171–180 of 215 posts
This is very annoying for development in my eyes. What is the preferred way to include https in your development flow? Have an nginx or apache running? What about automated tests against a running application?
This is still mildly annoying.
Earlier quoted context omitted.
Subnet IPs are always different tho. Can I really get a cert for all subnet addresses? That'd be awesome! Please please educate me. I want to be clear though, I need it so that the user doesn't have to install the cert themselves, or have to be online to approve. Previously, a user would connect to the local wireless network, then the router would open them up to a directory listing of the local apps available on the…
I'm not familiar with this exact setup, but I am assuming you have full control over the router software, but want to limit any installation or configuration of either the browser's computer or the local network fileservers. > Subnet IPs are always different tho. Can I really get a cert for all subnet addresses? SSL certs don't usually have anything to do with the IP address, that is usually handled by the hosts file…
Probably can even configure local network file servers, but better if not.
If we don't ever need to use domains in the mesh (we have a separate directory / search system).
Wait, I only have to have the certs locally (offline) on the routers?
Ahh, hmm, cause you're saying I could MITM it. But Browsers (especially on mobile) all usually freak out when they go to `https://subnetIPaddress` saying "your connection is not private" "back to safety" every single time, with freakishly small "prcooed anyways" links on mobile. Either way, mobile or not, this warning totally just trashes the experience. How do I fix that?
Or you're saying they still type in the domain? But doesn't that require existing internet to then go through? Or you're saying, router still MITM that, but happens to have matching private key, so then it is able to locally (offline) proxy the traffic into the mesh? Hmmmmmmmmmmm!!!! This might be very helpful. Sucks we still have to buy certs to run our own offline system - who has the longest certs? (Let's Encrypt is like only 3 months?)
Super thanks to everyone for helping us!
Earlier quoted context omitted.
This feels pessimistic to me: most people didn’t learn the web that way, instead using shared servers — and there were plenty of similar complaints that it was too hard to learn Unix/Windows admin stuff, too. Today, you can use glitch, github pages, jsbin & a million friends, zeit, etc. or the same cheap Dreamhost account people used $20 years ago and start practicing with HTTPS and many other amenities at minimal co…
I have to imagine the "just open a .html file and start playing" route is a huge vector for getting people into proper programming. I know it's what both I and my brother did. Maybe you don't agree, but I think it's a horrible shame that we're making that route less and less possible by disabling features for anything other than HTTPS. Glitch honestly looks really good, but I'm a bit worried about telling people that…
If they do want to get into programming, Scratch and other learning DEs and/or node/js are much better paths than dealing with the layers of barnacles that have accrued over HTML to get to the OPA / Webasm / TS/JS etc "web programming" environments.
.NET and VSCode are free downloads, provide a managed environment, and C# is a good imperative language to start with. It also supports F# if you want to get into functional programming.
Earlier quoted context omitted.
Subnet IPs are always different tho. Can I really get a cert for all subnet addresses? That'd be awesome! Please please educate me. I want to be clear though, I need it so that the user doesn't have to install the cert themselves, or have to be online to approve. Previously, a user would connect to the local wireless network, then the router would open them up to a directory listing of the local apps available on the…
If you are running a network disconnected from the internet, it follows logically that you'll have to reconfigured the normally internet-anchored security mechanisms on end-devices. You always have the option of using another app for this too. Are you sure you don't want confidentiality on the audio/video calls on your network? After all it's passing through all the mesh nodes and vulnerable to eavesdropping.
Earlier quoted context omitted.
I think it's not unreasonable for a techie to be the admin of their own phone. (I still don't get how this is an unpopular opinion.)
> (I still don't get how this is an unpopular opinion.) Not unpopular, just unrealistic. You can't do it on an iPhone, and if you're doing local web development you really ought to be checking it on an iPhone.
It will still work on localhost, which is nice. It would be nice if it also worked on local IPs, like 192.168. . . Those do not work on Chrome, I think, which make mobile testing a bit more cumbersome.
openssl genrsa -out key.pem 2048
openssl req -new -key key.pem -out certificate.csr
openssl x509 -req -in certificate.csr -signkey key.pem -out certificate.pem
Earlier quoted context omitted.
But how do you do local development when you can't get an SSL cert for your dev machine's server? No, self signed certs don't always do what you need, especially on mobile where you can't just add your cert as a trusted cert easily.
Wihtout using any third party service, you could use an SSH tunnel, with autossh for automatic reconnections. autossh -L 2080:localhost:80 192.198.1.14 And then, you'll be able to visit your dev website on http://localhost:2080 Firefox will believe that your service is local, and will allow the activation of the camera and the microphone even though you do not use https.
It will still work on localhost, which is nice. It would be nice if it also worked on local IPs, like 192.168. . . Those do not work on Chrome, I think, which make mobile testing a bit more cumbersome.
Is generating localhost certs and then accepting them in your browser once is that hard? openssl genrsa -out key.pem 2048 openssl req -new -key key.pem -out certificate.csr openssl x509 -req -in certificate.csr -signkey key.pem -out certificate.pem
Earlier quoted context omitted.
I'm not familiar with this exact setup, but I am assuming you have full control over the router software, but want to limit any installation or configuration of either the browser's computer or the local network fileservers. > Subnet IPs are always different tho. Can I really get a cert for all subnet addresses? SSL certs don't usually have anything to do with the IP address, that is usually handled by the hosts file…
Correct. Probably can even configure local network file servers, but better if not. If we don't ever need to use domains in the mesh (we have a separate directory / search system). Wait, I only have to have the certs locally (offline) on the routers? Ahh, hmm, cause you're saying I could MITM it. But Browsers (especially on mobile) all usually freak out when they go to ` https://subnetIPaddress` saying "your connecti…
The script is automated and will ensure that the certificate is always up to date.
Inside the mesh you would need:
* Have an internal DNS that resolves myserver.mymesh.example.com to an internal IP address
* Distribute the private key and certificate to the internal servers of your mesh.
* Have the browsers/clients of your mesh use the DNS names instead of raw IP addresses. So users would have to learn to go to https://myserver.mymesh.example.com instead of https://a.b.c.d
What you will need to do is have an internal DNS server that resolves "myserver.mymesh.example.com" to an internal IP address. The server would use the *.mymesh.example.com private key and cert.
Earlier quoted context omitted.
> It would be nice if it also worked on local IPs, like 192.168... That would defeat the security purpose. Anyone within your local network (which practically speaking very often means the next Wifi your device could find) could attack you.
But how do you do local development when you can't get an SSL cert for your dev machine's server? No, self signed certs don't always do what you need, especially on mobile where you can't just add your cert as a trusted cert easily.