Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The web server deployment model breaks at hobby scale

w.on-t.work

Post reply on HN
Print view View original

71–75 of 75 posts

Re: The web server deployment model breaks at hobby scale

#71

Post by sam_lowry_ »

josephg wrote: post #70
sam_lowry_ wrote: post #69

Earlier quoted context omitted.

I think we should have gone the legal route, forbidding JS injection in pasing HTML by carriers by e. g. conditioning their liability to the modification of data. That is, if they inject JS or modify the data in any way, they are liable for the content, otherwise not.

Yeah I think we should have done both. Made this illegal, and stopped it via encrypted channels. Computers are fast now. We should just encrypt everything that gets sent over the open internet. The IETF put out a statement about this a few years ago. I agree with their stance. > The IAB urges protocol designers to design for confidential operation by default. We strongly encourage developers to include encryption in…

Encrypted channels as the solution to people's problems is exactly what Poul-Henning Kemp warned against in his last Bikeshed: https://queue.acm.org/detail.cfm?id=3818307

Re: The web server deployment model breaks at hobby scale

#72

Post by josephg »

sam_lowry_ wrote: post #71
josephg wrote: post #70

Earlier quoted context omitted.

Yeah I think we should have done both. Made this illegal, and stopped it via encrypted channels. Computers are fast now. We should just encrypt everything that gets sent over the open internet. The IETF put out a statement about this a few years ago. I agree with their stance. > The IAB urges protocol designers to design for confidential operation by default. We strongly encourage developers to include encryption in…

Encrypted channels as the solution to people's problems is exactly what Poul-Henning Kemp warned against in his last Bikeshed: https://queue.acm.org/detail.cfm?id=3818307

That's a long rant and I don't like homework. Can you summarise his position, or at least the parts you agree with?

Re: The web server deployment model breaks at hobby scale

#73

Post by onkarkdev »

smashed wrote: post #17

I can relate to the TLS termination issue. It is difficult to provide a self hosted version of a web app with a sensible TLS setup. The best is almost not to do it at all. Just have a docker image serve http/1.1 and document that a reverse proxy is required to expose the service. There are simply too many ways to do it and every sys admin/hobbyist has their own preferred way. For the anonymous and authenticated cachi…

[flagged]

Re: The web server deployment model breaks at hobby scale

#74

Post by dsvf »

smashed wrote: post #65
sam_lowry_ wrote: post #58

Earlier quoted context omitted.

No, HTTP is not enough, I submitted a couple HTTP-only links to HN lately, they got flagged within half an hour, even HN crowd can not open HTTP links anymore ;-)

That's not really HN's fault but all modern browsers will warn the user before accessing an http site with a security warning. My point was not to use http only as a finished solution, but to let the admin front the http-only service with their TLS termination solution of choice.

... Of which (TLS terminators) caddy is IMO the easiest for hobbyists, as was the starting point of this subthread

Re: The web server deployment model breaks at hobby scale

#75

Post by sam_lowry_ »

dsvf wrote: post #74
smashed wrote: post #65

Earlier quoted context omitted.

That's not really HN's fault but all modern browsers will warn the user before accessing an http site with a security warning. My point was not to use http only as a finished solution, but to let the admin front the http-only service with their TLS termination solution of choice.

... Of which (TLS terminators) caddy is IMO the easiest for hobbyists, as was the starting point of this subthread

I already commented on this twice here, but here it goes again:

I self-host Immich with Caddy as TLS terminator, and it's far from obvious.

They all run on a small N150 PC in my closet, the same PC serves as my internet router. Both Immich and Caddy run in podman-compose, and there are firewall rules that allow incoming traffic to Caddy and outgoing traffic from Caddy to update certificates. There's also a tricky setup of Systemd dependencies that make sure podman networking and firewall rules play nicely together and with other system config, like the bridge for the 2.4Gz range internal Wi-Fi and for external 5Gz Wi-Fi 6 card.

If not for the LLM help, I would have spent many days figuring out all the rough edges of this setup.

Which is exactly the point OP is making. Hobbying webhosting is hard nowadays.

Post reply on HN