Encryption Works: How to Protect Your Privacy (And Your Sources) in the Age of NSA Surveillance
The stories of how NSA whistleblower Edward Snowden first contacted journalists Glenn Greenwald and Laura Poitras (both Freedom of the Press Foundation board members), and how he communicated with the Washington Post's Barton Gellman, have given the public a rare window into digital security and conversing online in the age …
How To Build an Absurdly Backwards Compatible Website | flower.codes
Let's face it: the internet is broken. It feels like so much of the web is composed of clickbait, ads, popups, and a toxic amount of JavaScript that you need a modern computer just to get any value out of it. Remember when low-power computers were created for people who were "just browsing the internet?" Half of the sites on the internet are so overloaded with tracking scripts, ads, third-party "analytics" platforms, and other junk that they simply crash in the face of sub-par hardware; and don't even get me started on what they do to "retro" computers. If the modern web hasn't been created with aging hardware in mind, what does that mean for the proliferation of e-waste? Is it really so necessary to update your computer every 2-5 years? And, what if you didn't? What if you couldn't afford to? My daily driver is a mid-2012 MacBook Pro that will stop receiving all updates (security included) from Apple by the end of this year. While I personally intend to keep it alive with Linux, this isn't a path that is readily available to most people. What are most people supposed to do in this situation to save some money and avoid adding more junk to our landfills? These are the questions I have been asking myself over the last year or so, and while I haven't come up with many great answers for the general populace, I did make the decision to ensure that this website is as backwards compatible as possible. The Basics When I say "as backwards compatible as possible," I mean that this website will be usable on as many browsers, connections, and hardware as I can reasonably support. But, how exactly am I accomplishing this? While there are no hard and fast rules for keeping a website accessible to everyone, there are a few basic guidelines and workarounds that I've come to rely on. Missing Host Headers Did you know that the HTTP/1.0 specification didn't require a Host header? Up until recently, I didn't. You see, in HTTP/1.1, the Host request header tells a web server exactly which site it is requesting, giving the Web Master—coolest title ever—the ability to configure multiple "virtual hosts" on a single server. In other words, example.com and example.net can be hosted on the same server, while serving up different content. As far as sustainability goes, this is a pretty decent solution, as it allows you to utilize the infrastructure you already have to host multiple websites. But, you know what doesn't send a Host header? Internet Explorer versions 1 and 2. Probably more, too, but they are the only two I've come across so far that have forsaken me; which means that, without a workaround, my website is completely inaccessible to all of those IE1 and IE2 users out there. That's literally ones of people that don't have access to sweet, sweet content like this. Thanks for that one, Microsoft. So, how do we bring those no-Host rebels into the fold? A second IP. Thankfully, DigitalOcean offers a handful of free floating IPs that you can assign to a single droplet, which means that flower.codes has it's own dedicated IP address in order to appease those picky, early 90's Windows computers. With a little bit of overhead, you can simply set your server to listen on the float IP, so any request to that particular IP will fall back to your website. I use the Caddy webserver, so to accomplish an HTTP fallback that will be returned on every request (unless a valid host entry can be matched), simply use http:// as the site address: http:// { root * /www/example.com file_server } No Automatic HTTPS To be absolutely clear here, I am not advocating for not supporting HTTPS. It's 2022. That would be absurd. But, what I am advocating for is not automatically redirecting to HTTPS. Get your certs, encrypt that traffic, do all the things you normally do... just don't force an HTTP => HTTPS redirect on your users. Don't get me wrong, HTTPS is critical for modern website security, but all modern browsers automatically redirect to HTTPS whether you enforce it or not. What this means is that retro browsers can still load your website in good-ole HTTP, while newer browsers will handle the more secure redirection to HTTPS for you. If you're using the Caddy webserver, this is as simple as creating two separate server entries, one with an http:// prefix, and one with an https:// prefix: http://example.com { root * /www/example.com file_server } https://example.com { root * /www/example.com file_server } Raw HTML is Your Friend Remember the tag? And based layouts? What about ? I do. Because the foundation of my website is built using those pre-Y2k web development standards. As much as modern browsers like to say that they have deprecated some of the aforementioned tags (among other things, like setting a default bgcolor in your BODY tag), they still support the usage because there are enough websites that haven't (and likely never will) upgraded to the homogeneous post Web 2.0 hellscape. One of the advantages to using these old-school web design methods is that you can still use modern CSS to make things look better on newer devices. Instead of going crazy with flexbox and floats, do a basic layout using tables and then adjust the look with CSS. This gives you the advantage of having a modern-looking website design (if that's your thing), while also gracefully degrading on older browsers that don't support it. Use CSS Sparingly I think it is safe to say that modern CSS simply won't work with old browsers. I shouldn't have to go into why that is, but what if you want to have some CSS, just to make things look a tad more pretty for browsers that were released in the last decade? In general, most browsers (even most legacy ones) will gracefully ignore CSS that they don't understand, which means that @media tags for things like basic responsiveness and dark mode are usable without any issue. That said, browsers that predate CSS do not know what to do with tags, and as a result simply print the styles out at the top of the page. It's pretty ugly and, depending on how much CSS you have, borderline unusable. To work around this problem, you can put standard HTML comments within the tags, which will get ignored by CSS-supported browsers, while getting interpreted by pre-CSS browsers: Gettin' GIFfy Wit It Fun fact: the earliest browsers only supported color images of the GIF variety. I won't get into the technical details here, but you can blame CompuServe for its creation. This means that, if you want your images to load in any browser, they need to be in GIF format. Neat, right? Also, not for nothing, but GIF is absolutely pronounced with a soft "G" sound. Scream at me all you want, but it's what the inventors of the format intended1, and I'm a sucker for historical accuracy: The creators of the format pronounced the acronym GIF as /dʒɪf/, with a soft g as in 'gin'. Wilhite stated that the intended pronunciation deliberately echoes the American peanut butter brand Jif, and CompuServe employees would often quip "choosy developers choose GIF", a spoof of Jif's television commercials. Unnecessary Improvements Forgotten Link Tags There are a number of tags that older browsers support that can be pretty fun to add. For example, the home tag indicates what the homepage for the current website. In some browsers (such as NCSA Mosaic), this results in a cute little "home" icon at the top of the page that, when clicked, sends you to the designed home URL. Another useful tag to add is the author tag (refv=made and rel='me authn'). This provides information about the author of the page, usually in the form of a mailto: address. In some browsers—such as Lynx—this tag makes it easy for the user to contact the page author without having to look anything up (or jump to a "contact" page).
Ads, overlays and paywalls, oh my! How to get around the web’s worst annoyances (updated x3)
Over the years, I’m assembled a toolkit of browser extensions and strategies that have made the web tolerable, allowing me to block overly intrusive ads, bust through overlays and scale paywalls.
Bringing people back to the open web - Chris Hardie
The average Internet user isn't aware of (or doesn't care) about the principles of an "open web" in those terms. It's up to developers, designers, entrepreneurs and technology leaders to create a version of the open web that also happens to be the best version of the web.