News for hackers. Stuff that matters.
Re:The modern HTTPS world has no place for old web servers by maxk42 on Wednesday May 13, 2020 @02:03PM (#23169742)
The other issue is that a certificate-based model of trust can be wielded by governments to censor the internet.

Unsecure http is essential to the free flow of information.

Let's get the right solution before we force everyone to use it.

Re:The modern HTTPS world has no place for old web servers by zzo38computer on Wednesday May 13, 2020 @04:36PM (#23171555)
Don't force anyone to use it. Both HTTP and HTTPS can be used, in addition to other protocols such as SMTP, NNTP, Gopher, Telnet, SSH, etc. To ensure to have free internet, to allow all protocols including if someone invents a new one, and including if someone uses non-standard port numbers for whatever reason, and including in both directions (anyone can act as a server or as a client or both).
Re:The modern HTTPS world has no place for old web servers by krapp on Wednesday May 13, 2020 @02:09PM (#23169808)
If governments want to censor the internet, insecure protocols only make it easier for them.
Re:The modern HTTPS world has no place for old web servers by apostacy on Wednesday May 13, 2020 @03:12PM (#23170583)
Restricted devices (Most Android and iOS devices) that can only trust certificates that are ultimately controlled by the government is a far greater vector for censorship.

Devices that can be made to update on the whim of some corporation (which can be compelled by the government) are also not at all secure.

I don't consider my house secure if the lock company and the police have a skeleton key to my front door.

Open devices that can use open protocols are best. That is why they are trying to deprecate them.

Re:The modern HTTPS world has no place for old web servers by apostacy on Wednesday May 13, 2020 @03:09PM (#23170536)
That is correct. I have heard rumors that there are people at Google who want to wield their architecture to censor websites they disagree with. Essentially marking certain websites as malicious, solely because they don't want people to be able to view them.

I don't think it is at all far fetched. We've already seen domain registrars in the United States arbitrary delete domain names for purely political reasons that they made up on the spot. Why not revoke certificates from websites that they find objectionable?

It's not like most users would know how to force their device to connect anyway. On many Android devices, it is virtually impossible to force your browser to connect to a site Google doesn't want you to. But they've gotten this far because we trust them to only protect us from malicious sites.

Re:The modern HTTPS world has no place for old web servers by apostacy on Wednesday May 13, 2020 @11:40PM (#23175008)
It would be great if people could correct the record instead of just cowardly downvoting me. If I am presenting something that is untrue, please let me know.

Am I being paranoid for not trusting Google, Facebook or the federal government?