Hacker News Reader

Comment by superkuh | Hacker News Reader

HTTP/1.1 support is the last bastion between the web and complete corporate control. Once the megacorp browsers and man in the middle companies like Cloudflare drop HTTP/1.1 we will no longer be able to host a website without the continued approval of a third party corporation. HTTP/2 and HTTP/3 implemenations require the use of CA based TLS.

Just to preempt misunderstanding: HTTPS is great. But HTTPS only, with no option for HTTP is very much worse than HTTP+HTTPS for human people. Despite being great for for profit companies and institutions.

View on HN

> HTTP/2 and HTTP/3 implemenations require the use of CA based TLS.

You can't do LetsEncrypt?

You can. You can also continue to use private CAs, which presumably could be used to add more options if something happens to Let’s Encrypt.

Let'sEncrypt is still a third-party entity.

From my original comment,

>Just to preempt misunderstanding: HTTPS is great. But HTTPS only, with no option for HTTP is very much worse than HTTP+HTTPS for human people. Despite being great for for profit companies and institutions.

Using LE is great. It's problematic that literally everyone uses it but it's better than it not existing. But using LE does not solve the problem of not being able to use plain HTTP.

Not for LAN only personal websites.

Dumb question, but how is HTTP important on local, switched networks? I have a single switch and don’t fear local MitM. I was under the impression basic HTTP is mostly fine then. Other parties, even on that same switch, won’t be able to listen in (a network hub would allow this).

Some web features are only available on HTTPS and browser really discourage users from entering websites with self-signed certificates.

See: https://developer.mozilla.org/en-US/docs/Web/Security/Secure...

I don't get what you're asking. Why is HTTP/S important?? I don't know how to answer that for you. Security is important regardless of where it is at. Defense in depth, at multiple layers. I don't fear MITM on a local only HTTPS server, I might not trust other devices/traffic on my network that scoop up _everything_ it can, and being in plaintext, would expose more than I want. I trust my services and devices. I don't trust everything on the network especially devices that are not mine, or that I have no control over (set top boxes, Roku TVs, Sec Cameras/NVRs, etc). Of course I have other controls and protections in place, but I trust and WANT LOCAL HTTPS on my services in addition to those.

> I don't fear MITM on a local only HTTPS server

> I trust my services and devices

That is exactly the point. You trust your local, possibly dumb aka unmanaged switch. It's a little piece of silicone with no funny business going on.

Now if you plug a trusted device A as well as an untrusted device B in, the untrusted device won't see any traffic meant for device A:

https://wiki.wireshark.org/CaptureSetup/Ethernet#switched-et...

Point being: as long as you trust all network devices from a trusted machine to another, on a switched Ethernet network, no other device will see any of that traffic at all, on a fundamental, low OSI level. It's not even about HTTP/S at that point yet. All this is untrue for WiFi, where you will want HTTPS indeed.

I'm not advocating against HTTPS at all. I use it as much as possible. But it might actually not be necessary, locally under the right circumstances.

Why not just self-sign for that? Outside of using it to test configurations or deployments, SSL seems a lot less necessary if it's just inside a LAN and all the clients are known.

Some services don't work without HTTPS or transport security. Sometimes, I want transport security on traffic for various reasons. Current mainstream browsers are also refusing to connect to 'self signed certificate' HTTPS sites because they're 'insecure' and continually are disallowing you the user to bypass these 'protections'.

> But HTTPS only, with no option for HTTP is very much worse

Have to agree with this. Been playing with `window.addEventListener('devicemotion')` recently, that shit is https only, which means I can't debug it on a simple localhost. WTF.

https://github.com/FiloSottile/mkcert

Try a quick and dirty local reverse proxy like Caddy. It provides self-signed localhost TLS, trusted on the OS level (if you agree) such that the browser is none the wiser.

That's not quick n' dirty, that's a lot of hassle. I want write index.html and open the local file in a browser and that's it.

$ python -m http.server

then connect to :8000

that's not TLS

Nothing prevents you from using a self signed cert.

It adds security for local deployments as well because you either trust the local CA or your browser tells you that someone has owned your network

> Nothing prevents you from using a self signed cert.

With the various web browsers continuing to disallow or blar warnings about "SELF SIGNED CERT", this is not true. There's a lot of _current issues_ trying to access a self signed HTTPS site using mainstream browsers because they know better than you do.

That is just an implementation detail. It's trivial to create your own local CA, put it into the trust store of your device, use a cert signed by it and be done with it.

I've been using self-signed certs on my websites for 20 years. Part of the problem is that the HTTP/3 implementations do not allow the use of self signed certs. CA based only.

That is just an implementation detail. It's trivial to create your own local CA, put it into the trust store of your device, use a cert signed by it and be done with it.

And that's fine if it's only you and some friends using it. But if I want a random person on the other side of the world to be able to search for $topic and load my website it's not gonna work.

For the last decade or so I've gotten about 1k hits per day on my self-signed HTTP+HTTPS site. Random people will click past the scare tactics of modern browsers re: self signed if the topic is already technical and the demographic understands browsers are stupid. But all these people would be unable to visit under HTTP/2 or HTTP/3 only.

HTTP/1.1 is never going away. Cloud vendors will need to support it approximately forever because so many applications are not HTTP/2 compliant, and technically not even HTTP/1.1 compliant (because of things like header casing) in a way that precludes “down casting” after ingress without a lot of hacky workarounds.

Honestly I don't think browsers will drop HTTP/1 anytime soon because it's inconvenient/impossible to do HTTPS on a local network. I mean, Chrome shows Not Secure on http connections, but not on localhost, and it doesn't mean much anyway. Which is FINE. I mean, maybe input[type=password] gets an alert on HTTP? Just a thought.

> HTTP/2 and HTTP/3 implemenations require the use of CA based TLS.

Well, the standard doesn't, but the browser(s?) implantation(s) do?:

https://http2.github.io/faq/#does-http2-require-encryption

Very few people are going to be setting the compile time options for the libraries that implement HTTP/3 to enable plain HTTP/3 (no one has for HTTP/2). So Google, MS, Apple, etc not supporting plain HTTP/3 is a defacto standard more powerful than the spec Google/MS openwashed through the IETF.

Tell your browser to stop putting up warnings about self-signed TLS then.

I don’t think this is a conspiracy by Big TLS. Rather I think people are mad ISPs are injecting ads into their websites.

Reply on news.ycombinator.com