20.xx: postponse LuCI HTTPS per default

[Alberto Bursi]

On 20/11/20 18:35, Adrian Schmutzler wrote:
> Hi,
> 
>> -----Original Message-----
>> From: openwrt-devel [mailto:openwrt-devel-bounces at lists.openwrt.org]
>> On Behalf Of Alberto Bursi
>> Sent: Freitag, 20. November 2020 17:32
>> To: openwrt-devel at lists.openwrt.org
>> Subject: Re: 20.xx: postponse LuCI HTTPS per default
>>
>>
>>
>> On 20/11/20 17:17, Fernando Frediani wrote:
>>> Hi Alberto
>>>
>>> On 20/11/2020 13:09, Alberto Bursi wrote:
>>>>
>>>> <clip>
>>>>
>>>> The only thing I can accept as a valid complaint against https by
>>>> default is the increased minimum space requirements, everything else
>>>> I really don't understand nor agree with.
>>>
>>> It's exactly this I am referring to when I talk about the extras not
>>> the steps the user will take to enable it. So why I mentioned to leave
>>> it as optional and easy to do for those who wish (and have space) to have
>> it.
>>>
>>
>> Devices with low flash space (and RAM) are already receiving special
>> treatment (different compile options, different default packages) to lower
>> space footprint.
>>
>> These devices can (should?) be left out of the "https by default" easily.
> 
> No, this is not an option. We certainly won't have (read "maintain") _two_ defaults for a matter like this.
> 


I'm not sure you can actually not "maintaining two defaults" regardless 
of what is decided.

 From what I understand, https support is an addon to the base http web 
interface infrastructure and not a fully different thing.

So I think that if you switch to https by default you still need to 
maintain the "non-https" part of the web interface infrastructure anyway.


> Apart from that, this discussion was not intended to discuss the various options _again_, but to ask whether we should have "https by default" as a _blocker_ for the next release.
> Personally, since the discussion seems to be as open and unresolved as a few months ago, I'm against making this a blocker.

Yeah I wouldn't treat it as a blocker, it's getting late for a release 
already and nobody in the main developer list seems to care about 
setting a default either way.

-Alberto