71–80 of 128 posts
Earlier quoted context omitted.
Number of connections isn't that relevant with HTTP2
Unfortunately back here in the real world only about 10% or so of all websites support HTTP/2 so it is very relevant.
And infact reducing the number of requests using things like spritemaps, bundling js and css is actually an antipattern with http2.
Earlier quoted context omitted.
Unfortunately back here in the real world only about 10% or so of all websites support HTTP/2 so it is very relevant.
Adding http2 is easier then reducing the number of requests. And infact reducing the number of requests using things like spritemaps, bundling js and css is actually an antipattern with http2.
Those are just ways to lose some of the impact of bloat without addressing the bloat itself.
If you address bloat directly it will benefit all users.
Earlier quoted context omitted.
Wait, why does letsencrypt allow mitm by server provider?
Domain validation only requires an HTTP response. They can easily MitM that specific response to fake a certificate for your domain.
In particular, the company operating the data center your server is in can reliably do this, and so can the backbone provider they use, and probably the server's local government. The DNS provider that controls your domain can mitm the ca process too (though with a higher chance of detection).
The argument for making domain validation yellow (and not red) is that domain validation protects against attacks from residential ISPs / coffee shops, and it would also be hard for a foreign government to launch the attack against their own citizens. They basically have to compromise the CA, tamper with your browser, or just randomly break https with "bad certificate warnings".
Over time, I'd hope more bad security practices (crypto related or not) would lead to yellow bars.
For instance, intel secure enclaves help cloud security a lot, but they are still exotic. If they catch on, and you're at a vps that doesn't offer something like that, then you get a yellow bar starting in 2027.
I don't understand why I need to use https on a static marketing webpage. No login stuff, no JavaScript, nothing. Just straight up HTML and CSS. Right now I need to pay about $150 every year for something that's only used to satisfy Google PageRank (I can't use LetsEncrypt with my hosting provider). Why?
Earlier quoted context omitted.
Wait, why does letsencrypt allow mitm by server provider?
Domain validation only requires an HTTP response. They can easily MitM that specific response to fake a certificate for your domain.
Otherwise it doesn't matter if you use Let's Encrypt as the attacker could just initiate the validation regardless of your CA and end up with a valid certificate (which would still fail cert pinning)
Edit: Oh I see, it's a more about if DV should ever be green.
Earlier quoted context omitted.
Number of connections isn't that relevant with HTTP2
Unfortunately back here in the real world only about 10% or so of all websites support HTTP/2 so it is very relevant.
Presumably, cloudflare is up to its ears in NSL's, illegal wiretaps, etc. If you care at all about mass surveillance, censorship, oppressive governments (in the US, or the location of the cloudflare proxy) you probably should look elsewhere. It's probably controversial, but I'd love to see a yellow security icon in browsers when sites are using well known https relays that can see plaintext (or are doing other obviou…
This analysis seems flawed. If you care about mass surveillance, you want their top-tier security and legal teams working for you.
Earlier quoted context omitted.
Most of the answers you're getting aren't all that big of deal for your site. You still might want https though. You should think about https for sites like yours the way you think about vaccines. SSL everywhere makes everyone safer, even though it doesn't have a tremendous impact on your own site. Also, shameless plug, if you want really easy SSL you can use our new startup: https://fly.io . I'm not sure what countr…
500
Earlier quoted context omitted.
It would have to work without the site's permission, so the browser (or maybe a third party service) would do a basic vulnerability scan. Maybe orange could mean "a script kiddie could pwn this site in under an hour", and yellow would mean "we don't see how your ISP could mitm this, but server side providers (aws, google, azure cloudflare) definitely could." FWIW, my personal website uses let's encrypt, so it would b…
> FWIW, my personal website uses let's encrypt, so it would be yellow or worse. This shouldn't effect your security stance. There's a common misconception that you trust your private keys with your CA and they can somehow transparently MITM you. But they only have your public key, not your private keys, so they can't do that. The security threat from trusted CAs is that they can MITM anyone, regardless of if you use…
Earlier quoted context omitted.
Most of the answers you're getting aren't all that big of deal for your site. You still might want https though. You should think about https for sites like yours the way you think about vaccines. SSL everywhere makes everyone safer, even though it doesn't have a tremendous impact on your own site. Also, shameless plug, if you want really easy SSL you can use our new startup: https://fly.io . I'm not sure what countr…
But of nitpicking, but on mobile the balloon is cut off a bit at the top :)
You can email me if you want to avoid cluttering HN: mrkurt at gmail.