Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s on HTTP?

whatsonhttp.com

Post reply on HN
Print view View original

21–30 of 57 posts

Re: What’s on HTTP?

#21

Post by Gigachad »

superkuh wrote: post #4

HTTP is incomparibly less fragile than HTTPS which is why HTTP+HTTPS is such a great solution for websites made by human persons for human persons. Lets be clear, corporate or institutional persons using HTTPS alone is fine and reasonable. But for human use cases HTTP+HTTPS gets you the best of both worlds. No HTTPS cert system ever survives longer than a few years without human input/maintainence. There's just too m…

If you don't care about security, you could just use a browser which ignores invalid certificates.

Re: What’s on HTTP?

#22

Post by elliot07 »

paulnpace wrote: post #9

Not very useful when most of the pages are default web server pages.

The author should check to see if the HTTP response body contains "nginx" or "apache" and just filter those out. Seems like at least 50% of what I'm seeing.

Also would be nice if there was a hotlink to view the original site directly from the index page.

Re: What’s on HTTP?

#23

Post by TZubiri »

fushihara wrote: post #19
TZubiri wrote: post #14

Earlier quoted context omitted.

I thought that was a one time thing in a 3rd world country blown out of proportion into myth status. Would you mind sharing what ISP it was and what time period this was in?

I’m not sure whether this applies globally, but in Japan, around 2015, some mobile carriers deployed a “traffic optimization” feature that would lossily compress images in transit. On the platforms of NTT Docomo and KDDI (au), users could opt out of this behavior. However, with SoftBank, it could not be disabled, which led to controversy. As you might expect, this caused issues—since the image data was modified, the…

This event sounds much more realistic/common, the motivation of an ISP to save bandwidth costs is much more likely/frequent than the motivation of an ISP to monetize through ads (in addition to monthly service fees).

Re: What’s on HTTP?

#24

Post by ericpauley »

Ferret7446 wrote: post #11
superkuh wrote: post #4

HTTP is incomparibly less fragile than HTTPS which is why HTTP+HTTPS is such a great solution for websites made by human persons for human persons. Lets be clear, corporate or institutional persons using HTTPS alone is fine and reasonable. But for human use cases HTTP+HTTPS gets you the best of both worlds. No HTTPS cert system ever survives longer than a few years without human input/maintainence. There's just too m…

This is such a weird framing. HTTPS is HTTP. TLS is at a different layer of the network stack. You may as well say HTTP through a proxy is better or worse than HTTP through a VPN; all of those statements are equally nonsensical. You are simply arguing that insecure network requests require less work. Which is obviously true. TLS did not appear out of nothing. Much effort was expended to create it, and there's a reaso…

My thoughts exactly. By this logic both are fragile because they run over lossy wireless networks.

The composability of TLS/HTTP is really a beautiful thing.

Re: What’s on HTTP?

#25

Post by forgotmypw17 »

superkuh wrote: post #4

HTTP is incomparibly less fragile than HTTPS which is why HTTP+HTTPS is such a great solution for websites made by human persons for human persons. Lets be clear, corporate or institutional persons using HTTPS alone is fine and reasonable. But for human use cases HTTP+HTTPS gets you the best of both worlds. No HTTPS cert system ever survives longer than a few years without human input/maintainence. There's just too m…

Agree 100%. HTTP is much more accessible, and HTTPS has more failure modes. When I want to ensure that someone can read my content, I offer both.

Re: What’s on HTTP?

#26

Post by userbinator »

tryauuum wrote: post #6
superkuh wrote: post #4

HTTP is incomparibly less fragile than HTTPS which is why HTTP+HTTPS is such a great solution for websites made by human persons for human persons. Lets be clear, corporate or institutional persons using HTTPS alone is fine and reasonable. But for human use cases HTTP+HTTPS gets you the best of both worlds. No HTTPS cert system ever survives longer than a few years without human input/maintainence. There's just too m…

I'd rather have some expired cert than http I saw once my ISP injecting javascript ads into http traffic and the horror is with me forever

That's when you connect the VPN...

Re: What’s on HTTP?

#27

Post by toast0 »

Gigachad wrote: post #21
superkuh wrote: post #4

HTTP is incomparibly less fragile than HTTPS which is why HTTP+HTTPS is such a great solution for websites made by human persons for human persons. Lets be clear, corporate or institutional persons using HTTPS alone is fine and reasonable. But for human use cases HTTP+HTTPS gets you the best of both worlds. No HTTPS cert system ever survives longer than a few years without human input/maintainence. There's just too m…

If you don't care about security, you could just use a browser which ignores invalid certificates.

Invalid certificates are one thing, and you can probably click through that. But maybe your older browser tops out at TLS 1.0, and servers don't offer that anymore (I think the credit card PCI cert discourages it) or maybe your older browser can't do ECC certs and the server you want to talk to only has an ECC cert.

Or maybe your older server only speaks TLS 1.0 and that's not cool anymore. Or it could only use sha1 certs, so it can't get a current cert.

When I can, I like to server http and https, and serve the favicon with HTTPS and use HSTS to induce current clients to use https for everything. Finally, a use for the favicon.

Re: What’s on HTTP?

#29

Post by Dylan16807 »

toast0 wrote: post #27
Gigachad wrote: post #21

Earlier quoted context omitted.

If you don't care about security, you could just use a browser which ignores invalid certificates.

Invalid certificates are one thing, and you can probably click through that. But maybe your older browser tops out at TLS 1.0, and servers don't offer that anymore (I think the credit card PCI cert discourages it) or maybe your older browser can't do ECC certs and the server you want to talk to only has an ECC cert. Or maybe your older server only speaks TLS 1.0 and that's not cool anymore. Or it could only use sha1…

Someone with an older browser can update the browser outside of very niche situations. I have little concern for that use case.

If a server can't do TLS 1.2 from 2008 I question how it's still stable and unhacked more than anything.

Re: What’s on HTTP?

#30

Post by offmycloud »

TZubiri wrote: post #14
tryauuum wrote: post #6

Earlier quoted context omitted.

I'd rather have some expired cert than http I saw once my ISP injecting javascript ads into http traffic and the horror is with me forever

I thought that was a one time thing in a 3rd world country blown out of proportion into myth status. Would you mind sharing what ISP it was and what time period this was in?

Cox Communications used to do it in California to inject JS into sites. I remember seeing little Cox popup/toast messages in the corner of other sites.
Post reply on HN