Hacker News Reader

Comment by greatgib | Hacker News Reader

Here you can see a multi-year plan and no one complained when it was possible: - let's force everyone to use https. - but https relies on verified domain names and this comes with a cost... Solution: here is let's encrypt, so https everywhere is justified - last step, use the fact that registrar are centralized to ensure the identity of all domain names holders, anonymous servers without https will not be reachable by normal people!

View on HN

There are stakeholders who want Real Name digital signatures for git commits to "critical" open-source software and every dependency. There is already a numerical score for OSS which determines whether bug fixes will be funded by Google and others,

https://openssf.org/press-release/2021/10/13/open-source-sec...

That sounds like a way to punish malicious committers rather than prevent malicious commits.

I'm not a big fan of https, but how is this related to it? Websites that are http-only will be affected as well.

Edit: if you're talking about obtaining certs for bare IPs, it's actually possible to do that. See 1.1.1.1

OP said, "let's force everyone to use https."

My guess is that OP's point was that "everyone" includes servers as well as browsers, presumably by shaming via no lock icon and other tactics.

I know, but I still don't understand how this is related to the news at hand. You'll have to publish your info regardless of which protocols you're using (if any).

you can connect using bare IPs with http.

You can with https as well.

For most of us that means an untrusted cert, and hence a browser warning, but that's equivalent to the browser padlock icon when browsing http (and arguably safer).

Plus, if you are browsing or publishing using plain ip addresses you are already outside the "regular behaviour" so users doing that will be happy to click through.

However this subthread is irrelevant to the main thread. The https/http question is unrelated to the dns question, since dns applies to both equally.

Before you could use ips, or alternative name system, or just private/personal DNS.

This will not work anymore as the https will require to have an official/qualified domain name.

Look at the case of the .dev domain names that were used by a lot of persons, and suddenly google bought the top domain and enforced https mandatory for it in chrome to ensure that no one else could use it anymore.

Also, imagine if the next step is to check that only "approved/legitimate" top domains, respecting some Google policies, are allowed for your own safety...

You are totally overthinking things.

1. This affects http, too. I mean it affects anything using domains names.

2. It's generally a bad argument as there are so many more ways state agencies can mess with you when you use http then when you use https.

3. did you read the article? (I guess no)

4. The problem is DNS and DNS only, everything else is just a side effect from DNS being conceptually broken (wrt. privacy protection and decentralization). Https everywhere is inevitable and good, what isn't is that due to how DNS works we ended up with a (kinda) centralized-only certificate system. Https happens to need certificates, but it doesn't care what system provides them for it. So a complete privacy preserving decentralized certificate (and DNS replacement) could totally work with HTTPS.

Reply on news.ycombinator.com