Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I love such focused, cooperative and mature tools. They do one thing well, play nicely and keep their promises.

however, using lighttpd due to https.



Why not a separate TLS terminator like Hitch[1]? (Why do people in general insist that TLS be built and linked into everything?)

[1] https://hitch-tls.org/


yes, that would be it. I thought of stunnel. But that's extra moving parts.


The scale goes from “less moving parts” to “more focused”; the optimal point varies, but I don’t think you can get away from the fact that those are in opposition. Of course, the usual vernacular meaning of “more focused” is “does less things I don’t need”, but that’s not unrelated: because everyone needs a different subset of things, the more things a given piece of software needs the larger, on average, the proportion of those that you don’t need; so running more pieces of (less feature-rich) software seems necessary in order for having less stuff you don’t need or understand overall.

(In the specific case of TLS, I get additional warm fuzzies from being sure that, however screwed up the web server is, it cannot be confused[1] into revealing the secret keys when it does not have access to them in the first place. I don’t know to which extent this is actually important, though. A factotum[2]-like approach is a compromise that gives the web server the ephemeral keys in exchange for not having to pass the entirety of the traffic through the terminator, but I’m not aware of any practical implementations except for the one Akamai, disgustingly, patented[3] 10 years after the actual invention.)

[1] http://www.cap-lore.com/CapTheory/ConfusedDeputy.html

[2] https://www.usenix.org/conference/11th-usenix-security-sympo... or http://doc.cat-v.org/plan_9/4th_edition/papers/auth

[3] https://patents.google.com/patent/US9531685B2 (wow, I though this was the Cloudflare patent, but that one, https://patents.google.com/patent/US8782774B1, is even more trivial)


> warm fuzzies from being sure that, however screwed up the web server is, it cannot be confused[1] into revealing the secret keys when it does not have access to them in the first place.

indeed a big one. THE big one.

Usually I do watch out for 'https' in CGIs which requires the webserver to know. Need it e.g. to build absolute URLs https://codeberg.org/mro/geohash/src/branch/master/lib/cgi.m...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: