Hacker News Reader

Comment by Tehnix | Hacker News Reader

Sorry, but this argument is just so damn stupid. It's on the level of, "we don't have passwords for accounts, because people could bruteforce them anyways"...

They are basically arguing that while SSL might cover 9/10 cases, because it doesn't cover that 1 case, they will leave the other 9 open.

View on HN

Perfect is the enemy of good. Perhaps with a bit of added rationalization to hide laziness.

IRCops have a long history of being change-averse and vitriolic. This just looks like more of the same.

I'm just so baffled, since it is almost literally just creating a certificate and you are done (I run a couple of IRC servers myself). Even a self-signed certificate is better than none at all.

You're talking about people who make heavily-entrenched ideologies about minor technical distinctions into an Olympic-level contest of stubbornness and scorn.

Get a certificate, and add some scary code to your stack (openssl requires a lot of attention), and seriously restrict the number of connections per second you can handle.

It's inconvenient to restart all your connections because you need to apply an openssl patch, it's when worse when all the tls handshakes increase the time to get everyone back online when you do.

it's an IRC network aimed at gamers where 98% of channels are public and free for anyone to join without any form of authentication ever.

so you'd be more accurate to say it covers 98/100 of cases, and we leave the other 2 open

the main obstacle these days is that a secure PKI deployment for a network ran by 40 different companies with no legal structure is a hard problem, not the technical challenge of putting a cert in your ircd.conf

While they are free to join the channels, I'd imagine a great deal of the users authenticate to the nickserver to avoid impersonation and to protect their nick. Without SSL, anybody on their network could potentially sniff their credentials with a lot less trouble than MITM'ing a SSL connection.

So I'd say that it's just not for the 2% that are using the secure channels, but probably for the majority of the userbase that is active for more than a couple of sessions.

QuakeNet has supported challenge response auth for more than 10 years, so this isn't a problem for anyone using that.

This a common cognitive flaw in nerds. There isn't a continuum, but a proof like step function.

(redundant)

The comment isn't dead (or at least, not anymore; can comments get resurrected from dead status)?

It would appear so. It was dead earlier, but I imagine some mod or something revived him :)

Yeah. They're saying "bad stuff will still happen if we have SSL, so let's not do SSL". Hell of an argument.

Reply on news.ycombinator.com