[HN Gopher] The "small web" is bigger than you might think
___________________________________________________________________
The "small web" is bigger than you might think
Author : speckx
Score : 259 points
Date : 2026-03-16 17:17 UTC (5 hours ago)
(HTM) web link (kevinboone.me)
(TXT) w3m dump (kevinboone.me)
| lasgawe wrote:
| mm, yeah. I like the idea of the small web not as a size category
| but as a mindset. people publishing for the sake of sharing
| rather than optimizing for attention or monetization.
| rapnie wrote:
| The fediverse is also generally experienced as a small web,
| where it comes to mindset. Though that is not always to the
| liking or preference of those expecting to find alternatives to
| big church social media platforms.
| apples_oranges wrote:
| Feeding llms you mean
| stronglikedan wrote:
| they gotta eat too!
| 8organicbits wrote:
| Is there a good free-but-subscriber-only solution for blogs?
| It seems like a contradiction, but in practice it may be
| manageable.
| pixl97 wrote:
| If it takes off in any amount, then LLMs will just
| subscribe and pull said data from sites at a reasonable
| pace (or not, it's free so make many accounts).
| cosmicgadget wrote:
| Loginwall or email newsletter with a summary on the open
| web.
| romaniv wrote:
| Small Web, Indie Web and Gemini are terminally missing the point.
| The web in the 90s was an _ecosystem_ that attracted people
| because of experimentation with the medium, diversity of content
| and certain free-spirited social defaults. It also attracted
| attention because it was a new, exciting and rapidly expanding
| phenomenon. To create something equivalent right now you would
| need to capture those properties, rather then try to revive old
| visual styles and technology.
|
| For a while I hoped that VR will become the new World Wide Web,
| but it was successfully torpedoed by the Metaverse initiative.
| SirFatty wrote:
| Which is exactly the point of Gemini.
| skeeter2020 wrote:
| I'm a dinosaur who bemoans the loss of whatever-it-was we had
| prior to the mass exploitation and saturation of the web
| today, so I feel it's my duty to check out Gemini and stop
| complaining. I'm prepared to trade ease of use or some modern
| functionality for better content and less of what the
| internet has become.
| mattlondon wrote:
| Not quite. I think Gemini has deliberately gone for a "text
| only" philosophy, which I think is very constraining.
|
| The early web had a lot going on and allowed for a _lot_ of
| creative experimentation which really caught the eye and the
| imagination.
|
| Gemini seems designed to _only_ allow long-form text content.
| You can 't even have a table let alone inline images which
| makes it very limited for even dry scientific research
| papers, which I think would otherwise be an excellent use-
| case for Gemini. But it seems that this sort of thing is a
| deliberate design/philosophical decision by the authors which
| is a shame. They _could_ have supported full markdown, but
| they chose not to (ostensibly to ease client implementation
| but there are a squillion markdown libraries so that
| assertion doesn 't hold water for me)
|
| It's their protocol so they can do what they want with it,
| but it's why I think Gemini as a protocol is a dead-end
| unless all you want to do is write essays (with no images or
| tables or inline links or table-of-contents or MathML or SVG
| diagrams or anything else you can think of in markdown). Its
| a shame as I think the client-cert stuff for Auth is
| interesting.
| okuntilnow wrote:
| There are images in geminispace, and audio, and (probably)
| video. It's just not inline. One of constraints of the
| protocol is that pages cannot load content without your
| express say-so.
| wibbily wrote:
| It's tough but one of the tenets of Gemini is that a lone
| programmer can write their own client in a spirited
| afternoon/weekend. Markdown is just a little too hard to
| clear the bar. Already there was much bellyaching on the
| mailing list about forcing dependence on SSL libraries;
| suggesting people rely on more libraries would have been a
| non-starter
|
| Note that the Gemini protocol is just a way of moving bytes
| around; nothing stops you from sending Markdown if you want
| (and at least some clients will render it - same with
| inline images).
| krapp wrote:
| Didn't the creator of the protocol go on a rant when
| someone made a browser for Gemini that included a
| favicon?
|
| I can't imagine the backlash if someone tried to
| normalize Markdown. Isn't the entire point of Gemini that
| it can never be extended or expanded upon?
|
| Maybe it would be better to create an entirely different
| protocol/alt web around Markdown that didn't risk running
| afoul of Gemini's philosophical restrictions?
| gzread wrote:
| It's about capturing the noncommerciality, not the
| experimentation. Most of the small web sites are just blogs, a
| solved problem by now, but there's interesting content in many
| of them.
| cdrnsf wrote:
| There's an element of nostalgia, certainly but it's also a
| reaction to the overwhelmingly commercial web. Why not build
| something instead of scrolling through brief videos
| interspersed with more and more ads that follow you everywhere?
|
| Large companies have helped build the web but they've done at
| least as much, if not more, to help kill it.
| Karrot_Kream wrote:
| The small web can be a lot of things, but IMO it gets too
| overrun by the ideologically zealous. One does not have to
| believe in primitive anarchism to enjoy camping, for example.
| In general it seems any niche idea on the internet is like
| candle flame to zealous moths.
| krapp wrote:
| Ideological zealots are more or less the only people who
| hate the modern web so much that they want to quarantine
| themselves within an entirely different and functionally
| limited protocol or ecosystem. Everyone else is fine
| discussing camping in Facebook groups and on Reddit and
| wherever, maybe just using an ad blocker.
| upboundspiral wrote:
| I think the article briefly touches on an important part: people
| still write blogs, but they are buried by Google that now
| optimizes their algorithm for monetization and not usefulness.
|
| Anyone interested in seeing what the web when the search engines
| selects for real people and not SEO optimized slop should check
| out https://marginalia-search.com .
|
| It's a search engine with the goal of finding exactly that -
| blogs, writings, all by real people. I am always fascinated by
| what it unearths when using it, and it really is a breath of
| fresh air.
|
| It's currently funded by NLNet (temporarily) and the project's
| scope is really promising. It's one of those projects that I
| really hope succeeds long term.
|
| The old web is not dead, just buried, and it can be unearthed. In
| my opinion an independent non monetized search engine is a public
| good as valuable as the internet archive.
|
| So far as I know marginalia is the only project that instead of
| just taking google's index and massaging it a bit (like all the
| other search engines) is truly seeking to be independent and
| practical in its scope and goals.
| lich_king wrote:
| > Google that now optimizes their algorithm for monetization
| and not usefulness.
|
| I don't think they do that. Instead, "usefulness" is mostly
| synonymous with commercial intent: searching for <x> often
| means "I want to buy <x>".
|
| Even for non-commercial queries, I think the sad reality is
| that most people subconsciously prefer LLM-generated or
| content-farmed stuff too. It looks more professional, has nice
| images (never mind that they're stock photos or AI-generated),
| etc. Your average student looking for an explanation of why the
| sky is blue is more interested in a TikTok-style short than
| some white-on-black or black-on-gray webpage that gives them
| 1990s vibes.
|
| TL;DR: I think that Google gives the average person exactly the
| results they want. It might be not what a small minority on HN
| wants.
| BrenBarn wrote:
| > I think that Google gives the average person exactly the
| results they want.
|
| There is some truth in this, but to me it's similar to saying
| that a drug dealer gives their customers exactly what they
| want. People "want" those things because Google and its ilk
| have conditioned them to want those things.
| sdenton4 wrote:
| On the one hand, a search engine is not heroin... It's a
| pretty broken analogy.
|
| On the other hand, we could probably convince Cory Doctorow
| to write a piece about how fentanyl is really about the
| enshitification of opiates.
| marginalia_nu wrote:
| Google and most search engines optimize for what is most
| likely to be clicked on. This works poorly and creates a huge
| popularity bias at scale because it starts feeding on its own
| tail: What major search engines show you is after all a large
| contributor to what's most likely to be clicked on.
|
| The reason Marginalia (for some queries) feels like it shows
| such refreshing results is that it simply does not take
| popularity into account.
| boxedemp wrote:
| I think that's a cool project, though I found the results to be
| less relevant than Google.
| janalsncm wrote:
| Whether the results are less relevant or not depends
| massively on what you searched and whether the best results
| even exist in the Marginalia search index or not.
|
| If Google is ranking small web results better than
| Marginalia, that's actionable.
|
| If the best result isn't in the index and it should be,
| that's actionable.
| marginalia_nu wrote:
| Well to be fair, Marginalia is also developed by 1 guy
| (me), and Google has like 10K people and infinite compute
| they can throw at the problem. There has been definite
| improvements, and will be more improvements still, but
| Google's still got hands.
| janalsncm wrote:
| Hey Marginalia, cheers. Imo fewer hands can also be an
| advantage.
|
| There are no PMs breathing down your neck to inject more
| ads in the search results, you don't depend on any broken
| internal bespoke tools that you can't fix yourself, and
| you don't need anybody's permission to deploy a new
| ranking strategy if you want to.
| marginalia_nu wrote:
| Thanks for shilling.
|
| Regarding the financials, even though the second nlnet grant
| runs out in a few weeks, I've got enough of a war chest to work
| full time probably a good bit into 2029 (modulo additional
| inflation shocks). The operational bit is self-funding now, and
| it's relatively low maintenance, so if worse comes to worst
| I'll have to get a job (if jobs still exist in 2029, otherwise
| I guess I'll live in the shameful cardboard box of those who
| were NGMI ;-).
| susam wrote:
| A little shell function I have in my ~/.zshrc:
| pages() { for _ in {1..5}; do curl -sSw '%header{location}\n'
| https://indieblog.page/random | sed 's/.utm.*//'; done }
|
| Here is an example output: $ pages
| https://alanpearce.eu/post/scriptura/
| https://jmablog.com/post/numberones/
| https://www.closingtags.com/blog/home-networking
| https://www.unsungnovelty.org/gallery/layers/
| https://thoughts.uncountable.uk/now/
|
| On macOS, we can also automatically open the random pages in the
| default web browser with: $ open $(pages)
|
| Another nice place to discover independently maintained personal
| websites is: https://kagi.com/smallweb
| viscousviolin wrote:
| That's a lovely bit of automation.
| oooyay wrote:
| Caveat that Kagi gates that repo such that it doesn't allow
| self-submissions so you're only going to see a chunk of
| websites that other people have submitted that also know about
| the Kagi repo.
| mxuribe wrote:
| But per the instructions, it seems like that if one wants to
| add your own website, then one needs to add 2 other small
| websites (that are not on the list already)...so technically
| it does open things up to those who are not aware of the
| repo...assuming their site is pulled in when someone wants to
| add their own website. Obviously this scale is slow...but i
| think that's kinda the point, eh? Nevertheless, for every 1
| person wanting to add their stuff, 2 others would technically
| get added i guess.
|
| See: https://github.com/kagisearch/smallweb?tab=readme-ov-
| file#%E...
| sdoering wrote:
| This is so lovely. Just adopted it for arch. And set it up, so
| that I can just type `indy n` (with "n" being any number) and
| it opens n pages in my browser.
|
| Thanks for sharing.
| 8organicbits wrote:
| One objection I have to the kagi smallweb approach is the
| avoidance of infrequently updated sites. Some of my favorite
| blogs post very rarely; but when they post it's a great read.
| When I discover a great new blog that hasn't been updated in
| years I'm excited to add it to my feed reader, because it's a
| really good signal that when they publish again it will be worth
| reading.
| freediver wrote:
| To clarify criteria is less than 2 years since last blog post.
| oopsiremembered wrote:
| I'm with you. Also, sometimes I'm specifically looking for some
| dusty old site that has long been forgotten about. Maybe I'm
| trying to find something I remember from ages ago. Or maybe I'm
| trying to deeply research something.
|
| There's a lot more to fixing search than prioritizing recency.
| In fact, I think recency bias sometimes makes search worse.
| Borg3 wrote:
| http://borg.uu3.net/~borg/?fun/wisdom_of_the_ancients
| est wrote:
| also kagi exclude non-English sites. Sad for mixed language
| blogs like mine.
| shermantanktop wrote:
| This is a specific definition of "small web" which is even
| narrower than the one I normally think of. But reading about
| Gemini, it does make me wonder if the original sin is client-side
| dynamism.
|
| We could say: that's Javascript. But some Javascript operates
| only on the DOM. It's really XHR/fetch and friends that are the
| problem.
|
| We could say: CSS is ok. But CSS can fetch remote resources and
| if JS isn't there, I wonder how long it would take for ad vendors
| to have CSS-only solutions...or maybe they do already?
| akkartik wrote:
| Yeah, CSS is Turing Complete: https://lyra.horse/x86css
| zahlman wrote:
| I wonder: what's the least that could be removed from CSS to
| avoid Turing-completeness?
| jmclnx wrote:
| I moved my site to Gemini on sdf.org, I find it far easier to use
| and maintain. I also mirror it on gopher. Maintaining both is
| still easier than dealing with *panels or hosting my own. There
| is a lot of good content out there, for example:
|
| gemini://gemi.dev/
|
| FWIW, dillo now has plugins for both Gemini and Gopher and the
| plugins work find on the various BSDs.
| heliumtera wrote:
| How many would be left after removing self promotion, AI
| generated content and "how I use AI?"(Claude code like everybody
| else)
| varun_ch wrote:
| A fun trend on the "small web" is the use of 88x31 badges that
| link to friends websites or in webrings. I have a few on my
| website, and you can browse a ton of small web websites that way.
|
| https://varun.ch (at the bottom of the page)
|
| There's also a couple directories/network graphs
| https://matdoes.dev/buttons https://eightyeightthirty.one/
| 101008 wrote:
| A beautiful trend that has been going for 30 years ;-)
|
| One of the happiest moments of my childhood (I'm exagerating)
| was when my button was placed in that website that I loved to
| visit everyday. It was one of the best validations I ever
| received :)
| skciva wrote:
| What inspired me to pursue computer related fields was making
| little badges and forum signatures in Photoshop as a teen.
| Heartwarming to see this tradition has persisted
| Terr_ wrote:
| I can't be the only one with an ancient collection of
| artistically-mismatched "under construction" graphics.
| NooneAtAll3 wrote:
| my main problem with such links is... how often do you update
| them? how often do you check those websites to see that they're
| still active?
|
| I remember going through all the blogs linked on terry tao's
| blog - out of like 50 there were only 8-ish still alive :(
| myylogic wrote:
| great work
| lich_king wrote:
| It's easy to hand-curate a list of 5,000 "small web" URLs. The
| problem is scaling. For example, Kagi has a hand-curated "small
| web" filter, but I never use it because far more interesting and
| relevant "small web" websites are outside the filter than in it.
| The same is true for most other lists curated by individual
| folks. They're neat, but also sort of useless because they are
| _too_ small: 95% of the things you 're looking for are not there.
|
| The question is how do you take it to a million? There probably
| are at least that many good personal and non-commercial websites
| out there, but if you open it up, you invite spam & slop.
| freediver wrote:
| I mainly use Kagi Small Web as a starting point of my day, with
| my morning coffee. Especially now when categories are added,
| always find something worth reading. The size here does not
| present a problem as I would usually browse 20-30 sites this
| way.
| lich_king wrote:
| Right, but that basically works as a retro alternative to
| scrolling through social media. If you're looking for
| something specific, it's simultaneously true that there's a
| small web page that answers your question and that it's not
| on any "small web" list because the owner of the webpage
| never submitted it there, or didn't meet the criteria for
| inclusion.
|
| For example, I have several non-commercial, personal websites
| that I think anyone would agree are "small web", but each of
| them fails the Kagi inclusion criteria for a different
| reason. One is not a blog, another is a blog but with the
| wrong cadence of posts, etc.
| freediver wrote:
| Feel free to suggest changes to criteria for inclusion. It
| is mostly the way it is now as the entire project is
| maintained by one person - me :)
| lich_king wrote:
| Looking at the criteria again, I can think of at least
| three things that arbitrarily exclude large swathes of
| the small web:
|
| 1) The requirement that it needs to be a blog. There's
| plenty of small-web sites of people who obsess over
| really wonderful and wacky stuff (e.g.,
| https://www.fleacircus.co.uk/History.htm) but don't
| qualify here.
|
| 2) The requirement that it needs to be updated regularly.
| Same as above - I get that infrequently updated websites
| don't generate a "daily morning" feed, but admitting them
| wouldn't harm in any way.
|
| 3) Blanket ban on Substack-like platforms while allowing
| Blogspot, Wordpress.com, YouTube, etc. Bloggers follow
| trends, so you're effectively excluding a significant
| proportion of personal blogs created in the last six
| years, including the stuff that isn't monetized or behind
| interstitials. The outcomes are pretty weird: for
| example, noahpinionblog.blogspot.com is on your list, but
| noahpinion.blog is apparently no longer small web.
| freediver wrote:
| 1) It has to have a feed (we dont want to overcrawl) so
| hence 'blog' - more accurately any site with an RSS/atom
| feed would do
|
| 2) 'Regularly' means posted in the last 2 years to be
| included
|
| 3) Substack has an annoying subcribe popup and ads/popups
| are against the spirit of what this represents
| cosmicgadget wrote:
| My approach operates under the assumption that good, non-
| commercial webpages will be similar to other good webpages.
| Slop, SEO spam, and affiliate content will resemble other such
| content.
|
| So a similarity-based graph/network of webpages should cluster
| good with good, bad with bad. That is what I've seen so far,
| anyway.
|
| With that, you just need to enter the graph in the right place,
| something that is fairly trivial.
| nottorp wrote:
| > The question is how do you take it to a million?
|
| Do you need to take it to a million in the same place? Is that
| still "small"?
|
| Why not have 2000 hand curated directories instead?
| afisxisto wrote:
| Cool to see Gemini mentioned here. A few years back I created
| Station, Gemini's first "social network" of sorts, still running
| today: https://martinrue.com/station
| freediver wrote:
| Kagi Small Web has about 32K sites and I'd like to think that we
| have captured most of (english speaking) personal blogs out there
| (we are adding about 10 per day and a significant effort went
| into discovering/fidning them).
|
| It is kind of sad that the entire size of this small web is only
| 30k sites these days.
| savolai wrote:
| Does this use frames or iframe? https://kagi.com/smallweb
|
| I would expect a raw link in the top bar to the page shown, to
| be able to bookmark it etc.
| susam wrote:
| There is a '/'-shaped icon in the navigation bar at the top.
| If you click on that it takes you to the original post in a
| new tab. On Firefox and Safari, you can also right click that
| icon and add the original post to the bookmarks.
| Cyan488 wrote:
| I'm noticing sites that break the rules. I report (flag) them,
| is that useful or should I just PR to remove them?
| freediver wrote:
| PR is better!
| aquova wrote:
| What methods are you using to find them? I notice my own
| doesn't appear, although it does show up well under some (very
| niche) Google search terms. I suspect there's the potential for
| an order of magnitude more sites than have been found.
| flir wrote:
| Suspect there's a long tail/iceberg you still haven't captured
| (source: you haven't found me yet and I'm not hiding, I'm just
| not chasing SEO).
| freediver wrote:
| I am happy to hear this.
| zahlman wrote:
| Does this concept of "personal blog" include people
| periodically sharing, say, random knowledge on technical
| topics? Or is it specifically people writing about their day-
| to-day lives?
|
| How would I check if my site is included?
| susam wrote:
| You can check: <https://github.com/kagisearch/smallweb/blob/m
| ain/smallweb.tx...>. I can see that your RSS URL is listed
| there.
|
| But it currently does not appear in the search results here:
| <https://kagi.com/smallweb/?search=zahlman>. The reason
| appears to be this:
|
| _" If the blog is included in small web feed list (which
| means it has content in English, it is
| informational/educational by nature and it is not trying to
| sell anything) we check for these two things to show it on
| the site: * Blog has recent posts (<7 days old) [...]"_
|
| (Source: https://github.com/kagisearch/smallweb#criteria-for-
| posts-to...)
| jopsen wrote:
| > I'd like to think that we have captured most of (english
| speaking) personal blogs
|
| I think that's naive.
|
| But maybe thats just because my blog wasn't on the list :)
| krapp wrote:
| Neither is mine, But that's fine with me.
| tonymet wrote:
| hats off to https://1mb.club/ and https://512kb.club/ for
| cataloging and featuring small web experiences
| GuB-42 wrote:
| I don't expect many people to agree but I think that the "small
| web" should reject encryption, which is the opposite direction
| that Gemini is taking.
|
| I don't deny the importance of encryption, it is really what
| shaped the modern web, allowing for secure payment, private
| transfer of personal information, etc... See where I am getting
| at?
|
| Removing encryption means that you can't reasonably do financial
| transactions, accounts and access restriction, exchange of
| private information, etc... You only share what you want to share
| publicly, with no restrictions. It seriously limits commercial
| potential which is the point.
|
| It also helps technically. If you want to make a tiny web server,
| like on a microcontroller, encryption is the hardest part. In
| addition, TLS comes with expiring certificates, requiring regular
| maintenance, you can't just have your server and leave it alone
| for years, still working. It can also bring back simple caching
| proxies, great for poor connectivity.
|
| Two problems remain with the lack of encryption, first is
| authenticity. Anyone can man-in-the-middle and change the web
| page, TLS prevents that. But what I think is an even better
| solution is to do it at the content level: sign the content, like
| a GPG signature, not the server, this way you can guarantee the
| authenticity of the content, no matter where you are getting it
| from.
|
| The other thing is the usual argument about oppressive
| governments, etc... Well, if want to protect yourself, TLS won't
| save you, you will be given away by your IP address, they may not
| see exactly what you are looking at, but the simple fact you are
| connecting to a server containing sensitive data may be evidence
| enough. Protecting your identity is what networks like TOR are
| for, and you can hide a plain text server behind the TOR network,
| which would act as the privacy layer.
| marginalia_nu wrote:
| Big thing that made encryption required is arguably that ISPs
| started injecting crap into webpages.
|
| Governments can still track you with little issue since SNI is
| unencrypted. It's also very likely that Cloudflare and the like
| are sharing what they see as they MITM 80% of your connections.
| jopsen wrote:
| > It's also very likely that Cloudflare and the like are
| sharing what they see as they MITM 80% of your connections.
|
| Maybe, I suspect not, but even so if we reduce the number of
| men in the middle that's pretty nice.
| marginalia_nu wrote:
| Between what Snowden told us, and the CLOUD Act, it seems
| quite likely.
| throw5 wrote:
| > But what I think is an even better solution is to do it at
| the content level: sign the content, like a GPG signature
|
| How would this work in reality? With the current state of
| browsers this is not possible because the ISP can still insert
| their content into the page and the browser will still load it
| with the modified content that does not match the signature.
| Nothing forces the GPG signature verification with current
| tech.
|
| If you mean that browsers need to be updated to verify GPG
| signature, I'm not sure how realistic that is. Browsers cannot
| verify the GPG signature and vouch for it until you solve the
| problem of key revocation and key expiry. If you try to solve
| key revocation and key expiry, you are back to the same
| problems that certificates have.
| axblount wrote:
| Signatures do have similar problems to certificates. But
| Gemini doesn't avoid them either and often recommends TOFU
| certificates. I think the comment's point was that digital
| signatures ensure identity but are unsuitable for e-commerce,
| a leading source of enshittification.
| interroboink wrote:
| > you are back to the same problems that certificates have.
|
| Some of the same problems. One nice thing about verifying
| content rather than using an SSL connection is that plain-old
| HTTP caching works again.
|
| That aside, another benefit of less-centralized and more-
| fine-grained trust mechanisms would be that a person can
| decide, on a case-by-case basis what entities should be
| trusted/revoked/etc rather than these root CAs that entail
| huge swaths of the internet. Admittedly, _most_ people would
| just use "whatever's the default," which would not behave
| that differently from what we have now. But it would open the
| door to more ergonomic fine-grained decision-making for those
| who wish to use it.
| honeycrispy wrote:
| Anyone between you and the server can change the content of the
| page on unencrypted connections. I would love to live in a
| world where encryption is unnecessary, but unfortunately that
| world does not exist right now.
| cristoperb wrote:
| You could do signatures/MAC without encryption to guarantee
| that the message was not modified
| zzo38computer wrote:
| > I think that the "small web" should reject encryption, which
| is the opposite direction that Gemini is taking.
|
| I think it should allow but not require encryption.
|
| > Removing encryption means that you can't reasonably do
| financial transactions, accounts and access restriction,
| exchange of private information, etc... You only share what you
| want to share publicly, with no restrictions. It seriously
| limits commercial potential which is the point.
|
| Note that the article linked to says "the Gemini protocol is so
| limited that it's almost incapable of commercial exploitation",
| even though Gemini does use TLS. (Also, accounts and access
| restriction can sometimes be used with noncommercial stuff as
| well; they are not only commercial.)
|
| > It also helps technically. If you want to make a tiny web
| server, like on a microcontroller, encryption is the hardest
| part.
|
| This is one of the reasons I think it should not be required.
| (Neither the client side nor server side should require it.
| Both should allow it if they can, but if one or both sides
| cannot (or does not want to) implement encryption for whatever
| reason, then it should not be required.)
|
| > Anyone can man-in-the-middle and change the web page, TLS
| prevents that. But what I think is an even better solution is
| to do it at the content level: sign the content, like a GPG
| signature
|
| Using TLS only prevents spies (except Cloudflare) from seeing
| or altering the data, and does not prevent the server operator
| from doing so (or from reassigned domain names, if you are
| using the standard certificate authorities for WWW; especially
| if you are using cookies for authentication rather than client
| certificates which would avoid that issue (but the other issues
| would not entirely be avoided)).
|
| Cryptographic signatures of the files is helpful, especially
| for static files, and would help even if the files are
| mirrored, so it does have benefits. However, these are
| different benefits than those of using TLS.
|
| In other cases, if you already know what the file is and it is
| not changing, then using a cryptographic hash will help, and a
| signature might not be needed (although you might have that
| too); the hash can also be used to identify the file so that
| you do not necessarily need to access it from one specific
| server if it is also available elsewhere.
|
| > Well, if want to protect yourself, TLS won't save you, you
| will be given away by your IP address, they may not see exactly
| what you are looking at, but the simple fact you are connecting
| to a server containing sensitive data may be evidence enough.
|
| There is also SNI. Depending on the specific server
| implementation, using false SNI might or might not work, but
| even if it does, the server might not provide a certificate
| with correct data in that case (my document of Scorpion
| protocol mentions this possibility, and suggestions of what to
| do about it).
| adiabatichottub wrote:
| > It also helps technically. If you want to make a tiny web
| server, like on a microcontroller, encryption is the hardest
| part.
|
| > Two problems remain with the lack of encryption, first is
| authenticity. Anyone can man-in-the-middle and change the web
| page, TLS prevents that. But what I think is an even better
| solution is to do it at the content level: sign the content,
| like a GPG signature, not the server, this way you can
| guarantee the authenticity of the content, no matter where you
| are getting it from.
|
| If your microcontroller can't do TLS then it probably won't do
| GPG either. But you can still serve HTTP content on port 80 if
| you need to support plaintext. I believe a lot of package
| distribution is still over HTTP.
|
| Edit: Sorry, missed the web server part somehow and was
| thinking of a microcontroller based client.
|
| > In addition, TLS comes with expiring certificates, requiring
| regular maintenance, you can't just have your server and leave
| it alone for years, still working. It can also bring back
| simple caching proxies, great for poor connectivity.
|
| Yeah, TLS and DNS are the two of the biggest hurdles to a
| completely distributed Internet. Of course you go down that
| road and you get IPFS, which sounds cool to me, but doesn't
| seem to have ever taken off.
| zzo38computer wrote:
| > If your microcontroller can't do TLS then it probably won't
| do GPG either.
|
| It is not a problem if you are only serving static files.
| adiabatichottub wrote:
| I guess I was thinking microcontroller as client, so yes I
| agree
| krapp wrote:
| >Removing encryption means that you can't reasonably do
| financial transactions, accounts and access restriction,
| exchange of private information, etc... You only share what you
| want to share publicly, with no restrictions. It seriously
| limits commercial potential which is the point.
|
| People will still do financial transactions on an unencrypted
| web because the utility outweighs the risk. Removing encryption
| just guarantees the risk is high.
| zzo38computer wrote:
| > People will still do financial transactions on an
| unencrypted web because the utility outweighs the risk.
| Removing encryption just guarantees the risk is high.
|
| That does not necessarily require TLS to mitigate (although
| TLS does help, anyways). There are other issues with
| financial transactions, whether or not TLS is used. (I had
| idea, and wrote a draft specification of, "computer payment
| file", to try to improve security of financial transactions
| and avoid some kinds of dishonesty; it has its own security
| and does not require TLS (nor does it require any specific
| protocol), although using TLS with this is still helpful.)
| (There are potentially other ways to mitigate the problems as
| well, but this is one way that I think would be helpful.)
| xantronix wrote:
| I have noticed that when I encounter an HTTP-only web site, I
| know I am in for a pleasant, calm, well-curated experience, and
| I mean that without a hint of irony.
|
| I don't have a lot to say about the technical discussion here,
| other than "TLS null cipher could be fine but also a lot more
| infrastructure than desirable", which could subvert your intent
| here.
|
| Maybe we should normalise TOR usage before it becomes a
| surefire signal to the FBI to raid one's home.
| swiftcoder wrote:
| > If you want to make a tiny web server, like on a
| microcontroller, encryption is the hardest part
|
| Even an esp32 can (just) handle TLS. Given relatively modern
| designs, you end up on remarkably small chips before TLS is a
| real blocker
| jimbokun wrote:
| I think a simpler argument would be that small web is not a
| good fit if your content is sensitive in the place you are
| publishing from. It's meant for public publishing. If you need
| encryption, use a different distribution mechanism.
| UqWBcuFx6NV4r wrote:
| That is not the only protection that HTTPS offers. US ISPs
| used to inject ads into HTML HTTP responses.
|
| Can all this performative love for unencrypted HTTP just die
| already. You've all forgotten what it was actually like, and
| what the drawbacks actually are. This is so tiring.
| tonymet wrote:
| I'm not sold on gemini. Less utility, weaker, immature tools.
| Investing on small HTTP based websites is the right direction.
| One could formalize it as a browser extension or small-web HTTP
| proxy that limits JS, dom size, cookie access etc using existing
| Web browsers & user agents.
| trinsic2 wrote:
| Can anyone point me to the best place to get castor going? I cant
| install it on my 22.04 install unmet dependencies...
| 627467 wrote:
| I read alot against monetization in the comments. I think because
| we are used monetization being so exploitative, filled with dark
| patterns and bad incentives on the Big Web.
|
| But it doesnt need to be thia way: small web can also be about
| sustainable monetization. In fact there's a whole page on that on
| https://indieweb.org/business-models
|
| There's nothing wrong with "publishers" aspiring to get paid.
| danhite wrote:
| Isn't this a simple compute opportunity? ...
|
| > March 15 there were 1,251 updates [from feed of small websites
| ...] too active, to publish all the updates on a single page,
| even for just one day. Well, I could publish them, but nobody has
| time to read them all.
|
| if the reader accumulates a small set of whitelist keywords,
| perhaps selected via optionally generating a tag cloud ui, then
| that est. 1,251 likely drops to ~ single page (most days)
|
| if you wish to serve that as noscript it would suffice to
| partition in/visible content eg by <section class="keywords ..."
| and let the user apply css (or script by extension or
| bookmarklet/s) to reveal just their locally known interests
| dwg wrote:
| Love the irony: Man builds a Gemini-style feed aggregator for
| small web, finding it, well, not so small.
| Gunax wrote:
| It's sad how the snall web became invisible.
|
| I used to use all sorts of small websites in 2005. But by 2015 I
| used only about 10 large ones.
|
| Like many changes, I cannot pinpoint exactly when this happened.
| It just occurred to me someday that I do not run into many
| unusual websites any longer.
|
| It's unfortunate that so much of our behavior is dictated by
| Google. I dint think it's malicious or even intentional--but at
| some point they stopped directing traffic to small websites.
|
| And like a highway closeure ripples through small town economies,
| it was barely noticed by travellers but devestating to
| recipients. What were once quaint sites became abandoned.
|
| The second force seems to be video. Because video is difficult
| and expensive to host, we moved away from websites. Travel blogs
| were replaced with travel vlogs. Tutorials became videos.
| Ylpertnodi wrote:
| > I dint think it's malicious or even intentional--but at some
| point they stopped directing traffic to small websites.
|
| Small websites have small dollars?
| ZebrasEat wrote:
| Has there been any effort in taking any of these small web type
| approaches into a headscale type space? My preferences would be
| to have a private area where whitelisting prevents crawling or
| scraping. Am baffled why someone hasn't created a headscale
| server and started distributing nodes to personally known 'good
| intentioned' humans. Anyone ever heard of anything like this?
| esseph wrote:
| Parts of the "dark web" are built somewhat like this
| graemep wrote:
| > The US spends ~$14,570 per person on healthcare. Japan spends
| ~$5,790 and has the highest life expectancy in the OECD.
|
| The difference in life expectancy will be influenced by multiple
| factors and may have more to do with diet and lifestyle than with
| healthcare.
|
| Japan also spends less per capita than the UK, France or Germany.
| The US spends a lot more than any of those so the US system is
| bad value for money.
| mtmail wrote:
| The comment belongs to this thread
| https://news.ycombinator.com/item?id=47401809
| pipeline_peak wrote:
| Every answer I've seen to corporate internet whether it be
| Mastodon or Gemini just sounds like shell script slab city.
|
| Just another place for hackers to go and keep to themselves.
|
| Non tech people, who needs them! In shelf script slab city, we
| can share cooking recipes in plaintext.
|
| Just spin up your instance, map it to a port, initialize the
| listener daemon, download the cli viewer...and you're in shell
| script slab city! Who needs Twitter
___________________________________________________________________
(page generated 2026-03-16 23:00 UTC)