JAKE ARCHIBALD: This is one of the things that's
changed on the web since the start days
for me is you now need to set up a server to do anything.
It used to be that you could just run the stuff on your file
system.
That doesn't work anymore because the cross-origin rules
have been, quite rightly, really tightened up in browsers.
Like if you're on the file system,
you can't really contact anything else.
It's all treated as a separate origin, which
it should be, right, because you don't want a web
page on your machine being able to go into your passwords
folder or whatever.
But that's it.
If you get started with web, all you
need is an HTTP server running on local host and off you go.
PAUL LEWIS: No.
No.
Again, no.
Always no with you.
Right.
Fine.
It works on your machine, and then you
upload it to your server and it goes, ha ha, no,
because it's no longer HTTPS.
I've white listed local hosts so you're good to go,
but now, it should be Service Worker, push notifications,
all those lovely new things you wanted, uh-uh.
JAKE ARCHIBALD: Paul hates security on the web.
PAUL LEWIS: Again, HTTPS is just too difficult
and there's so many features being gated on HTTPS right
now that it's a bit depressing.
You know, why?
Tell me the answer.
JAKE ARCHIBALD: HTTPS is super important.
I think if there are two sources of information that
are otherwise completely equal and completely identical,
except on one of them, you can trust
that you'll receive it unmodified,
course that's better.
PAUL LEWIS: I'm OK with it from the user perspective.
It's a good thing to ship for users.
But-- but-- it's not--
JAKE ARCHIBALD: Button.
PAUL LEWIS: Button.
JAKE ARCHIBALD: He's going to press the serious button now.
This is your disapproval button.
PAUL LEWIS: This is the-- aargh-- the rage button.
Because the hosting that you get is not
going to give you that by default. It's too hard, right?
If you go into DevOps and you run your own server,
you're by proxy saying, this is something
I am willing to take on as my responsibility, right?
JAKE ARCHIBALD: Yeah.
PAUL LEWIS: OK?
But if you don't, and the standard issue
developer that I am, I don't want to get into DevOps.
I don't want to do that.
I think the default option from my host should be HTTPS.
It shouldn't even be a thing that I
have to opt into when they go, you get PHP 4, 5,
MySQL, as many [INAUDIBLE] as you
want, oh, and you get SSL just by default because you're
a human being who wanted to get hosting from us.
JAKE ARCHIBALD: I think the big companies
such as Google, they need to find a way to,
rather than punishing the developer,
they punish the hosts.
Because there's a lot of hosts still using HTTPS
as a money spinner, whereas with things like SNI,
it can be super cheap.
OK, with SNI, you lose Android 2.
Android 2 doesn't support it.
And you also lose Internet Explorer on XP, I think.
But those things are going away.
It should just be free, as you say, with every host.
PAUL LEWIS: HTTP at this point, for me,
should be more like a bug.
It should be considered-- aah.
That's--
JAKE ARCHIBALD: Now, there's been some discussion
around that and there's been some people suggesting
that all new web features should only
land on HTTPS, whether it's security sensitive or not.
I disagree with that quite strongly.
PAUL LEWIS: I think if 95% of the web was HTTPS, fair enough,
but it's not.
I think we've got to get more people as the default
before you start switching things off properly.
I can see the new features, the ones that are security
sensitive particularly.
JAKE ARCHIBALD: I think it's fine for security
sensitive stuff.
Service Worker is HTTPS only for a good reason.
We tried to find a way to make it work with HTTP.
There wasn't a way.
But for features that don't need it,
like we're getting a new media API.
So the Play, Pause keys on your lock screen and stuff,
we're going to bring those to the web.
That doesn't need HTTPS.
PAUL LEWIS: No.
I mean, it would be ludicrous if somebody said,
WebGL or IndexDB, they require HTTPS
because they're on the web.
It doesn't make sense.
JAKE ARCHIBALD: It does sort of feel
like the standards people wagging their fingers
at developers going, eat your greens
or you're not allowed the pudding, where
the greens are HTTPS and the pudding is new web features.
I don't think it's a constructive way
to build up the web.
[MUSIC PLAYING]