Hacker News Reader

Comment by codethief | Hacker News Reader

Re [1]: No TLS? :(

Good question, there's no TLS support inside MOROS so its website must be available over HTTP, especially when I self-host it. That's not the case currently so I could also have HTTPS but I'm using Dokku and last time I tried the Let's Encrypt plugin would redirect HTTP to HTTPS automatically, which is annoying.

Edit: I set up CloudFlare in front of the server and there's now a working HTTPS version along with the HTTP version accessible from inside MOROS. This should also work when I'll use again the web server inside the OS. Thanks for prompting me to look into it!

There's nothing sensitive, therefore there is no reason to use TLS.

Other than the build and download links?

No! Stop! Why won’t this one die! MITMing is a two way street. I could intercept sensitive data, or I could shove something in that tricks the user (phishing, etc), exploits the user agent, and more!.

“You only need encryption for the sensitive stuff” is what we did, poorly, in the late ‘00s / early ‘10s, and it was rightfully proven to be a bad idea. There’s a reason why browsers treat HTTP the way they currently do, and it isn’t because they’ve been co-opted by Big Certificate Authority.

EDIT: and as the other commenter says, there are download links.

You don't need encryption to prevent something shoved into it without detection

No but we have no "httpv" protocol scheme to require signatures but not encryption

Which IMO has been a huge mistake since breaking caching proxies for networks because we want to prove authenticity and have to do secrecy as well has been quite silly.

No, but you do need authentication, and TLS does both.

Reply on news.ycombinator.com