Hacker News Reader

Comment by greggman | Hacker News Reader

Can we please not restrict APIs to https only ? My game system requires http because it serves pages from your home computer/console to your phone's browser on the local network

http://docs.happyfuntimes.net

Either that or please suggest a viable workaround

View on HN

I think the "new APIs only on https" plan has exceptions for lan-local addresses or at least for localhost.

What if my home computer has a public IP address (which it does, since I use IPv6 only)? It's not always so simple.

There's also the option of my phone connecting to my home pc while it uses 4G (while the PC uses the land connection).

then just white-list those addresses?

that doesn't help. The phones don't connect to localhost they connect to a PC

user overrides are also an option: http://www.w3.org/TR/powerful-features/#development-environm...

That's not really a solution either. You really expect your house guests or people visiting a museum or event to do a technical reconfiguring of their phone just to interact with the installation or game?

I would think that museum should be able to get a SSL cert.

But yeah, "SSL-only" kinda breaks the end-to-end principle since we have no mechanism to assign SSL certs to endpoints on demand. So it seems flawed on a conceptual level.

Most of these types of exhibits are created by art students and shown at events and happen to be run by museums. Neither the students nor anyone at the museum have any tech experience whatsoever. As the system is now it works for them. But when HTTPS is required they'll all be S.O.L.

I think it's feasible to have a domain with certificate for resolving any ip, using dnsmasq as DNS resolver for that domain, combining this

https://pfigue.github.io/blog/2013/12/06/configuring-dnsmasq... (but without --server)

and this

https://stackoverflow.com/questions/28204678/dns-service-to-... (specifically, the "synth-domain" parameter, maybe limiting it to LAN ip addresses)

I haven't tried it.

I'm not really sure how that would help. Wouldn't all the phones be getting their DNS from the local router? How would that work without having each users have to configure DNS on their phones? Also how does running DNS server help? I don't expect people to know how to configure their router to point to some DNS server running on their local PC. Maybe I'm mis-understanding the suggested solution

The application redirects to <local https host>, and to make the certificate valid, have a wildcard *.example.com. With the DNS server you can have e.g. https://192-168-0-7.example.com/ resolve to 192.168.0.7.

All of this, of course, only if there are some desired HTTPS-only features in the browser.

Couldn't you host over HTTPS locally with a self-signed certificate? I've done it with my own, similar, locally hosted stuff.

It's a pain, and I've yet to find any good guides. I'm actually in a fix right now because I want to develop over localhost, but need this Flask site to work on HTTPS. I'm sure it's possible, but I have yet to find any guides or examples that make it straightforward. I love that we're moving towards security, but I wish it was easier...

That would require users to install his cert as trusted, though.

Ah, right, and I forgot how much the mobile browsers' UIs suck for this. On desktop it's just "yeah, I know what I'm doing <click>". On mobile they invoke threats and hide everything under barely visible links.

It also requires people to buy a domain before they can host a website. This is already a bad idea, and it makes even less sense as IPv6 deployment picks up and more people use clever IPv6 addresses instead of hostnames.

Reply on news.ycombinator.com