Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I'm not a big fan of https, but how is this related to it? Websites that are http-only will be affected as well.

Edit: if you're talking about obtaining certs for bare IPs, it's actually possible to do that. See 1.1.1.1



Before you could use ips, or alternative name system, or just private/personal DNS.

This will not work anymore as the https will require to have an official/qualified domain name.

Look at the case of the .dev domain names that were used by a lot of persons, and suddenly google bought the top domain and enforced https mandatory for it in chrome to ensure that no one else could use it anymore.

Also, imagine if the next step is to check that only "approved/legitimate" top domains, respecting some Google policies, are allowed for your own safety...


OP said, "let's force everyone to use https."

My guess is that OP's point was that "everyone" includes servers as well as browsers, presumably by shaming via no lock icon and other tactics.


I know, but I still don't understand how this is related to the news at hand. You'll have to publish your info regardless of which protocols you're using (if any).


you can connect using bare IPs with http.


You can with https as well.

For most of us that means an untrusted cert, and hence a browser warning, but that's equivalent to the browser padlock icon when browsing http (and arguably safer).

Plus, if you are browsing or publishing using plain ip addresses you are already outside the "regular behaviour" so users doing that will be happy to click through.

However this subthread is irrelevant to the main thread. The https/http question is unrelated to the dns question, since dns applies to both equally.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: