[dead]
What’s on HTTP?
31–40 of 57 posts
Re: What’s on HTTP?
#32[flagged]
Re: What’s on HTTP?
#33Earlier quoted context omitted.
Might be a bit of each of us touching different ends of the elephant. To be clear I am talking about long timespans. Lets Encrypt hasn't even existed for a full decade yet. During that time it's dropped support entirely for the original acme protocol. During that time it's root certs have expired at least twice (only those I remember where it caused issues in older software). And that's ignoring the churn in acme/acm…
If you can't keep your site's certs working, I don't have much faith you can keep your server working. Maintenance is required in the face of entropy
There is some kind of middle ground here.. My first HTML file still renders like it did on Mosaic. The HTTP server I used back then still works today 35 years later without maintenance. I do agree that HTTPS is a simple solution but there is too much cargo cult around it. Honestly I do not see the use to maintain everything published if you follow sane practices.
EDIT: I have 15 year old things at work that do not compile, you have to maintain it for sure, biggest problem is cryptography. I am not sure that unstable tech should be part of the application ever.
Re: What’s on HTTP?
#34Earlier quoted context omitted.
If you can't keep your site's certs working, I don't have much faith you can keep your server working. Maintenance is required in the face of entropy
There is some kind of middle ground here.. My first HTML file still renders like it did on Mosaic. The HTTP server I used back then still works today 35 years later without maintenance. I do agree that HTTPS is a simple solution but there is too much cargo cult around it. Honestly I do not see the use to maintain everything published if you follow sane practices. EDIT: I have 15 year old things at work that do not co…
Unless I'm misunderstanding your point, your HTTP server from 35 years ago is still working today without any maintenance?
Does that mean no security patching and no updates for bugfixes? or does "no maintenance" means something else I'm missing?
I find it difficult to discuss these topics when comments like these pretend that you can leave your system exposed on the internet for years without any maintenance.
If we're talking applications that don't actively listen on the internet that's fine, and I would agree that we should have complete software that just works. But a webserver, unless it's for personal/home use, it's on the internet and I don't see how it could work for 35 years without any update/change
Re: What’s on HTTP?
#35HTTP only is fundamentally disrespectful to your users. It places your needs above theirs. It assumes that your threat model is the same as theirs. There is no excuse for it in 2026.
Re: What’s on HTTP?
#36Earlier quoted context omitted.
I'd rather have some expired cert than http I saw once my ISP injecting javascript ads into http traffic and the horror is with me forever
Agree strongly. An expired cert is better than no cert. Also would argue maintenance is only as complicated as you make it for yourself. Countless people keep patched, secure, https web servers running with minimal effort. If its somehow effort, introspect some on why you are somehow making so much work for yourself.
[deleted]
Re: What’s on HTTP?
#37HTTP only is fundamentally disrespectful to your users. It places your needs above theirs. It assumes that your threat model is the same as theirs. There is no excuse for it in 2026.
HTTP is still the best solution for intranet sites... as long as you cannot run your own fully local CA as hassle-free as DHCP, HTTP will never die.
Re: What’s on HTTP?
#38HTTP only is fundamentally disrespectful to your users. It places your needs above theirs. It assumes that your threat model is the same as theirs. There is no excuse for it in 2026.
HTTP is still the best solution for intranet sites... as long as you cannot run your own fully local CA as hassle-free as DHCP, HTTP will never die.
Can't you get certificates by doing DNS challenges and use those certificates internally? If you don't have to be completely airgapped, doing the DNS challenges shouldn't be too hard.
Re: What’s on HTTP?
#39Earlier quoted context omitted.
HTTP is still the best solution for intranet sites... as long as you cannot run your own fully local CA as hassle-free as DHCP, HTTP will never die.
Can't you get certificates by doing DNS challenges and use those certificates internally? If you don't have to be completely airgapped, doing the DNS challenges shouldn't be too hard.
It is my understanding that DNS challenges are discouraged and/or being deprecated due to the challenge results being less trustworthy than more stringent verification methods. There is also the operational overhead that arises as SSL certificate lifetimes shorten; It is my understanding that there is now a case being made for SSL certificate lifetimes shorter than 24 hours.
Re: What’s on HTTP?
#40HTTP is incomparibly less fragile than HTTPS which is why HTTP+HTTPS is such a great solution for websites made by human persons for human persons. Lets be clear, corporate or institutional persons using HTTPS alone is fine and reasonable. But for human use cases HTTP+HTTPS gets you the best of both worlds. No HTTPS cert system ever survives longer than a few years without human input/maintainence. There's just too m…
Any fans of retrocomputing will certainly agree. Much of the plain-HTTP internet that's left is there by them and for them.
But, as we learned with the telnet filter going into place, we exist on the network at the pleasure of everyone else. Their concerns must come before ours. The needs of the many outweigh the needs of the few.