On: Why HTTPS for Everything?

[tptacek]

This objection has always seemed pretty weird to me.

Of course you can type HTTP commands character-by-character into a terminal. You just have to use a TLS-aware tool to do it.

Meanwhile, you can't really just type HTTP commands to a server without tooling, because a whole bunch of TCP is happening behind the scenes. Why is "telnet" OK, but OpenSSL "s_client" isn't?

[tedunangst → tptacek]

You can't type any lines beginning with Q or R with s_client.

[besselheim → tedunangst]

You can use the -quiet or -ign_eof options to disable this.

[icebraining → besselheim]

You can also use socat (the multipurpose relay) to provide a bare TCP socket to which you can connect, even using telnet.

[mattstreet → tedunangst]

Then it should also be noted that you really shouldn't use telnet to interact with HTTP or SMTP either. Telnet has issues if you send control characters, which wouldn't be used for either protocol, but might exist in embedded data you might want to send or receive. Just use netcat.

[tptacek → mattstreet]

I guess, but it's hard to think of an HTTP request you can't reasonably make with telnet, while s_client apparently won't let you use the Referer header.