Hacker News Reader

> We've recently added these features:

> [...]

> - Security up through TLS 1.0 (SSL 3.1).

uhhhhhhhh, isn't this removed from Firefox for having security holes fixed in later versions of the TLS spec?

That line is about twelve years old, per git blame. Typically, I’d use a reverse proxy to handle HTTPS anyways.

I would almost prefer a web framework that doesn't even bother trying to handle things like HTTPS and assumes that I'm using a reverse proxy in front of it. Fewer things to maintain.

Is this generally true for compiled languages ?

I like being able to handle https in a single go binary for small projects that otherwise don't need a load balancer etc.

I don't trust random web frameworks to implement HTTPS correctly and there are lots of subtle attacks on cryptography.

Reply on news.ycombinator.com