<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
Nick,
<div><br>
</div>
<div>you can always <i>choose</i> to use nginx if you like, but there’s no reason anyone else should be forced to.<br>
<br>
<div dir="ltr"> -mel</div>
<div dir="ltr"><br>
<blockquote type="cite">On Jan 26, 2022, at 7:55 AM, Nick Suan via NANOG <nanog@nanog.org> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr">
<title></title>
<div>While I agree that, yes everything SHOULD support TLS, there's a perfectly good reason for terminating TLS in something like (nginx/caddy/apache/etc): X number of things supporting TLS on their web interface means X number of ways of configuring TLS.
If I terminate it on nginx, there's only a single way: the nginx config, which is then farily easily leveraged into having a single set allowed protocols and ciphers.
<br>
</div>
<div><br>
</div>
<div>On Wed, Jan 26, 2022, at 9:33 AM, Mel Beckman wrote:<br>
</div>
<blockquote type="cite" id="qt" style="">
<div>People who advocate TLS lash-ups like nginx front ends remind me of Mr. Beans DIY automobile security, which started with a screwed-on metal hasp and padlock, and then continued to a range of additional “layers”. Not “defense-in-depth”, merely unwarranted
“complexity-in-depth”: <br>
</div>
<div><br>
</div>
<div>
<div><a href="https://youtu.be/CCl_KxGLgOA">https://youtu.be/CCl_KxGLgOA</a><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>TLS is a standardized, fully open-source package that can be integrated into even tiny IoT devices (witness this $10 WiFi module<a href="https://www.adafruit.com/product/4201"> https://www.adafruit.com/product/4201</a>). The argument that people who want
intrinsically secure products can just bolt-on their own security are missing the point entirely. Every web-enabled product should be required to implement TLS and then let custiners decide when they want to enable it. Vendors who are so weak that they can’t
should have their products go straight into /dev/null. <br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">-mel via cell<br>
</div>
<div dir="ltr">
<div><br>
</div>
<blockquote type="cite">
<div>On Jan 26, 2022, at 6:51 AM, heasley <heas@shrubbery.net> wrote:<br>
</div>
<div><br>
</div>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr">
<div><span>Wed, Jan 26, 2022 at 07:21:19AM -0600, Mike Hammett:</span><br>
</div>
<div><br>
</div>
<blockquote type="cite"><span>Why is it [TLS] even necessary for such a function?
</span><br>
</blockquote>
<div><span></span><br>
</div>
<div><span>confidentiality and integrity, even if you do not care about authentication.</span><br>
</div>
<div><span>I am surprised that question is asked.</span><br>
</div>
<div><span></span><br>
</div>
<div><span>The fewer things that are left unprotected, the better for everyone. those</span><br>
</div>
<div><span>with concern about erosion of their privacy and human rights benefit from</span><br>
</div>
<div><span>everything being protected, everywhere for everyone.</span><br>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
<div><br>
</div>
</div>
</blockquote>
</div>
</body>
</html>