Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s on HTTP?

whatsonhttp.com

Post reply on HN
Print view View original

11–20 of 57 posts

Re: What’s on HTTP?

#11

Post by Ferret7446 »

superkuh wrote: post #4

HTTP is incomparibly less fragile than HTTPS which is why HTTP+HTTPS is such a great solution for websites made by human persons for human persons. Lets be clear, corporate or institutional persons using HTTPS alone is fine and reasonable. But for human use cases HTTP+HTTPS gets you the best of both worlds. No HTTPS cert system ever survives longer than a few years without human input/maintainence. There's just too m…

This is such a weird framing. HTTPS is HTTP. TLS is at a different layer of the network stack. You may as well say HTTP through a proxy is better or worse than HTTP through a VPN; all of those statements are equally nonsensical.

You are simply arguing that insecure network requests require less work. Which is obviously true. TLS did not appear out of nothing. Much effort was expended to create it, and there's a reason

Re: What’s on HTTP?

#12

Post by Ferret7446 »

superkuh wrote: post #10
miladyincontrol wrote: post #8

Earlier quoted context omitted.

Agree strongly. An expired cert is better than no cert. Also would argue maintenance is only as complicated as you make it for yourself. Countless people keep patched, secure, https web servers running with minimal effort. If its somehow effort, introspect some on why you are somehow making so much work for yourself.

Might be a bit of each of us touching different ends of the elephant. To be clear I am talking about long timespans. Lets Encrypt hasn't even existed for a full decade yet. During that time it's dropped support entirely for the original acme protocol. During that time it's root certs have expired at least twice (only those I remember where it caused issues in older software). And that's ignoring the churn in acme/acm…

If you can't keep your site's certs working, I don't have much faith you can keep your server working. Maintenance is required in the face of entropy

Re: What’s on HTTP?

#13

Post by Telaneo »

tryauuum wrote: post #6
superkuh wrote: post #4

HTTP is incomparibly less fragile than HTTPS which is why HTTP+HTTPS is such a great solution for websites made by human persons for human persons. Lets be clear, corporate or institutional persons using HTTPS alone is fine and reasonable. But for human use cases HTTP+HTTPS gets you the best of both worlds. No HTTPS cert system ever survives longer than a few years without human input/maintainence. There's just too m…

I'd rather have some expired cert than http I saw once my ISP injecting javascript ads into http traffic and the horror is with me forever

On the one hand, I agree with you given that state of the world.

On the other hand, that state of the world shouldn't exist. It's incredible to me that it's not illegal.

Re: What’s on HTTP?

#14

Post by TZubiri »

tryauuum wrote: post #6
superkuh wrote: post #4

HTTP is incomparibly less fragile than HTTPS which is why HTTP+HTTPS is such a great solution for websites made by human persons for human persons. Lets be clear, corporate or institutional persons using HTTPS alone is fine and reasonable. But for human use cases HTTP+HTTPS gets you the best of both worlds. No HTTPS cert system ever survives longer than a few years without human input/maintainence. There's just too m…

I'd rather have some expired cert than http I saw once my ISP injecting javascript ads into http traffic and the horror is with me forever

I thought that was a one time thing in a 3rd world country blown out of proportion into myth status.

Would you mind sharing what ISP it was and what time period this was in?

Re: What’s on HTTP?

#15

Post by pixl97 »

TZubiri wrote: post #14
tryauuum wrote: post #6

Earlier quoted context omitted.

I'd rather have some expired cert than http I saw once my ISP injecting javascript ads into http traffic and the horror is with me forever

I thought that was a one time thing in a 3rd world country blown out of proportion into myth status. Would you mind sharing what ISP it was and what time period this was in?

Where as my ISP did not put in ads, they did inject messages such as maintenance was going to occur and did things like redirect bad dns to their own search.

Also ISPs were monitoring and selling browsing data years ago.

Re: What’s on HTTP?

#16

Post by tryauuum »

TZubiri wrote: post #14
tryauuum wrote: post #6

Earlier quoted context omitted.

I'd rather have some expired cert than http I saw once my ISP injecting javascript ads into http traffic and the horror is with me forever

I thought that was a one time thing in a 3rd world country blown out of proportion into myth status. Would you mind sharing what ISP it was and what time period this was in?

it was some mobile ISP in Russia. Maybe 6 or 8 years ago

Re: What’s on HTTP?

#17

Post by rcakebread »

TZubiri wrote: post #14
tryauuum wrote: post #6

Earlier quoted context omitted.

I'd rather have some expired cert than http I saw once my ISP injecting javascript ads into http traffic and the horror is with me forever

I thought that was a one time thing in a 3rd world country blown out of proportion into myth status. Would you mind sharing what ISP it was and what time period this was in?

Comcast / Xfinity in the U.S., for example:

https://www.reddit.com/r/technology/comments/9b5ikd/comcastx...

Re: What’s on HTTP?

#18

Post by pocksuppet »

miladyincontrol wrote: post #8
tryauuum wrote: post #6

Earlier quoted context omitted.

I'd rather have some expired cert than http I saw once my ISP injecting javascript ads into http traffic and the horror is with me forever

Agree strongly. An expired cert is better than no cert. Also would argue maintenance is only as complicated as you make it for yourself. Countless people keep patched, secure, https web servers running with minimal effort. If its somehow effort, introspect some on why you are somehow making so much work for yourself.

That's no use when your automated registrar stops working in 3 years because it went out of business or changed protocols. Let's Encrypt has been an outlier.

Re: What’s on HTTP?

#19

Post by fushihara »

TZubiri wrote: post #14
tryauuum wrote: post #6

Earlier quoted context omitted.

I'd rather have some expired cert than http I saw once my ISP injecting javascript ads into http traffic and the horror is with me forever

I thought that was a one time thing in a 3rd world country blown out of proportion into myth status. Would you mind sharing what ISP it was and what time period this was in?

I’m not sure whether this applies globally, but in Japan, around 2015, some mobile carriers deployed a “traffic optimization” feature that would lossily compress images in transit.

On the platforms of NTT Docomo and KDDI (au), users could opt out of this behavior. However, with SoftBank, it could not be disabled, which led to controversy.

As you might expect, this caused issues—since the image data was modified, the hash values changed. As a result, some game apps detected downloaded image files as corrupted and failed to load them properly.

Needless to say, this was effectively a man-in-the-middle attack, so it did not work over HTTPS.

Within a couple of years, the feature seems to have been quietly discontinued.

There were also concerns that this might violate the secrecy of communications, but at least the government authorities responsible for telecommunications did not take any concrete action against it.

There is a Japanese Wikipedia article about this: https://ja.wikipedia.org/wiki/%E9%80%9A%E4%BF%A1%E3%81%AE%E6...

Re: What’s on HTTP?

#20

Post by cellularmitosis »

superkuh wrote: post #4

HTTP is incomparibly less fragile than HTTPS which is why HTTP+HTTPS is such a great solution for websites made by human persons for human persons. Lets be clear, corporate or institutional persons using HTTPS alone is fine and reasonable. But for human use cases HTTP+HTTPS gets you the best of both worlds. No HTTPS cert system ever survives longer than a few years without human input/maintainence. There's just too m…

Any fans of retrocomputing will certainly agree. Much of the plain-HTTP internet that's left is there by them and for them.
Post reply on HN