Hacker News new | past | comments | ask | show | jobs | submit login

> HTTPS only, as being pushed in modern times is quite bad.

I'd be interested to hear more about this, care to elaborate?




Web devs have been cargo-culting really hard lately and adopting practices like completely disabling HTTP and only doing 304 redirects to HTTPS on the HTTP interface. They say they need to protect their users from MITM and downgrade attacks if they say anything at all, but realistically this isn't even in the threat model for 99% of sites.

So now we have sites abandoning HTTP entirely and only having HTTPS. So this encourages browsers like Firefox to start enabling things like HTTPS only in their browsers by default. It encourages putting up scaremongering warnings of danger on HTTP sites like HTTPS self-signed certs get (which killed off self signed sites).

So now browsers are beginning to refuse to show HTTP and the web admins are putting up servers that refuse to serve HTTP. That means in the near future unless you can get a cert authority approval (forever) you'll be unable to host a visitable website (ie, get a TLS cert from an authority) and unable to visit most websites that don't play the cert game unless you modify your browser.

Human people cannot be cert authorities. Only corporations can. These two trends towards HTTPS only, on client and server, lead inevitably towards a situation where everywhere is in a handful of cert authority chains and things become easily controlled, or accidentally broken, due to that centralization.




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: