I found the layout confusing but stuff like this is desperately needed. Encryption is a difficult subject but so important to how the Internet functions; the better people understand the concepts the better decisions they will make.
I tried to explain explain how the web browser retrieves a web page (including HTTPS) in simple terms once; the resulting text quickly got away from me[0] so I respect the creators of this for trying.
I may very well be an old curmudgeon but am I the only one who doesn't like all this comic-y cutesy content? They seem to be a rebranded version of the old `Idiot's guide to X` which were ubiquitous in the '90s. Yes, I'm also talking about stuff like `Clojure for the brave and true` or `Learn you a X for the greater good`. Does anyone actually benefit from this content? I look at it and it seems to be targeted to 10 year olds. Are we as an industry getting dumber?
For this specific subject, instead of reading about the `adventures of Certificat, Browserbird, and Compugter` can we just read something like https://hpbn.co/transport-layer-security-tls/ ?
> I may very well be an old curmudgeon but am I the only one who doesn't like all this comic-y cutesy content? They seem to be a rebranded version of the old `Idiot's guide to X` which were ubiquitous in the '90s.
The For Dummies series - corny jokes, mediocre cartoons, and all - are what taught me computing as a kid growing up in the '90s. So I support content like this because, empirically, it works.
Yep, we have that option and lots of explanations like that already exist.
This is a different approach to explaining the subject. I don't see how that's a problem. Personally I think they just went overboard with it (to the point of being distracting), but I get what they're trying to do and appreciate the effort - even if it's not for me. Kudos I say. Others might find it useful. Plus it could inspire someone else to explore another approach.
You are definitely an old curmudgeon, and I assume you are proud of that. Ironic thing about your link is that it's using Cloudflare
...So in an up-to-date browser it comes over TLS 1.3 (Cloudflare enables this by default, technically they're talking Draft 28, but this differs from the final RFC only in that drafts deliberately switch off TLS 1.3 downgrade protection since otherwise each draft would be mutually incompatible with every other system)
...So the description of how this works ends up being wrong for the site it's describing because it assumes TLS 1.{0,1,2} semantics but
...Despite the micro version change, TLS 1.3 is a significantly different protocol, both in how it begins and in details like resumption (now handled with PSKs) that this post describes for older SSL/TLS. It looks enough like TLS 1.2 that dumb middleboxes let it past.
One seldom acknowledged reason to write this sort of explanation (as a cartoon, as blog post, as a slide deck, whatever) is that the process of explaining something to other people clarifies our own understanding. When you're rehearsing "And of course the hats are invisible to bears, because..." you pause for a second -- wait, why _are_ these hats invisible to bears? Now that you come to say it, that's incredible and you realise you don't know. You go away and read the source materials - aha! Now you know why the hats are invisible and so although the purported purpose was to teach others, what you've actually done is learn for yourself.
Dunno about the industry getting dumber, but they certainly are getting lazier when it comes to UX. I could barely read it for 10s before my eyes started hurting.
I share a similar sentiment. Articles with an abundance of memes/gifs -- ones trying to be funny/cute, not contributing to the subject matter -- are placed in the same category.
At best it adds clutter, but usually lends to distraction and/or frustration and moving on.
I feel the same way. Another thing I've noticed along the same lines is companies and technologies named after words in "toddler speak" by adding -y or -ly to the end of a word (e.g. dog -> doggy). I initially chalked this up to the .ly TLD but that doesn't seem to be widely used nowadays. Maybe it started out that way and took on a life of its own?
Different people learn in different ways. I usually prefer a well written, funny text to a dry one. If I am forced to use a completely dry reference to learn a new topic, I often make up humorous mnemonics and explanations as I go, to help things stick.
So, yes, I (and I assume many others) benefit from the content. Of course that is not to say it is for everyone. Personally I don’t care much for learning from videos but know many people who much prefer them to text.
I doubt there is a single, universal style of learning medium that is optimal for most (let alone all) learners.
Part of the situation might be because of outsiders who try and learn these things on their own time. You might have a molecular biologist who finds themselves needing to setup up a webapp for some research and they were never formally educated as an "engineer".
Grown-ups also sometimes like to pass on what they know to children, teens and grandparent, so they might resort to cutesy stuff.
Then there are dummies like me who need lots of illustrations and everything explained from 10 different points of views before they start to understand. But, most of us hate getting in the way of the masters and experts.
We should have a "kids" version of HN and of various reddits. Everyone will be anonymous because your 50-yr-old co-worker doesn't want to be known around the office for reading comics that include cartoon superheroes showing you how to battle the evils of CSRF/SSRF.
(Thanks for linking to that page that explains TLS. That also helps.)
I think it has to do with who is reading. Some people learn better this way (myself included). I've seen many topics over the years explained in forms similar to this and it was very easy to understand opposed to just reading it out of a textbook. Although I'll admit that even this was done way too cutesy. They put far too many pictures with too small of text on each page, made it hard to follow along and keep focused. I need to be able to read fluently, small white text on a black background is hard on the eyes. You can find little snippets like this in many textbooks, but it's generally a single picture or two that are shown to better show the point made in the preceding text.
No and apparently "we as an industry" also struggle to get less condescending.
Maybe "we as an industry" don't have to learn the intricate details of such technologies in this cheerful manner. But is every potential consumer of this site really a CS-degree holding, experienced developer coming from the trenches?
You know, some 13-year old might stumble upon this and find it quite a bit more engaging than the (very good) link you have shared.
Not all content is for all people at all times. Thankfully, the internet is still free enough for all of us to close pages if they don't provide useful content.
I think your link is ideal for computer professionals, but I think `the adventures of Certificat, Browserbird, and Compugter` will probably be better for people with little to no actual technical knowledge.
I remember learning a lot from 1980s computer books with jokes and cartoons when I was older than 10, for example http://wiki.c2.com/?ThinkingForth , or the Fortran colouring book.
I'm not sure I'd've got on with ones where all the text is in cartoons, though. Too hard to scan, perhaps.
It was best when the cartoons were doing double service as diagrams showing what was going on inside the computer.
If you need more details there are certainly better sources. But imho there is usually a huge lack of trustworthy high level overviews. Newbies make mistakes and seasoned teachers may have a hidden agenda.
no man or woman on the street with a job not in the information economy would care to digest even your excellent linked doc.
TFA target audience is not even someone that understands that the Internet and the Web are different things.
It's a wonderful doc, wonderfully presented. With every mom and pop retail business needing a website these days, this is a really great explanation for them, so they can start to understand why they want https.
Geez, man. Really, "Learn You" and "Brave and True"? Those books are 95% pure instruction, and you have a problem with them because they include a small captioned cartooned image every 10 pages? The tutorial in this post is on a completely different level, but if you have a problem with those other books injecting even the slightest bit of humor into an otherwise very dry material (however interesting it may be, it is dry), then I really feel angry at whoever hurt you.
Technology isn't only for the wealthy elite who have the time to sit and read hundreds of pages of jargon anymore. The internet is for everyone, not just us nerds.
Because it barely spends any time setting that up, for one thing. It would probably be a bit more memorable if the characters actually said things like “Hi! I’m Compugter! I sit on your desk or in your lap and talk to the Internet for you!”; instead there is just a panel with a tiny label floating off to one side.
Or maybe it should be “Hi! I’m Compugter, I sit in a rack in a puppy farm somewhere, and talk to the browserbird in your hand or lap or desk”? It really doesn’t define its terms at all before launching into a description of a man-in-the-middle attack. This is just not well-written, and no amount of cute drawings will cover for that, no matter how well done they are.
I have this problem with most analogies used to explain things. Computer concepts are abstract enough without layering another abstraction on top. If you're trying to explain something complicated, you're just adding more cognitive overload. If you're trying to explain something simple, why not be direct? It's possible that I just run into nothing but bad analogies, but I don't see them as being helpful.
I had this issue even starting from the first panel after the introduction, where the dog was sending a message to the bird. I kept having to scroll to the top to double check who was who.
I skimmed over it and it seems to be a bit dated.
The handshake description is basically a static RSA key exchange. This is deprecated in TLS 1.3 and largely unused even in older TLS versions, because it's horrible. (I wrote a paper to show how horrible it is.)
Unfortunately I see this quite often that people are simply not up to date when it comes to crypto.
I'd be curious to read that paper, if you don't mind sharing a link - I recognize your name from the TLS mailing list, but I don't recall seeing that paper referenced there, and everything I google is in German...
I found this really hard to read. At first I tried to read left-to-right, top-to-bottom, but then it felt like the "panels" (or lack thereof) were not lining up. Then I thought "Oh! It must be three columns top-to-bottom" so I tried that then realized I was missing content and that I was right the first time.
I'd love to see you lay this out a bit differently. Apart from that, I love the content. Thanks.
Self signed certificates do not prove integrity. A crab in the middle can generate another self signed certificate for the same domain name and your browser will not know that it isn't the one you expected.
The only workaround is to manually add the certificate to the root store. But this depends on securely receiving the certificate - say by physically transferring it from one computer to another by USB stick.
A major problem with this is that non-expert users might interpret it to mean that the "green lock" always means everything is ok. That is dangerous advice since it's possible to publish a phishing site having proper SSL. Users need more context than what is offered here to avoid becoming victims of phishing scams.
I also found the content itself difficult to read in both layout and copy. The character names were confusing, and I don't think the three concepts of privacy, integrity, and identity were conveyed in a clear enough sense so that a non-expert could interpret how those are actually 3 different things.
I like the light-hearted direction taken to explain HTTPS, but I personally find the narrative difficult to read and follow.
It might be unfair for me to compare the two, but I do like Randall's approach to explaining Heartbleed https://xkcd.com/1354/ because it feels like it has a better flow.
I'd definitely like to see this idea get expanded upon and improved, so I can feel confident about forwarding this link to non-technical users who are interested in learning how the Internet works. I also agree with doing one of these on phishing.
[+] [-] AndrewStephens|7 years ago|reply
I tried to explain explain how the web browser retrieves a web page (including HTTPS) in simple terms once; the resulting text quickly got away from me[0] so I respect the creators of this for trying.
[0] https://sheep.horse/2017/10/how_you_are_reading_this_page.ht...
[+] [-] decebalus1|7 years ago|reply
For this specific subject, instead of reading about the `adventures of Certificat, Browserbird, and Compugter` can we just read something like https://hpbn.co/transport-layer-security-tls/ ?
[+] [-] geofft|7 years ago|reply
The For Dummies series - corny jokes, mediocre cartoons, and all - are what taught me computing as a kid growing up in the '90s. So I support content like this because, empirically, it works.
[+] [-] Reedx|7 years ago|reply
Yep, we have that option and lots of explanations like that already exist.
This is a different approach to explaining the subject. I don't see how that's a problem. Personally I think they just went overboard with it (to the point of being distracting), but I get what they're trying to do and appreciate the effort - even if it's not for me. Kudos I say. Others might find it useful. Plus it could inspire someone else to explore another approach.
[+] [-] tialaramex|7 years ago|reply
...So in an up-to-date browser it comes over TLS 1.3 (Cloudflare enables this by default, technically they're talking Draft 28, but this differs from the final RFC only in that drafts deliberately switch off TLS 1.3 downgrade protection since otherwise each draft would be mutually incompatible with every other system)
...So the description of how this works ends up being wrong for the site it's describing because it assumes TLS 1.{0,1,2} semantics but
...Despite the micro version change, TLS 1.3 is a significantly different protocol, both in how it begins and in details like resumption (now handled with PSKs) that this post describes for older SSL/TLS. It looks enough like TLS 1.2 that dumb middleboxes let it past.
One seldom acknowledged reason to write this sort of explanation (as a cartoon, as blog post, as a slide deck, whatever) is that the process of explaining something to other people clarifies our own understanding. When you're rehearsing "And of course the hats are invisible to bears, because..." you pause for a second -- wait, why _are_ these hats invisible to bears? Now that you come to say it, that's incredible and you realise you don't know. You go away and read the source materials - aha! Now you know why the hats are invisible and so although the purported purpose was to teach others, what you've actually done is learn for yourself.
[Edited s/hosted on/using/]
[+] [-] blowski|7 years ago|reply
[+] [-] 0x8BADF00D|7 years ago|reply
[+] [-] Nicksil|7 years ago|reply
At best it adds clutter, but usually lends to distraction and/or frustration and moving on.
[+] [-] dooglius|7 years ago|reply
[+] [-] jaredklewis|7 years ago|reply
So, yes, I (and I assume many others) benefit from the content. Of course that is not to say it is for everyone. Personally I don’t care much for learning from videos but know many people who much prefer them to text.
I doubt there is a single, universal style of learning medium that is optimal for most (let alone all) learners.
[+] [-] coin|7 years ago|reply
[+] [-] jypepin|7 years ago|reply
[+] [-] da02|7 years ago|reply
Grown-ups also sometimes like to pass on what they know to children, teens and grandparent, so they might resort to cutesy stuff.
Then there are dummies like me who need lots of illustrations and everything explained from 10 different points of views before they start to understand. But, most of us hate getting in the way of the masters and experts.
We should have a "kids" version of HN and of various reddits. Everyone will be anonymous because your 50-yr-old co-worker doesn't want to be known around the office for reading comics that include cartoon superheroes showing you how to battle the evils of CSRF/SSRF.
(Thanks for linking to that page that explains TLS. That also helps.)
Any opinion of the "Head First" books? https://ssearch.oreilly.com/?q=head+first They seem better than the 90s "...For Dummies" books.
[+] [-] Rotdhizon|7 years ago|reply
[+] [-] neuronic|7 years ago|reply
No and apparently "we as an industry" also struggle to get less condescending.
Maybe "we as an industry" don't have to learn the intricate details of such technologies in this cheerful manner. But is every potential consumer of this site really a CS-degree holding, experienced developer coming from the trenches?
You know, some 13-year old might stumble upon this and find it quite a bit more engaging than the (very good) link you have shared.
Not all content is for all people at all times. Thankfully, the internet is still free enough for all of us to close pages if they don't provide useful content.
[+] [-] Vendan|7 years ago|reply
[+] [-] mjw1007|7 years ago|reply
I remember learning a lot from 1980s computer books with jokes and cartoons when I was older than 10, for example http://wiki.c2.com/?ThinkingForth , or the Fortran colouring book.
I'm not sure I'd've got on with ones where all the text is in cartoons, though. Too hard to scan, perhaps.
It was best when the cartoons were doing double service as diagrams showing what was going on inside the computer.
[+] [-] LolNoGenerics|7 years ago|reply
[+] [-] jiveturkey|7 years ago|reply
no man or woman on the street with a job not in the information economy would care to digest even your excellent linked doc.
TFA target audience is not even someone that understands that the Internet and the Web are different things.
It's a wonderful doc, wonderfully presented. With every mom and pop retail business needing a website these days, this is a really great explanation for them, so they can start to understand why they want https.
[+] [-] nothrabannosir|7 years ago|reply
Without beej's guide to networking I wouldn’t have understood TCP.
[+] [-] nmca|7 years ago|reply
So some people do benefit from it a great deal, it seems.
[+] [-] vaer-k|7 years ago|reply
[+] [-] some_account|7 years ago|reply
[+] [-] hannasanarion|7 years ago|reply
Technology isn't only for the wealthy elite who have the time to sit and read hundreds of pages of jargon anymore. The internet is for everyone, not just us nerds.
[+] [-] comboy|7 years ago|reply
[+] [-] rockdiesel|7 years ago|reply
Content marketing and SEO purposes for the parent company, dnsimple.
[+] [-] brink|7 years ago|reply
[+] [-] egypturnash|7 years ago|reply
Or maybe it should be “Hi! I’m Compugter, I sit in a rack in a puppy farm somewhere, and talk to the browserbird in your hand or lap or desk”? It really doesn’t define its terms at all before launching into a description of a man-in-the-middle attack. This is just not well-written, and no amount of cute drawings will cover for that, no matter how well done they are.
[+] [-] caymanjim|7 years ago|reply
[+] [-] sjroot|7 years ago|reply
[+] [-] hannob|7 years ago|reply
Unfortunately I see this quite often that people are simply not up to date when it comes to crypto.
[+] [-] commandlinefan|7 years ago|reply
I'd be curious to read that paper, if you don't mind sharing a link - I recognize your name from the TLS mailing list, but I don't recall seeing that paper referenced there, and everything I google is in German...
[+] [-] ecesena|7 years ago|reply
As a technical person I don’t particularly love privacy = confidentiality, but I understand the desire to simplify.
If you’re looking for something next, I vote for phishing. We tried to make a short explanatory video, but it’s not even remotely cool as this one! https://twitter.com/_conorpp/status/1036751355346595840
[+] [-] bradenb|7 years ago|reply
I'd love to see you lay this out a bit differently. Apart from that, I love the content. Thanks.
[+] [-] lozenge|7 years ago|reply
The only workaround is to manually add the certificate to the root store. But this depends on securely receiving the certificate - say by physically transferring it from one computer to another by USB stick.
[+] [-] blr246|7 years ago|reply
I also found the content itself difficult to read in both layout and copy. The character names were confusing, and I don't think the three concepts of privacy, integrity, and identity were conveyed in a clear enough sense so that a non-expert could interpret how those are actually 3 different things.
[+] [-] arayh|7 years ago|reply
It might be unfair for me to compare the two, but I do like Randall's approach to explaining Heartbleed https://xkcd.com/1354/ because it feels like it has a better flow.
I'd definitely like to see this idea get expanded upon and improved, so I can feel confident about forwarding this link to non-technical users who are interested in learning how the Internet works. I also agree with doing one of these on phishing.
[+] [-] unknown|7 years ago|reply
[deleted]
[+] [-] king007|7 years ago|reply
[deleted]
[+] [-] unknown|7 years ago|reply
[deleted]
[+] [-] king007|7 years ago|reply
[deleted]