← Feed
@twl@pleroma.8777.ch
2026-04-14 03:42 UTC
@crunklord420@clubcyberia.co ok I actually watched the video and it's even more performative than I thought, he brings up good points about root CAs being handed out like they're nothing and how unsecure ACME is, and says the one time he installed https "software" it didn't work and he gave up. He then rolls his own https server with bogus rsa keys to trick acme into giving him a cert that can be hacked for less than $100 in compute, as well as not caring about session management which makes it trivial to steal other people's sessions because, he's... lazy? I found his "httpv" (v for vulnerable) project very funny but if it wasn't made under the guise that this was to stick it to google who puts up scary messages on his unencrypted site that he's too lazy to change, and calls things like updating server software as "shaming tactics by max security purists", I wouldn't have thought of it as stupid and pretentious. Also he compares the forceful authentication requirements of modern websites to ICE agents and immigration offices which is so funny and topical. I liked and subscribed.
Replies (3)
-
@twl@pleroma.8777.ch @crunklord420@clubcyberia.co I agree
Open ##2538487
-
@twl@pleroma.8777.ch I didn't even watch the video, didn't even click. This is only the 10th time I've seen someone blog this exact thing. It's like a 15 year old meme at this point and it's always been retarded. It's even more retarded than ever. "yeah bro thanks for opening up a mitm attack opportunity, very cool".
Open ##2538488
-
@twl@pleroma.8777.ch @crunklord420@clubcyberia.co There's exactly one reason to not force encryption on your site and that's old browsers. Which is only valid if your site is actually usable on those browsers, which most of modern sites aren't. Still refusing to implement it altogether has no reasons besides being quirky and purposefully different like everybody else.
Open ##2538489