0] relating to privacy, security, UI, and browser features, and there are virtually no good reasons not to. There are just 2 real exceptions I know of, neither of which apply here…

I know the general case for HTTPS. I am a system administrator. I was asking for this particular case where I for one see no need.

To prevent things like the Great Cannon of China from performing a denial of service attack against a third party.

Re: The Architecture of Open Source Applications

#22

Post by MaxBarraclough »

trabant00 wrote: post #18
MaxBarraclough wrote: post #14

Earlier quoted context omitted.

This topic crops up occasionally. With very few exceptions, all web content sent over the public Internet should be protected with HTTPS. The question isn't Why? , but Why haven't they bothered yet? There are plenty of reasons to use HTTPS [0] relating to privacy, security, UI, and browser features, and there are virtually no good reasons not to. There are just 2 real exceptions I know of, neither of which apply here…

I know the general case for HTTPS. I am a system administrator. I was asking for this particular case where I for one see no need.

> I for one see no need

asdffdsa mentioned plain old MITM. I listed several other applicable reasons in my linked comment:

1. It allows an unscrupulous ISP to more easily track your browsing

2. Modern browsers will rightly warn users not to trust the site. This makes the site look bad.

3. It prevents MITM injection of ads, trackers, and most importantly malware. There will always be browser exploits, so they're worth blocking.

Re: The Architecture of Open Source Applications

#23

Post by pc86 »

brownianemotion wrote: post #8
trabant00 wrote: post #5

Earlier quoted context omitted.

> To the authors: Please drop TLS in front of your site. It's near trivial and free. Curious why you think it is needed in this case.

It's a trusted site, without https it's e.g. easier to perform a mitm attack that could expose users to attacks. Not only encryption is important, authentication too, you want to know to which party you are talking.

What attacks is a malicious agent going to execute on a page of articles?

I think HTTPS is all well and good, but I've yet to hear a compelling reason why pages of text and images need it.

Re: The Architecture of Open Source Applications

#25

Post by RobertKerans »

Just1689 wrote: post #3

To the authors: Please drop TLS in front of your site. It's near trivial and free. --- I wonder how to take this? Is it good to use these as a recommended approach? I would bet that there could be good examples and bad? Is any of these the leader in terms of approach used for their domain? (Graph databases for example). Could it be that these are `just interesting` but not authoritative?

> Could it be that these are `just interesting` but not authoritative?

Each chapter is just a breakdown of how a programmer/s structured a given application. It's not really about comparing good/bad approaches, or recommending specific approaches. It pops up repeatedly as a recommendation because it's informative and useful but relatively uncommon (compare game development, where detailed post-mortems are a lot easier to find).

Re: The Architecture of Open Source Applications

#26

Post by xanthine »

RobertKerans wrote: post #25
Just1689 wrote: post #3

To the authors: Please drop TLS in front of your site. It's near trivial and free. --- I wonder how to take this? Is it good to use these as a recommended approach? I would bet that there could be good examples and bad? Is any of these the leader in terms of approach used for their domain? (Graph databases for example). Could it be that these are `just interesting` but not authoritative?

> Could it be that these are `just interesting` but not authoritative? Each chapter is just a breakdown of how a programmer/s structured a given application. It's not really about comparing good/bad approaches, or recommending specific approaches. It pops up repeatedly as a recommendation because it's informative and useful but relatively uncommon (compare game development, where detailed post-mortems are a lot easie…

Off-topic: Do you have any recommendations for books or other resources for such game-dev postmortems? I remember that idTech's Doom and Quake were described in one such book, but I'd really like to read about some other major games.

Re: The Architecture of Open Source Applications

#27

Post by RobertKerans »

xanthine wrote: post #26
RobertKerans wrote: post #25

Earlier quoted context omitted.

> Could it be that these are `just interesting` but not authoritative? Each chapter is just a breakdown of how a programmer/s structured a given application. It's not really about comparing good/bad approaches, or recommending specific approaches. It pops up repeatedly as a recommendation because it's informative and useful but relatively uncommon (compare game development, where detailed post-mortems are a lot easie…

Off-topic: Do you have any recommendations for books or other resources for such game-dev postmortems? I remember that idTech's Doom and Quake were described in one such book, but I'd really like to read about some other major games.

Gamasutra was best for this w/r/t essays. GDCVault has a good selection of talks if you dig around. Re books, the Boss Fight book series (I think this is possibly what you alluded to) is generally of a very high standard, though the books are not just purely about development.

Edit: takes a bit more digging, but gamedev.net can be good for this. Particularly when there is a long running thread where a developer documents their progress -- the thread documenting the development of the "Return of the Obra Dinn" is the kind of thing I have in mind

Edit: wasn't gemdev.net, it was the Tig forums for Obra Dinn -- here's them collected on Reddit:

https://www.reddit.com/r/themakingofgames/comments/34qogp/_/

Re: The Architecture of Open Source Applications

#28

Post by brownianemotion »

pc86 wrote: post #23
brownianemotion wrote: post #8

Earlier quoted context omitted.

It's a trusted site, without https it's e.g. easier to perform a mitm attack that could expose users to attacks. Not only encryption is important, authentication too, you want to know to which party you are talking.

What attacks is a malicious agent going to execute on a page of articles? I think HTTPS is all well and good, but I've yet to hear a compelling reason why pages of text and images need it.

The thing is, once you man in the middle it, without https, you can serve whatever content you want. It is no longer a page of "text and images", but one with malicious scripts, malicious links, ... you name it.
Post reply on HN