Well you could technically also use self signed certificates. But it requires a bit more work as well as installing your own custom CA cert.
Comment on Do I need https on everything
lambalicious@lemmy.sdf.org 2 days ago
HTTPS for everything means you have to buy into the cartel of “identity providers” that manage DNS and certificates, even if there are some mostly-good actors in there such as Let’s Encrypt, you still have the external dependency. As we have seen with cases such as Austistici, having that dependency can be a problem. It’s your call if it is in your case or not, but I wanted to raise this point because no one has pointed out that particular weakness vector so far in the thread.
In a very general sense, if your services are under a netbird or any sort of VPN where you control who gets account access or not, you “should not need” HTTPS. Might still be convenient to have.
kylian0087@lemmy.dbzer0.com 1 day ago
possiblylinux127@lemmy.zip 1 day ago
Self signed isn’t quite the same as a internal CA
kylian0087@lemmy.dbzer0.com 1 day ago
Yeah I oversimplified but doing the whole thing your self is possible.
lemmyvore@feddit.nl 1 day ago
There’s no cartel, you can buy a HTTPS cert from lots of places all over the world. Most domain registrars can set you up. It just won’t be free like Let’s Encrypt and also will have a very different renewal process (most likely once a year manually rather than every 90 days automatically).
stratself@lemdro.id 1 day ago
It’s a cartel in the sense that the CA/Browser forum determines, on their own whim, which CA gets featured or revoked in your browser. And single-handedly impose technical restrictions like shorter cert lifetimes and less features. Stuff like eMudhra being able to compromise everyone shows its quite a vulnerable group of single-point failures as well, but still condoned by almost everyone.
ZeroSSL and Komodo does have free certs if I remember correctly. They’re still bound by the 90 days (soon to be 47) limit though
dil@lemmy.zip 1 day ago
I use tailscale serve for my selfhosted stuff.
lambalicious@lemmy.sdf.org 1 day ago
Safari
Get a better browser? HTTP is as legit a transmission protocol as HTTPS and email are.
dil@lemmy.zip 1 day ago
All mobile browsers are safari wrappers on iphone
lambalicious@lemmy.sdf.org 1 day ago
Hmmm, I’d… say… “get a better phone”, but there’s not much of a better alternative there.
Get a desktop / laptop computer?
possiblylinux127@lemmy.zip 1 day ago
All you need is a DNS name. You can buy one for a few dollars.
Even if you refuse to buy a domain you could always run your own certificate chain
lambalicious@lemmy.sdf.org 1 day ago
That sounds interesting. But then you have to convince your peers to install your certificate root, right?
possiblylinux127@lemmy.zip 1 day ago
No, you would only use this internally. Overall doing this is a bad idea (if the root gets stolen encryption is useless) but is technically possible if you are looking for a learning exercise. It would be about the same amount of work as Let’s encrypt since you would probably still want to run ACME with fairly short certificate lifetimes.