Hacker News Reader

Comment by beebmam | Hacker News Reader

It's quite ironic that the "Foundations of Computer Science" are hosted on an HTTP server without TLS.

I was lucky enough to have gone to a university system (UC) which gave me an opportunity to learn the fundamentals of computer science, but when I see major universities (like Stanford) operate public HTTP sites without TLS, I can't be anything other than disappointed.

It's 2022, there's really no excuse to operate public HTTP sites without TLS (with minor exceptions). Even self-signed certificate HTTPS would be far better than HTTP without TLS.

View on HN

Why would it need encryption? The only convincing argument would be stuff like as insertions by ISPs and so on but that's extremely uncommon. Additionally everyone and their mother seems to be a CA these days...

There's more to HTTPS than just data integrity promises. One of the most popular topics on Hacker News is privacy, so I'd imagine people here would understand why virtually all public websites should be HTTPS only.

Ah yes, the obvious privacy implications of reading topics in elementary computer science.

You are right that virtually all public websites should be HTTPS only. Serving static, non-sensitive data is the use case that "virtually" is there for.

> You are right that virtually all public websites should be HTTPS only.

That is correct.

Is there any reason to be so sarcastic here, other your desire to engage in bad faith here? There are good reasons to make the paths that people request on public websites private to the client & server, even when that content is seemingly not interesting (to you) to gather for snooping purposes.

Its always entertaining to see users claiming bad faith when they are engaging in bad faith themselves.

Please list the good reasons that are relevant for a fully publically accessible page of information that contains nothing that asks for usernames/passwords or whatever.

The proof of the burden as to why this website should force all communication to be public is on you. HTTPS exists and configuring it is simple in this era, and the choice to not use it for a university's public website is either laziness or incompetence.

You surely must be aware that content like headers and even URL paths (and other parts of the URL) are confidential over HTTPS.

Why should I allow an employer, an abusive spouse, an abusive parent, a parole officer, a detective looking to charge me with a crime, a gang looking to intimidate me, know which content I'm accessing from a website? All it takes is something like a wireshark application somewhere between (inclusive) my network and the server's network, and they will full have access to everything I've requested from the server and everything it has responded with, including all metadata. No warrants needed.

Like I said in another comment: "Why should we make any personal details about our lives public information if it doesn't need to be? Do you go around announcing all the things that you do in your life that are seemingly harmless? Sometimes revealing information to the public that one would think is harmless can end up doing a lot of harm, both to you and others. Privacy matters, a lot."

> Do you go around announcing all the things that you do in your life that are seemingly harmless?

you must not like twitter much

Don't feed the troll

Going against my better judgement and feeding the troll: While public key cryptography is Computer Science, HTTPS most definitely has nothing to do with Computer Science theory.

Why’s it /so/ disappointing? I/We would definitely appreciate if you could elaborate. I’m not saying https is pointless, but why is it such a big deal for a site like this?

And how is self signed better? If anything I’d say it’s worse! It creates a false sense of security.

Sure I'd be glad to elaborate. Why should we make any personal details about our lives public information if it doesn't need to be? Do you go around announcing all the things that you do in your life that are seemingly harmless? Sometimes revealing information to the public that one would think is harmless can end up doing a lot of harm, both to you and others. Privacy matters, a lot.

A self-signed certificate used for HTTPS still protects the client/server from snooping by a unaffiliated party, even if it doesn't protect from a MITM intercepting and responding to the request in the case where the client hasn't already added this self-signed certificate to their trusted CA store.

There are many rationales already written in many places. https://https.cio.gov/everything/ for instance. Or https://doesmysiteneedhttps.com/ .

Please explain your reasoning. Why would this site need HTTPS?

I don't think any explanation about a particular site is needed. I came to believe that we in HN all agreed that mass surveillance is bad and that promoting HTTPS everywhere is the least we can do make surveillance more difficult.

Just as no one would want government agents following them around as they go about their day attending university lectures, and just as we wouldn't be happy with that agent asking us "Why, what do you have to hide?", we also shouldn't be comfortable with having our visit to resources on stanford.edu be open to surveillance by every node on the network. In a world where even example.com uses TLS, we can surely expect the same from all Stanford subdomains.

Just to push back on your first paragraph, there is no "we in HN". HN is composed of individual people with various degrees of belief in "HTTPS everywhere" and "mass Surveillance is bad", especially since many people here benefit directly or indirectly from money from mass surveillance.

there are many we's in hn emerging from the headlines we choose to click on.

All sites should be using HTTPS. Your phone doesn't audibly broadcast your emails as you send them, your snail mail doesn't come in completely transparent envelopes, and your doors have locks on them. It's minimal security to prevent the injection/filtering of information via MITM and consistent identity (for whatever that's worth).

Take just a moment to think about what the site could look like from China without HTTPS, if the CCP was interested:

Chapter 12 Propositional Logic

Chapter 13 Responsible State Guidance

Chapter 14 Using Logic to Design Computer Components

Chapter 15 Predicate Logic

Now it appears that a notable US institution supporting CCP-sponsored oversight, because someone was too lazy to use a self signed cert.

> Your phone doesn't audibly broadcast your emails as you send them

Funnily enough I used to know a blind woman who would use the iOS screen reader at like 4x speed when doing email.

> your snail mail doesn't come in completely transparent envelopes

You mean like post cards?

> and your doors have locks on them.

Fair =)

not ironic at all, you're just confusing (theoretical) "Computer Science" with "Software Engineering" industry best practices.

I feel like in the absence of an overwhelming justification, your comment is just derailing the topic and attracting unnecessary attention.

Why is it important for this particular site to use https or tls?

> Even self-signed certificate HTTPS would be far better than HTTP without TLS

In what way?

It would protect against passive monitoring but not active attacks.

TOFU still provides some amount of protection. It won't be very reliable, but better than not having it.

Reply on news.ycombinator.com