Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

431–440 of 463 posts

Re: Chrome’s address bar will use https:// by default

#431

Post by Cyberspy »

RupertEisenhart wrote: post #353
jussij wrote: post #332

Earlier quoted context omitted.

The OP means that in using https (and being forced to used https) you are also being forced into paying a 'third party' an annual fee just to get a valid certificate. That 'third party' is one of the recognized 'certificate authorities'. But the OPs point is by going https, you don't have a choice, you have to pay the certificate tax.

Letsencrypt provide a really good service. I can recommend the docker image made by linuxserver in particular [0]. Makes Https a (tax free) breeze. [0] https://docs.linuxserver.io/general/swag

That's OK then, if that's we all have to do to run any devices inside our LAN/home network.

Want a NAS box for sharing family files/photos or some other IoT device at home? Just set yourself up some other device to run the docker image, get your self a certificate from LetsEncrypt and then... install it on the NAS box? How does that happen?

Re: Chrome’s address bar will use https:// by default

#432

Post by throwaway53453 »

Wowfunhappy wrote: post #337
jodrellblank wrote: post #292

Earlier quoted context omitted.

3 months? I must have updated FireFox / Discord / VS Code /etc. about a hundred times in last 3 months. Plenty for them to add renewed SSL whatevers inside one of the updates.

> 3 months? I must have updated FireFox / Discord / VS Code /etc. I think this state of affairs is nuts. With the exception of Firefox, because web browsers have an inordinate number of security issues to contend with.

And other programs don't?

Re: Chrome’s address bar will use https:// by default

#433

Post by bildung »

rblatz wrote: post #389
colejohnson66 wrote: post #351

Earlier quoted context omitted.

Self signing doesn’t let the world access my website without some scary warning.

That’s irrelevant to this discussion about hosting sites on a LAN with no internet access. If you need https on the public internet you need a trusted cert.

Don't think personal LAN, think e.g. industrial automation: Many sensible companies want modern sensor systems that provide REST APIs and so on, but don't want those to access the internet. The hosts in this case often are appliance-like devices from third parties.

Re: Chrome’s address bar will use https:// by default

#435

Post by wildfire »

j1elo wrote: post #136
simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. What happens with offline LAN? And the ideal IoT devices that we would all want to have? (I mean those we dream about in all IoT HN posts, where the rants typically are that no internet connection should be needed for most of these kinds of devices) What about offlin…

How do the hosts on your local LAN find each other?

If via Multicast DNS, what stops you from publishing TLSA records as well?

Re: Chrome’s address bar will use https:// by default

#437

Post by account42 »

xrisk wrote: post #130
est31 wrote: post #94

Earlier quoted context omitted.

The info "is https available" is not secured either. The ISP can just block any packet on port 443 and force http that way. It would break links but wouldn't break people entering the address via the URL bar. A real improvement in security would be Google caching the data, and either offering it via a custom API or just signing it and appending it to their 8.8.8.8 DNS responses. Per default, Chrome already sends the…

HSTS preload lists exist. And the scenario where an ISP blocks https connections is unrealistic, the server can simply refuse to serve content on http other than redirects.

> HSTS preload lists exist.

Unfortunately, you can't be on the HSTS preload lists and have all newer browsers enforce HTTPS while still having a HTTP fallback for legacy systems. In genereal, the backwards compatibility story with HTTPS has been abysmal - it should have never been a new port or URL scheme in the first place.

Re: Chrome’s address bar will use https:// by default

#438

Post by zajio1am »

stormbrew wrote: post #373
kccqzy wrote: post #267

Earlier quoted context omitted.

The article says > IP addresses, single label domains, and reserved hostnames such as test/ or localhost/ will continue defaulting to HTTP. I don't think this affects you. If you are accessing a device on your LAN, you either use its IP address, or if you use DNS, you must be using your own DNS resolver then. In that case you can just use a single-label domain name such as http://media/ and you can omit the " http://…

You could be using mDNS (bonjour), in which case local addresses look like 'whatever.local'. This is actually pretty common? Honestly if they just made it so self-signed worked for .local that would probably help a lot.

mDNS uses link-local multicast so it does not work if your local network is more than one (l2) network segment (e.g. separate segment for wired and wireless).

Re: Chrome’s address bar will use https:// by default

#439

Post by dijit »

midasuni wrote: post #430
kstrauser wrote: post #327

Earlier quoted context omitted.

An FQDN doesn't imply it's reversed: https://en.wikipedia.org/wiki/Fully_qualified_domain_name I've never seen an FQDN written that way. It may be possible, but it definitely isn't common.

Java’s package names tend to follow the com.domain.subdomain.etc pattern Not seen them elsewhere.

You'll find that on apple computers too.

.com.apple..plist

Re: Chrome’s address bar will use https:// by default

#440

Post by knorker »

j1elo wrote: post #136
simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. What happens with offline LAN? And the ideal IoT devices that we would all want to have? (I mean those we dream about in all IoT HN posts, where the rants typically are that no internet connection should be needed for most of these kinds of devices) What about offlin…

70% of web servers don't have access to the Internet?

Do you have a source on that? I would guess more like 99.99%.

Post reply on HN