Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to build an absurdly backwards-compatible website

flower.codes

Post reply on HN
Print view View original

21–30 of 67 posts

Re: How to build an absurdly backwards-compatible website

#21

Post by GuB-42 »

jefftk wrote: post #8

I don't think that the advice to offer non-HTTPS is good: it exposes your users to downgrade (SSL stripping) attacks. Even extremely old browsers supported HTTPS: it was added to Netscape in 1994, and Internet Explorer in 1995 (IE2). You shouldn't have to give up security for users of modern browsers in pursuit of backwards compatibility. (It might be a bit tricky to find an HTTPS configuration that supports for both…

The site is compatible with IE1, HTTPS would break that. Unacceptable.

And I don't believe it is possible to have an HTTPS configuration that suits both old and new browsers since new browsers regularly deprecate older versions of SSL/TLS. I think that anything less than TLS 1.2 is deprecated in many browsers now. and TLS 1.2 is from 2008, way too modern for a website focused on compatibility.

For compatibility, HTTP is your only choice, secure protocols are likely to deprecate regularly as new vulnerabilities are found and stronger protocols are made.

Re: How to build an absurdly backwards-compatible website

#22

Post by goodoldneon »

zachflower wrote: post #17
amiga-workbench wrote: post #15

Regarding https, one thing I like to do on my personal websites is listen if the client actually wants to upgrade protocols instead of forcing https on everyone. set $need_http_upgrade "$https$http_upgrade_insecure_requests"; location / { if ($need_http_upgrade = "1") { add_header Vary Upgrade-Insecure-Requests; return 301 https://$host$request_uri; } index index.php index.html; try_files $uri $uri/ /index.php?$query…

Oooo I like this! I’ll have to steal it. Thanks for the tip!

Don’t do this. What if something strips the header between the client and your server? Always upgrade to HTTPS. Not doing so isn’t worth supporting 25 year old browsers

Re: How to build an absurdly backwards-compatible website

#23

Post by superkuh »

goodoldneon wrote: post #22
zachflower wrote: post #17

Earlier quoted context omitted.

Oooo I like this! I’ll have to steal it. Thanks for the tip!

Don’t do this. What if something strips the header between the client and your server? Always upgrade to HTTPS. Not doing so isn’t worth supporting 25 year old browsers

That depends what your website is. If it's for some commercial or sensitive thing then yeah, just HTTPS is okay. But if it's something of yours (and isn't just done to get you hired) then the downsides of HTTPS-only outweight the benefits. HTTP+HTTPS is perfect for human persons even if it's not for corporate persons.

You're basically making it so that people can only visit your site if a third party corporation wants to maintain an account with you. There are benign organizations like LetsEncrypt but it still means giving up control to an entity that will eventually go bad. Just look at what happened to dot Org.

And of course you prevent even moderately old systems from interacting with your web server. Depending on your accepted TLS cypher set you're probably excluding software from as late as 2017 by going HTTPs only.

It's like wearing level 3 body armor when you go out to the park to walk to the dog. There are some people who have lives where that's necessary, but it really isn't for most. And the downsides outweigh the admittedly very safe protection.

Re: How to build an absurdly backwards-compatible website

#25

Post by taftster »

> Let's face it: the internet is broken.

This is where I disconnect. The internet is not broken. Maybe arguably the _web_ is broken, and specifically, web pages are broken (the HTTP protocol is still a wonderful thing).

I wish technical authors would stop making the internet-is-broken meme when they really mean the web is broken. Sure, there's plenty broken with the internet in other ways (DNS, encryption, governments, ddos's, etc.), but let's not make the mistake that the internet equals the web.

Re: How to build an absurdly backwards-compatible website

#27

Post by adamddev1 »

taftster wrote: post #26
adamddev1 wrote: post #24

Very beautiful typography. Feels quite satisfying to read.

White-on-black is hard for me to read and goes blurry. I had to switch to reader-mode to read this. Are you on mobile or desktop?

Desktop (macbook air M1)

Re: How to build an absurdly backwards-compatible website

#28

Post by pabs3 »

amiga-workbench wrote: post #15

Regarding https, one thing I like to do on my personal websites is listen if the client actually wants to upgrade protocols instead of forcing https on everyone. set $need_http_upgrade "$https$http_upgrade_insecure_requests"; location / { if ($need_http_upgrade = "1") { add_header Vary Upgrade-Insecure-Requests; return 301 https://$host$request_uri; } index index.php index.html; try_files $uri $uri/ /index.php?$query…

One other trick to do this is include a https resource (image/CSS/JS) in the http page, and on https use the HTTP header that forces https for the domain. So then if the resource loads successfully, future loads of the site go to https. Browsers that don't support Upgrade-Insecure-Requests often support the https-only header.

Re: How to build an absurdly backwards-compatible website

#29

Post by pabs3 »

goodoldneon wrote: post #22
zachflower wrote: post #17

Earlier quoted context omitted.

Oooo I like this! I’ll have to steal it. Thanks for the tip!

Don’t do this. What if something strips the header between the client and your server? Always upgrade to HTTPS. Not doing so isn’t worth supporting 25 year old browsers

The thing could just strip the upgrade to https anyway. Lots of those sort of tricks are implemented in sslstrip:

https://github.com/moxie0/sslstrip

Re: How to build an absurdly backwards-compatible website

#30

Post by true_religion »

superkuh wrote: post #23
goodoldneon wrote: post #22

Earlier quoted context omitted.

Don’t do this. What if something strips the header between the client and your server? Always upgrade to HTTPS. Not doing so isn’t worth supporting 25 year old browsers

That depends what your website is. If it's for some commercial or sensitive thing then yeah, just HTTPS is okay. But if it's something of yours (and isn't just done to get you hired) then the downsides of HTTPS-only outweight the benefits. HTTP+HTTPS is perfect for human persons even if it's not for corporate persons. You're basically making it so that people can only visit your site if a third party corporation want…

> You're basically making it so that people can only visit your site if a third party corporation wants to maintain an account with you.

I don’t know about you but people can only visit my site if a “third party” maintains an account with me… and that third party is my ISP.

The web, even self hosted sites, isn’t some direct person to person contact network. It relies on a wealth of protocols and a community backing it.

Now to be fair, I do upgrade everyone but I don’t do so because of security concerns.I do it because the protocol inconsistency occasionally shows up in my logs, and sometimes browsers block APIs based on if you are HTTPS or not. It’s be nice if they didn’t but browsers are yet another third party in between my severs and my end user.

Post reply on HN