Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s on HTTP?

whatsonhttp.com

Post reply on HN
Print view View original

41–50 of 57 posts

Re: What’s on HTTP?

#41

Post by echoangle »

Suzuran wrote: post #39
echoangle wrote: post #38

Earlier quoted context omitted.

Can't you get certificates by doing DNS challenges and use those certificates internally? If you don't have to be completely airgapped, doing the DNS challenges shouldn't be too hard.

It is my understanding that DNS challenges are discouraged and/or being deprecated due to the challenge results being less trustworthy than more stringent verification methods. There is also the operational overhead that arises as SSL certificate lifetimes shorten; It is my understanding that there is now a case being made for SSL certificate lifetimes shorter than 24 hours.

I don’t know about the DNS challenge being discouraged, do you have something to read up on that? As far as I know it’s the only common way to get a wildcard cert.

And also the lifetime isn’t a problem in the setup I described, the internal server that uses the cert can do the dns challenge so it can get a new cert whenever it wants. It only needs to be able to access the DNS api.

Re: What’s on HTTP?

#42

Post by 0x000xca0xfe »

echoangle wrote: post #38
0x000xca0xfe wrote: post #37

Earlier quoted context omitted.

HTTP is still the best solution for intranet sites... as long as you cannot run your own fully local CA as hassle-free as DHCP, HTTP will never die.

Can't you get certificates by doing DNS challenges and use those certificates internally? If you don't have to be completely airgapped, doing the DNS challenges shouldn't be too hard.

You could also manually install CA certificates on every client device, or you can tell users to live with the security warnings shown by browsers...

It is currently not possible to keep your internal network private and still have HTTPS without hacks or problems on standard end user devices.

Re: What’s on HTTP?

#43

Post by echoangle »

0x000xca0xfe wrote: post #42
echoangle wrote: post #38

Earlier quoted context omitted.

Can't you get certificates by doing DNS challenges and use those certificates internally? If you don't have to be completely airgapped, doing the DNS challenges shouldn't be too hard.

You could also manually install CA certificates on every client device, or you can tell users to live with the security warnings shown by browsers... It is currently not possible to keep your internal network private and still have HTTPS without hacks or problems on standard end user devices.

> It is currently not possible to keep your internal network private and still have HTTPS without hacks or problems on standard end user devices.

Only if you consider transferring the cert from the public server to your internal server a hack. But how would it ever work otherwise? The CA needs to have some publicly accessible way to check your control of the domain, right?

Re: What’s on HTTP?

#44

Post by superkuh »

hexfran wrote: post #34
pastage wrote: post #33

Earlier quoted context omitted.

There is some kind of middle ground here.. My first HTML file still renders like it did on Mosaic. The HTTP server I used back then still works today 35 years later without maintenance. I do agree that HTTPS is a simple solution but there is too much cargo cult around it. Honestly I do not see the use to maintain everything published if you follow sane practices. EDIT: I have 15 year old things at work that do not co…

Unless I'm misunderstanding your point, your HTTP server from 35 years ago is still working today without any maintenance? Does that mean no security patching and no updates for bugfixes? or does "no maintenance" means something else I'm missing? I find it difficult to discuss these topics when comments like these pretend that you can leave your system exposed on the internet for years without any maintenance. If we'…

Static html webservers don't really have any need for security patching or bugfixes constantly like dynamic complex stuff. They literally can just live forever. The sites themselves are just files. Not applications.

Re: What’s on HTTP?

#45

Post by 0x000xca0xfe »

echoangle wrote: post #43
0x000xca0xfe wrote: post #42

Earlier quoted context omitted.

You could also manually install CA certificates on every client device, or you can tell users to live with the security warnings shown by browsers... It is currently not possible to keep your internal network private and still have HTTPS without hacks or problems on standard end user devices.

> It is currently not possible to keep your internal network private and still have HTTPS without hacks or problems on standard end user devices. Only if you consider transferring the cert from the public server to your internal server a hack. But how would it ever work otherwise? The CA needs to have some publicly accessible way to check your control of the domain, right?

You need a fake DNS entry on your local network for this to work - I would call that a hack.

And what if you aren't running a public webserver like 99% of normal people out there?

> But how would it ever work otherwise? The CA needs to have some publicly accessible way to check your control of the domain, right?

I mean that's exactly the problem: Why do you have to rely on the public CA infrastructure for local devices?

Consider the scenario of a smart wifi bulb in your local network that you want to control with your smartphone.

IMO it would be great to have your home router act as a local CA that can only issue certificates for .local domains and have that trusted per default by user agents. Would make smart home stuff a lot better than the current situation...

Re: What’s on HTTP?

#46

Post by 0x000xca0xfe »

echoangle wrote: post #41
Suzuran wrote: post #39

Earlier quoted context omitted.

It is my understanding that DNS challenges are discouraged and/or being deprecated due to the challenge results being less trustworthy than more stringent verification methods. There is also the operational overhead that arises as SSL certificate lifetimes shorten; It is my understanding that there is now a case being made for SSL certificate lifetimes shorter than 24 hours.

I don’t know about the DNS challenge being discouraged, do you have something to read up on that? As far as I know it’s the only common way to get a wildcard cert. And also the lifetime isn’t a problem in the setup I described, the internal server that uses the cert can do the dns challenge so it can get a new cert whenever it wants. It only needs to be able to access the DNS api.

DNS challenges are a massive PITA, too. I used them for wildcard certificates but gave up after a couple years because manually renewing them every three months was super annoying.

Unfortunately it is not easy to automate either especially if you use multiple domain providers. Not every hosting has an API and Namecheap wanted $50 for enabling it if I remember correctly.

Re: What’s on HTTP?

#47

Post by echoangle »

0x000xca0xfe wrote: post #45
echoangle wrote: post #43

Earlier quoted context omitted.

> It is currently not possible to keep your internal network private and still have HTTPS without hacks or problems on standard end user devices. Only if you consider transferring the cert from the public server to your internal server a hack. But how would it ever work otherwise? The CA needs to have some publicly accessible way to check your control of the domain, right?

You need a fake DNS entry on your local network for this to work - I would call that a hack. And what if you aren't running a public webserver like 99% of normal people out there? > But how would it ever work otherwise? The CA needs to have some publicly accessible way to check your control of the domain, right? I mean that's exactly the problem: Why do you have to rely on the public CA infrastructure for local devic…

> IMO it would be great to have your home router act as a local CA that can only issue certificates for .local domains and have that trusted per default by user agents. Would make smart home stuff a lot better than the current situation...

How would you talk to the router and make sure the communication is actually with the router and not someone else? The browser/lightbulb comes with trusted CAs preinstalled, but then you would have to install the routers CA cert on every device you add to the network.

Re: What’s on HTTP?

#48

Post by 0x000xca0xfe »

echoangle wrote: post #47
0x000xca0xfe wrote: post #45

Earlier quoted context omitted.

You need a fake DNS entry on your local network for this to work - I would call that a hack. And what if you aren't running a public webserver like 99% of normal people out there? > But how would it ever work otherwise? The CA needs to have some publicly accessible way to check your control of the domain, right? I mean that's exactly the problem: Why do you have to rely on the public CA infrastructure for local devic…

> IMO it would be great to have your home router act as a local CA that can only issue certificates for .local domains and have that trusted per default by user agents. Would make smart home stuff a lot better than the current situation... How would you talk to the router and make sure the communication is actually with the router and not someone else? The browser/lightbulb comes with trusted CAs preinstalled, but th…

In the case of WiFi, you use a password and WPA2?

Sure, if someone knows your WiFi password they could set up an "evil" router close to your house with the same SSID and credentials, or they could break into your house and install LAN wiretaps, but c'mon, if you are this paranoid you probably don't even have a smartphone in the first place.

Re: What’s on HTTP?

#49

Post by elixx »

cellularmitosis wrote: post #20
superkuh wrote: post #4

HTTP is incomparibly less fragile than HTTPS which is why HTTP+HTTPS is such a great solution for websites made by human persons for human persons. Lets be clear, corporate or institutional persons using HTTPS alone is fine and reasonable. But for human use cases HTTP+HTTPS gets you the best of both worlds. No HTTPS cert system ever survives longer than a few years without human input/maintainence. There's just too m…

Any fans of retrocomputing will certainly agree. Much of the plain-HTTP internet that's left is there by them and for them.

That explains why I've been using this to find all the cool stuff :) https://whatsonhttp.com/votes

Re: What’s on HTTP?

#50

Post by hrimfaxi »

Would be interested in more details on how this was built. The title of the page "VibeScan Tuner" seems to suggest this was vibecoded but is this actually crawling through IP space or hitting something like shodan?
Post reply on HN