7 ms·

I mean on some sites I make, I just don't care if its encrypted. I hate that I have to just because all you mofo's have forced me.

by rc_bhg 8y ago

mlfn 8y ago
Who's forcing you?
- donatj 8y ago
  Chrome, mostly.
  - filleduchaos 8y ago
    How is Chrome forcing you to implement HTTPS on your server?
  - andyjh 8y ago
    Chrome isn't forcing anyone, it's just making it clear to users that a non-https site is insecure, which it is. What's the problem with providing information so that users can make an informed choice about whether to use the site?
diafygi 8y ago
And I hate the fact that I can't trust the network to not modify your sites when I visit them. So I guess we can both be mad together. Remember that https offers both privacy and integrity, so even if you don't care about the privacy, you should care about the integrity.
- whorleater 8y ago
  >you should care about the integrity I mean, there's the option to not use my site. Can I take a stand against HTTPS because I believe PKI to be a dumpster fire?
  - yjftsjthsd-h 8y ago
    Of course you can do that. And everyone can choose not to use insecure sites like yours.
  - dwheeler 8y ago
    Sure, PKI has serious problems. But HTTP without HTTPS has far worse problems. Nothing is perfect. Waiting for the perfect, while failing to help in easy ways that you can do now, is a poor choice. In any case, HTTPS doesn't protect your site, it protects the users of your site (by protecting the confidentiality and integrity of the data in transit). If you don't care about your users, then those potential users should avoid your site. MITM attacks have become pervasive. HTTPS was less important years ago, but that time has passed. For example, ISPs, hotels, airlines, and many others have decided that it's okay to attack their customers. Supporting HTTPS is an easy way to help those users. It doesn't need to be perfect to be useful.
  - dagenix 8y ago
    This is like taking a stand against seatbelts. No one can do you from doing so, but it makes very little sense to and seems like it has more to do with an insistence of being contrary than to make a point or actually change something.
  - crunchatized 8y ago
    I mean, you can. But the heavily flawed PKI is rapidly improving from the dumpster fire it has been. The glaring 'blindly trust every CA to never go rogue' problem is on the edge of being solved, with browsers beginning to require CAs to submit all new certificates to Certificate Transparency logs in order to be accepted. Attackers would have to either compromise multiple targets in detectable ways, or publicly disclose their forged certificate to the world before they can use it, at least once the older certificates from the dark ages of 2017 have all expired in a few years.
CiPHPerCoder 8y ago
> I hate that I have to just because all you mofo's have forced me. I can't empathize with this perspective. "Encrypt every packet with strong cryptography" is the mission statement of the information security community ever since Edward Snowden went public. The "mofos" have "forced" you to protect your users from attacks like QUANTUMINSERT. The "mofos" have "forced" you to protect your users from abusive ISPs injecting advertisements that track them into web pages that gain no revenue from these ads. The "mofos" have "forced" you to protect your users from being hit with increased malvertising and watering hole attacks because ISPs generally cannot secure their own systems. I think the wins here far outweigh the temporary inconvenience of having to install/use certbot.
- dragontamer 8y ago
  Okay, I'll bite. Why would strong-encryption be necessary for a video game guide web-page? Say, one about Factorio? Some game communities are toxic. IE: Minecraft guides I'd host with https due to the threat of scumbags and hackers. But Factorio's community is incredibly lax and laid-back. So I would consider HTTPS to be a waste of effort and resources.
  - kerng 8y ago
    Because otherwise an ISP might insert ads, or some adversary changes the content and inserts malware. Also, as a consumer of your blog I want privacy, no need for ISP to know what I click on and read exactly. These are just a few reasons why.
    - dragontamer 8y ago
      > Also, as a consumer of your blog I want privacy, no need for ISP to know what I click on and read exactly. In this hypothetical example, you're clicking on a video game guide. Someone watching you buy games from Gamestop would have more information than someone watching you click on "How Factorio Trains Work" or something else on this hypothetical example. If the reverse DNS points to the IP address of the blog (ie: people see that you're browsing "FactorioGuide.com"), they're gonna figure out that you're learning how to play the game Factorio in any case. Even if all the traffic were encrypted. The only way people don't know what you're doing is if the guide were on a shared host with many-many webpages on a singular IP Address. But otherwise, the typical website (ie: self-hosted on a VPS) would have a unique IP Address and a unique reverse-DNS entry. And people would figure out how long you've been browsing and what you've been looking at, even through HTTPS.
jonafato 8y ago
HTTPS is for the users' benefit. They should be able to trust that they're getting the content they asked for without modification or snooping.

I mean on some sites I make, I just don't care if its encrypted. I hate that I have to just because all you mofo's have forced me.

by rc_bhg 8y ago

I mean on some sites I make, I just don't care if its encrypted. I hate that I have to just because all you mofo's have forced me.

mlfn 8y ago

Who's forcing you?

donatj 8y ago
Chrome, mostly.
- filleduchaos 8y ago
  How is Chrome forcing you to implement HTTPS on your server?
- andyjh 8y ago
  Chrome isn't forcing anyone, it's just making it clear to users that a non-https site is insecure, which it is. What's the problem with providing information so that users can make an informed choice about whether to use the site?

diafygi 8y ago

And I hate the fact that I can't trust the network to not modify your sites when I visit them. So I guess we can both be mad together. Remember that https offers both privacy and integrity, so even if you don't care about the privacy, you should care about the integrity.

whorleater 8y ago
>you should care about the integrity I mean, there's the option to not use my site. Can I take a stand against HTTPS because I believe PKI to be a dumpster fire?
- yjftsjthsd-h 8y ago
  Of course you can do that. And everyone can choose not to use insecure sites like yours.
- dwheeler 8y ago
  Sure, PKI has serious problems. But HTTP without HTTPS has far worse problems. Nothing is perfect. Waiting for the perfect, while failing to help in easy ways that you can do now, is a poor choice. In any case, HTTPS doesn't protect your site, it protects the users of your site (by protecting the confidentiality and integrity of the data in transit). If you don't care about your users, then those potential users should avoid your site. MITM attacks have become pervasive. HTTPS was less important years ago, but that time has passed. For example, ISPs, hotels, airlines, and many others have decided that it's okay to attack their customers. Supporting HTTPS is an easy way to help those users. It doesn't need to be perfect to be useful.
- dagenix 8y ago
  This is like taking a stand against seatbelts. No one can do you from doing so, but it makes very little sense to and seems like it has more to do with an insistence of being contrary than to make a point or actually change something.
- crunchatized 8y ago
  I mean, you can. But the heavily flawed PKI is rapidly improving from the dumpster fire it has been. The glaring 'blindly trust every CA to never go rogue' problem is on the edge of being solved, with browsers beginning to require CAs to submit all new certificates to Certificate Transparency logs in order to be accepted. Attackers would have to either compromise multiple targets in detectable ways, or publicly disclose their forged certificate to the world before they can use it, at least once the older certificates from the dark ages of 2017 have all expired in a few years.

CiPHPerCoder 8y ago

> I hate that I have to just because all you mofo's have forced me. I can't empathize with this perspective. "Encrypt every packet with strong cryptography" is the mission statement of the information security community ever since Edward Snowden went public. The "mofos" have "forced" you to protect your users from attacks like QUANTUMINSERT. The "mofos" have "forced" you to protect your users from abusive ISPs injecting advertisements that track them into web pages that gain no revenue from these ads. The "mofos" have "forced" you to protect your users from being hit with increased malvertising and watering hole attacks because ISPs generally cannot secure their own systems. I think the wins here far outweigh the temporary inconvenience of having to install/use certbot.

dragontamer 8y ago
Okay, I'll bite. Why would strong-encryption be necessary for a video game guide web-page? Say, one about Factorio? Some game communities are toxic. IE: Minecraft guides I'd host with https due to the threat of scumbags and hackers. But Factorio's community is incredibly lax and laid-back. So I would consider HTTPS to be a waste of effort and resources.
- kerng 8y ago
  Because otherwise an ISP might insert ads, or some adversary changes the content and inserts malware. Also, as a consumer of your blog I want privacy, no need for ISP to know what I click on and read exactly. These are just a few reasons why.
  - dragontamer 8y ago
    > Also, as a consumer of your blog I want privacy, no need for ISP to know what I click on and read exactly. In this hypothetical example, you're clicking on a video game guide. Someone watching you buy games from Gamestop would have more information than someone watching you click on "How Factorio Trains Work" or something else on this hypothetical example. If the reverse DNS points to the IP address of the blog (ie: people see that you're browsing "FactorioGuide.com"), they're gonna figure out that you're learning how to play the game Factorio in any case. Even if all the traffic were encrypted. The only way people don't know what you're doing is if the guide were on a shared host with many-many webpages on a singular IP Address. But otherwise, the typical website (ie: self-hosted on a VPS) would have a unique IP Address and a unique reverse-DNS entry. And people would figure out how long you've been browsing and what you've been looking at, even through HTTPS.

jonafato 8y ago

HTTPS is for the users' benefit. They should be able to trust that they're getting the content they asked for without modification or snooping.