Hacker News Reader

Comment by mmmeff | Hacker News Reader

Everyone mentioning their quick and scrappy solutions to setting up TLS termination is completely missing the spirit of the author’s letter. Did y’all even read it?

View on HN

You mean the point that "you could have set up a web server in 2000 and it could still be running today, working perfectly well"

Try to setup a windows 98 machine as a web server and see how it goes (Windows XP only came out in 2002). It doesn't do HTTP/1.1 so it's good question whether clients would be able to connect at all.

Windows XP came out in 2001.

> Try to setup a windows 98 machine as a web server and see how it goes

Windows 98 was a client OS, it was never intended for this. A proper test would be Windows NT 4.0 Server. Or more realistically for the time frame, Solaris 7 or 8.

W98 had a simple HTTP home server available for install, as did BeOS I think. Nothing comparable to Apache/IIS, but it was a thing.

Obviously forget about any security.

Any web server software set up in 2000 and still running today unpatched could be pwned quickly. Including and especially NT 4.0.

When you're running a server, TLS is not the only service you are dependent on; you're also dependent on security updates. If they're not backported, you'll need to make version upgrades.

Arguably it's better to think of every piece of software running on a server like it's a service, to maintain security and performance in an Internet full of hostile actors.

I don't even understand the mindset of wanting to run a live server on ancient software, aside from doing it as a hobby. In which case, it's pretty typical for such hobbies to require extra work and care. Driving around in a car from 1940s takes more maintenance work, and is less safe, than a modern car, and everyone gets that.

I think you misunderstood my comment, I'm not advocating doing this. I was simply correcting the person above me who appears to be under the impression that web servers in the 90s ran on a client OS.

Come, now. In '98 I was writing cgi-bin scripts in perl & c serving websites over apache; by 2000 I was on LAMP which was becoming a de-facto standard web stack.

Of course, I was rolling my own query sanitizers, which was the style at the time; and my php.ini did allow GET/POST to inject global variables. Not to mention CVEs discovered between now and then. So I wouldn't want that server from year 2000 to stay running untouched, but win98 is a strawman.

Incidentally, in 2018 I decommissioned the last perl scripts in the largest US bank, originally written decade(s) ago and handling billions per day (if not trillions).

Could have been yours ;)

> Try to setup a windows 98 machine as a web server

Just so you know, Windows 2000 is vastly more stable than the 9x branch and is perfectly usable, so you should upgrade.

Good point! Win2k was built on the NT kernel and probably would have been "fine" as a webserver.

You're right. Commenters seem to comment based strictly on their perception of the title.

I think however, that authors point was moot already - your network connected machine can't be static, it shouldn't be in years. There are constantly new RCE's and other exploits since ages. Your network connected machine must be maintained, whether it's a basic web server or your phone.

> your network connected machine can't be static, it shouldn't be in years.

Why not? Imagine if it's a purpose built webserver on a microcontroller[^1] which only serves strictly static pages or text files.

[^1]: http://tuxgraphics.org/electronics/200611/embedded-webserver...

Then it's pwned and useless-at-best as soon as an exploit is found, and can never be updated.

Wouldn’t there be a point where we run out of readily exploitable vulnerabilities against a specific platform ?

For instance if I was running a server on an 50 yo IBM framework serving static pages, how many serious attack vectors have been left unpatched at this point ? (ignoring DDOS type of issues where the content is not compromised)

There was a 26-year-old bash bug a few years back. How would you ever know when you'd found the last bug? Unless you do some formal verification of that 50yo IBM framework, I certainly wouldn't trust it to be exposed to the internet.

I would. It's so obscure that it deflects script kiddies with just that and the serious ones would break anything anyway.

You're modeling ability as a binary when it's more like a bell curve. Most attackers are somewhere in the middle and old systems are going to be most vulnerable to them.

> There are constantly new RCE's and other exploits since ages.

And many/most of them connected to the TSL/HTTPS-stack, due to the complexity it brings.

Yes, making websites secure requires work and maintenance and modernisation. The author even admits this. I think i'm ok with what's being lost in this transition.

You might be right but still let me see if can get this analogy right: The author is upset that we have to build a new house and we can't live in the old huts because they are not considered safe anymore. The scrappy solution would be to to keep the hut as it is and build a wall around it. You still risk someone jumping over the fence though.

I think in this analogy the issue I see it that we treat a one-man hut and airport terminal the same. For some buildings it's fine to have higher risks than others.

Of course people would need to be educated on those risks, which would probably be the biggest issue.

> Of course people would need to be educated on those risks, which would probably be the biggest issue.

Frankly, that's impossible in any reasonable timeframe compared to just not allowing unsafe "huts".

It’s more that you can’t live in a house now, you have to stay in a flat built and continuously maintained by others. Where before you could have built a simple, sturdy, and drafty castle that would stand for centuries, now you get a flat in a modern super-secure condo, which is very energy-efficient but requires constant maintenance not to crumble and decay.

Every building needs upkeep. Whether it’s a castle or a cottage.

If you don’t keep up the repairs, eventually the roof fails, rain gets in & then it’s a relatively quick slide into total ruin.

Some upkeep =/= having to repaint the whole thing every 3 months.

His last sentence:

> (At the same time this is necessary to keep HTTPS secure, and HTTPS itself is necessary for the usual reasons. But let's not pretend that nothing is being lost in this shift.)

So, to stay within your analogy: He acknowledges the need for new houses, but says that huts had a unique flair which is lost now.

Reply on news.ycombinator.com