Hacker News Reader

Comment by axegon_ | Hacker News Reader

Well... As a Bulgarian citizen and software engineer, I can't say I'm too enthusiastic about him(or the entire new government for that matter). Apparently founded a cyber security company yet his blog is hosted on:

1. The most godawful place on the planet. I used the company's services when I was 12-13 and I'm still embarrassed to say I've had anything to do with them, even as a client.

2. Didn't even bother to put an ssl certificate which takes literally two minutes and is free with, say, letsecrypt.

View on HN

I always find funny how the IT community in the country decides who to vote for or whether to vote at all. But to address your concerns, although I don't understand how the technicalities around someone's personal blog relate to what kind of a politician they'll be (as opposed to... idk... its 10+ years of content for example):

1. Superhosting is the largest Bulgarian shared hosting provider. Although they indeed offer a relatively mediocre service, they're far from unusable and have low latency for his Bulgarian readership. Also his blog is somewhat old, so there may not have been much choice at the time.

2. He has configured TLS for both https://blog.bozho.net/ and https://techblog.bozho.net/ although no redirect has been added for the first site. As far as we know this may have even been intentional.

As another Bulgarian citizen and software engineer who've had the chance to interact with Bozho on a few of occasions over 15 years, I can't say I'm anything less than excited about the freshness and skill he can bring to Bulgarian politics.

Bozho is a doer.

SSL looks fine to me: https://blog.bozho.net

http://blog.bozho.net/ should be a redirect then, that's still bad. And his twitter links to the http version so yeah...

HTTPS is not a strict improvement over HTTP. Indeed it adds SSL requirements to the client, increases resources needed to access/serve the content, requires to acquire and maintain a certificate, etc.

It's a common practice to offer HTTPS, but you shouldn't think of it as dogma. It's perfectly reasonable to provide both so that people using old terminals (an iPad v1, or an old game console for example) can access the content without technical issues. Or if you want a very low-resources device to access it.

It's all trade-offs and use-cases. One is not a superset of the other.

It's like saying every door should have a lock. No, not every door is improved by adding a lock. Many use-cases are actually not possible with a lock.

Different situations have different tradeoffs, and different people value different things.

The point of https here is to serve as a guarantee that the content you see is the content that was provided by the server and not something that was injected by somewhere between the two ends of the wire. The idea that it should support ipad 1 or old game consoles is just as valid as the idea that websites should support internet explorer 6 or that the linux kernel should have kept support for the i386. No, it's almost 2022, even potatoes can deal with tls.

Of course it's valid to want your website to serve users of IE6 or iPad1. You may not care for such users but not everyone is like you, living in your country, caring about the things you care about.

There are many valid use cases for HTTP, and more broadly, keeping old devices and experiences working as time passes

My country (France) has many buildings and bridges from 500 years ago for instance. I hope these get preserved as there is a lot to learn from them, lots of beauty in them, and they may be more and more relevant in the future.

Not everything should disappear the instant there an alternative. Things co-existing is great.

> The point of https here is to serve as a guarantee that the content you see is the content that was provided by the server and not something that was injected by somewhere between the two ends of the wire.

As I highlighted above, a redirect from http to https is going exactly against this. If you care about MITM attacks for your visitors to that extent, you should not serve any traffic on HTTP. Yet that's a usability nightmare because of how web clients (not just browsers) operate today.

A redirect has its security gotchas as well: if you usually rely on redirects to reach HTTPS sites, you are just as prone to get redirected to a malicious site using MITM attacks (eg. while on a cafe wifi). If there was a redirect, you could easily be MITM-redirected to eg. https://blog.bozh0.net and you might not even notice.

Browsers are finally starting to default to HTTPS without using a whitelist when no protocol is specified. That's the only reasonable approach, and hopefully in a few years, that's prevalent. Maybe browsers can also start doing something "smart" where they also fetch https resource when http is requested, and switch to https if they largely match.

Combining it with secure DNS is the only way to true protection against eavesdropping and MITM attacks.

Reply on news.ycombinator.com