8 May
2018
8 May
'18
3:17 p.m.
From: Clem Cole
I agree with Tannenbaum that uKernel's make more
sense to me in the long
run - even if they do cost something in speed
There's a certain irony in people complaining that ukernel's have more
overhead - while at the same time time mindlessly, and almost universally,
propogating such pinheaded computing hogs as '_mandating_ https for everything
under the sun' (even things as utterly pointless to protect as looking at
Wikipedia articles on mathematics), while simultaneously letting
Amazon/Facebook/Google do the 'all your data are belong to us' number; the
piling of Pelion upon Ossa in all the active content (page after page of
JavaScript, etc) in many (most?) modern Web sites that does nothing more than
'eye candy'; etc, etc.
Noel
8 May
8 May
3:22 p.m.
New subject: unix "awesome list"
On Tue, May 8, 2018 at 9:17 AM, Noel Chiappa <jnc(a)mercury.lcs.mit.edu>
wrote:
But I want sshd on my pdp11 so that I can securely log in :(
Warner
From: Clem
Cole
I agree with Tannenbaum that uKernel's make
more sense to me in the
long
run - even if they do cost something in speed
There's a certain irony in people complaining that ukernel's have more
overhead - while at the same time time mindlessly, and almost universally,
propogating such pinheaded computing hogs as '_mandating_ https for
everything
under the sun' (even things as utterly pointless to protect as looking at
Wikipedia articles on mathematics), while simultaneously letting
Amazon/Facebook/Google do the 'all your data are belong to us' number; the
piling of Pelion upon Ossa in all the active content (page after page of
JavaScript, etc) in many (most?) modern Web sites that does nothing more
than
'eye candy'; etc, etc.
4:18 p.m.
New subject: unix "awesome list"
On 5/8/2018 11:17 AM, Noel Chiappa wrote:
There's a certain irony in people complaining that ukernel's have more
overhead - while at the same time time mindlessly, and almost universally,
propogating such pinheaded computing hogs as '_mandating_ https for everything
under the sun' (even things as utterly pointless to protect as looking at
Wikipedia articles on mathematics), while simultaneously letting
Amazon/Facebook/Google do the 'all your data are belong to us' number; the
piling of Pelion upon Ossa in all the active content (page after page of
JavaScript, etc) in many (most?) modern Web sites that does nothing more than
'eye candy'; etc, etc.
Part of the https wave is the fact that the Tin Foil Hat Society thinks
they are being maliciously monitored by the gov't. The move towards
privacy on the Internet is fostered by this conspiracy-minded
thoughtlessness. Meanwhile, it just adds another step to any entity
wanting to figure out what you've been doing online. Either monitor your
browser (ala telemetry), or the websites themselves. If one were to see
https traffic to a website that's known for it's racist content, then
that pretty much defines what you've been doing without having to
decrypt the actual packets. Much less get your search history from
Google in the first place.
I've heard this very same privacy concern from what I consider
moderately intelligent people I associate with.
I have a (very) small website in http that has a few TOPS-10 items for
download. That doesn't need to be https, but for some reason, I've heard
that Google will lower my rankings because I'm not using https. What
tomfoolery is this?
ak
7:37 p.m.
New subject: unix "awesome list"
On Tue, 8 May 2018, Arthur Krewat wrote:
I have a (very) small website in http that has a few
TOPS-10 items for
download. That doesn't need to be https, but for some reason, I've heard
that Google will lower my rankings because I'm not using https. What
tomfoolery is this?
I'll bet my website (about a few feet away from me) is smaller still :-)
But yeah. I've been told that I *need* HTTPS, even though the damned site
is purely passive...
--
Dave Horsfall BSc DTM (VK2KFU) -- FuglySoft -- Gosford IT -- Unix/C/Perl (AbW)
People who fail to / understand security / surely will suffer. (tks: RichardM)
7:54 p.m.
New subject: unix "awesome list"
On 05/08/2018 01:37 PM, Dave Horsfall wrote:
I'll bet my website (about a few feet away from
me) is smaller still :-)
Props for hosting your own site.
But yeah. I've been told that I *need* HTTPS,
even though the damned
site is purely passive...
I think /need/ may be a strong word.
I *strongly* believe in the various cache ability aspects of unencrypted
HTTP.
That being said, I understand and believe in the two following reasons
for supporting encrypted HTTPS:
1) Encryption (from a verifiable source) makes it next to impossible
for malicious actors to inject things into your site's traffic. (Think
about the various JavaScript injection techniques used for ads /
tracking / malware / crypto mining / etc.)
2) Creating more noise for someone with higher value signal to hide in
when they really need to.
Finally, things like Let's Encrypt and other free cert providers make it
much less expensive to use encrypted HTTPS.
I'm perfectly fine with people running unencrypted HTTP and encrypted
HTTPS side by side. Even if you don't do a redirect from unencrypted
HTTP to encrypted HTTPS.
It's really up to each site administrator. I'm 60% for and 40% against
encrypted HTTPS everywhere.
--
Grant. . . .
unix || die
2183
days inactive
2183
days old
4 comments
5 participants
participants (5)
-
Arthur Krewat -
Dave Horsfall -
Grant Taylor -
jnc＠mercury.lcs.mit.edu -
Warner Losh