Why HTTPS for Everything?

Re:Why HTTPS for Everything? by tptacek on Monday January 02, 2017 @11:08AM (#13301879)

This objection has always seemed pretty weird to me.

Of course you can type HTTP commands character-by-character into a terminal. You just have to use a TLS-aware tool to do it.

Meanwhile, you can't really just type HTTP commands to a server without tooling, because a whole bunch of TCP is happening behind the scenes. Why is "telnet" OK, but OpenSSL "s_client" isn't?

[ Parent | on HN ]

Re:Why HTTPS for Everything? by tedunangst on Monday January 02, 2017 @11:54AM (#13302307)

You can't type any lines beginning with Q or R with s_client.

[ Parent | on HN ]

Re:Why HTTPS for Everything? by besselheim on Monday January 02, 2017 @12:00PM (#13302359)

You can use the -quiet or -ign_eof options to disable this.

[ Parent | on HN ]

Re:Why HTTPS for Everything? by icebraining on Monday January 02, 2017 @12:19PM (#13302561)

You can also use socat (the multipurpose relay) to provide a bare TCP socket to which you can connect, even using telnet.

[ Parent | on HN ]

Re:Why HTTPS for Everything? by mattstreet on Monday January 02, 2017 @02:13PM (#13303561)

Then it should also be noted that you really shouldn't use telnet to interact with HTTP or SMTP either. Telnet has issues if you send control characters, which wouldn't be used for either protocol, but might exist in embedded data you might want to send or receive. Just use netcat.

[ Parent | on HN ]

Re:Why HTTPS for Everything? by tptacek on Monday January 02, 2017 @02:21PM (#13303624)

I guess, but it's hard to think of an HTTP request you can't reasonably make with telnet, while s_client apparently won't let you use the Referer header.

[ Parent | on HN ]