Soweli Lukin


Why gopher needs crypto

A little while back I wrote some speculative stuff 1 about a hypothetical protocol which was more than gopher but less than the web (it really wasn't about gopher itself, and because of that this post is actually perhaps poorly titled, but oh well). There have been some responses to this, both in gopherspace 2, 3 and on Mastodon, and I've done a poor job of engaging with the wider discussion that I triggered. This may continue, as my own thoughts and feelings on the matter continue to be in a state of flux. But there is one component of that hypothetical new protocol which I am certain of, and it's a component that some people have expressed confusion as to the need for, so I'm going to write a little bit about that.

I'm talking about the fact that my hypothetical new protocol operated strictly over TLS connections - plaintext straight up wasn't an option.
I am of the opinion that the widespread lack of encryption in gopherspace today is the protocol's biggest shortcoming, and I actually suspect that this point alone discourages some folks who would otherwise be on board from adopting it. But others, including Bongusta overlord Logout, do not see the need, so here's my attempt at a justification.

I have to admit that I'm a little baffled that this needs to be explained in 2019. The web has seen a significant shift to using HTTPS for anything and everything in the past few years, instead of only for login pages or internet banking, and just about every argument used to justify that applies also to gopher. Claiming that gopher doesn't need it because there's "nothing important on gopher" is a self-fulfilling prophecy. Nobody will put anything important on gopher until it stops lacking basic protections which we expect elsewhere.

Even if all content on gopher is fundamentally public content whose authors want it to be read by anybody, it remains true that:

These are all real problems affecting gopher today which make it unsuitable for several use cases, like political activism or software distribution, which I think it would be nice if it were suitable for. As long as these problems are unsolved, gopher can't ever be more than a toy in today's ultra-hostile internet.

All of these problems are solved, or at least heavily ameliorated, on the web via the ubiquitous use of HTTPS. Of course, the web comes with its own boatload of problems, like Referer headers and cookies and Javascript and more, which make it unsuitable for a bunch of uses too. Note that all those problems are solved in gopher, by virtue of its simplicity.

We only need to add ubiquitous encryption to gopher to end up with the best of both worlds!

Now, let me be clear exactly what I mean by "adding encryption to gopher". I don't want to advocate anybody serving anything on port 70 which isn't backward compatible with standard gopher, because that would be a tragedy for the gopher community. And I also don't want plaintext gopher to disappear entirely, because it's great that something like gopher exists which can be utilised on 40 year old machines which are too slow to do effective crypto. What I would like is to see something new which is basically "gopher plus crypto, maybe a little more" appear alongside the existing options. Something which could be thought of as a "souped up gopher" or as a "stripped down web", depending on your perspective. Something which meant people weren't forced to choose between two non-overlapping sets of massive and obvious shortcomings but could just USE the internet for sharing static content in a non-awful way - whether that static content is "just" phlog posts, ASCII art or old zines, or whether it's serious political dissent, cypherpunk activism, sexually explicit writing or non-trivial free software development.

The web is surely a dumpster fire, but let's not pretend gopher is perfect and cannot be improved. Those of us fleeing the web have just fallen back here because it's about the only off-the-shelf vaguely web-like thing that there is to fall back to. Some of us may be truly comfy here, and that's absolutely fine. Increasingly I think I'd like to use gopher as a temporary base of operations to build something even better.

r-and-the-web.txt


Soweli LukinIssuesAlex Schroeder