News for hackers. Stuff that matters.

A comment on The Gemini protocol as seen by curl maintainer. Parent comment

Re:The Gemini protocol as seen by curl maintainer by teruakohatu on Sunday May 28, 2023 @05:25PM (#36107936)
Without TLS you cannot be sure the content was not modified after it was sent to you but before you received.

It is a reasonable requirement in the 2020s.

[ Parent | on HN ]
Re:The Gemini protocol as seen by curl maintainer by rhabarba on Sunday May 28, 2023 @05:50PM (#36108135)
I see my mistake. Sorry.
[ Parent | on HN ]
Re:The Gemini protocol as seen by curl maintainer by jumpyjumps on Sunday May 28, 2023 @06:37PM (#36108453)
If it's self signed and TOFU you can't be sure there was no proxy in the middle on first use though.
[ Parent | on HN ]
Re:The Gemini protocol as seen by curl maintainer by junon on Sunday May 28, 2023 @07:04PM (#36108668)
Self signed != inherently insecure. If you have the public key, verified it, and you want to make sure that you're getting content directly from the server, you can do just that. It's just not got a chain of trust with root certs that are built into the browser.
[ Parent | on HN ]
Re:The Gemini protocol as seen by curl maintainer by jumpyjumps on Sunday May 28, 2023 @07:49PM (#36108952)
My point is how do you get the public key if you can't trust what has been published? You can't trust the gemini site, you'd have to use another protocol, such as HTTPS signed by a CA in order to verify the public key you are being given was actually signed by the author and not someone in the middle rewriting the authors gemini content.
[ Parent | on HN ]