Sir Tim Berners-Lee defends decision not to bake security into www

Re: HTTP or HTML?

Mage: "email" <> SMTP/POP/IMAP

The point of the article is that sometimes a protocol becomes adopted because of its apparent simplicity and ease in use and implementation. And after setting up a couple of X400 gateways in the 90's I could see why (while not completely agreeing with it). And many secure mailers still use X400 based exchange.

Same story some might tell about IP vs IPX or even Microsoft vs OS2. While you can wish the world would wait and think before it acts on implementations, that doesn't mean the world will listen to that advice. The world doesn't revolve around finding "sound solutions" but more often about "who is first".

Re: HTTP or HTML? @Mage

The whole concept of wide area networking security was a moot point when it came to early email systems. UUCP was the best that there was (UUCP is the UNIX to UNIX Copy Program, not just a mail system, although one of the most common uses was mail, and another was remote printing).

Everybody knew it was not secure, because it was a store-and-forward scheme, such that any of the intermediate systems had access to the content. That was just the way it worked, and everybody knew and accepted it.

If you look at basic UUCP, it ran over serial communication lines, often over analogue telephone lines using modem. The concept of it being secure was never even thought about. It was easy to tap a telephone line and feed the data captured through a modem, so it was obvious that there was no security. If you wanted to send something securely, you encrypted it and the uuencoded the result.

There was an encrypted UUCP system which used the UNIX crypt technology. I cannot remember the exact details or what it was called, but it was in the AT&T BNU, but it effectively meant that the data was not transmitted in the clear. But it was still vulnerable on the intermediate host systems.

Saying that it should have been secure is like saying early cars should have been built with roofs, windows and locks. But they weren't.

Anyway. The TELEX system was about as insecure as you can imagine, so that is not a particularly good example.

BTW. To all of the people saying that X.400 should have been the default mail system should remember that SMTP was defined in RFC 821 several years before the initial recommendations for X.400, and they expected to be running over X.25 transport systems, so were a bit weak on the security side as well.

Re: HTTP or HTML?

Thanks for reminding me about Robert Cailliau. in fact - as I didn't work in DD but in the PS - I don't ever recall meeting Robert, though I'm sure I will have done at some point. I think everyone in DD (Data-handling Department?) helped in some way to the creation of the WWW - the amount of group-chatter on vxcrna for example was crucial to Tim working on RPC's.

CERN was fairly amazing in that around 7K scientifically-minded people were wandering around the main sites, I had coffee (double ristretto) with, and worked with, eminences such as Abdus Salaam, Victor Weisskopf [Manhattan Project theoretical leader], Russian dissidents - who always wanted a cold beam of pbars at 3am and just generally special ppl.

I'd be sitting at an IBM/VM/CMS terminal typing away some Fortran code for radio frequency simulations, then a quiet tap on the shoulder from a really nice guy "er, do you mind if I use this terminal" - (I was 'playing' whilst Simon van der Meer (Physics Nobel 1984) was patiently waiting to use our only terminal)

I recommend all youth reading El'Reg to do as much STEM studies as they can, then read http://cerncourier.com/cws/latest/cern and write them a letter asking for a job, I did & haven't looked back!

Re: RE: Charles 9 Both correct

Or if he had baked in security:

1, he would have got it wrong - even experts get it wrong so the chance of a regular programmer inventing ssl and implementing it correctly is zero. So we would have had a built-in faulty standard.

2, It would have been too difficult for anyone else to use/implement so we would have no browsers/servers outside CERN.

3, Without an infrastructure of certifcate providers the only response would be to use something like existing "x." protocol family security. Which would have involved governments. So anyone copuld have had a website if the postoffice approved your licence request.

4, It would have hit export issues. No web browser/server software could have been copied from the USA. There would have to have been government level negotiations for a "munition" to be transferred from CERN to other institutions.