THE BEST THING ABOUT GOPHER IS THAT IT'S UNENCRYPTED

Time for something controversial. Actually most of my entries are 
controversial, it's just that I doubt anybody reading really cares 
that much about their topics. But this one's about internet 
protocols, and an opinion on them is basically a prerequisite for 
browsing Gopher today in the first place.

Now this is basically a reaction to Gemini. I don't object to 
Gemini's existance, but I wouldn't use it. That is partly because I 
don't want any more than the Gopher protocol already provides. 
Beyond read-only sites with strictly structured content navigation 
and no embedded images, HTML/HTTP provides a wide world of forms, 
session tracking, and unsolicited multi-megabyte image downloads. 
You know it's there, you know it can be set up without using 
client-side scripting or cross-site tracking. You know of countless 
websites that _do_ work in a text-only browser. Your only problem 
is that it allowed for trends in web design that you strongly 
dislike to become commonplace.

Well one trend the web has taken that _I_ dislike is HTTPS 
redirects for read-only access. That is: requiring encryption when 
one is not submitting private information. Gemini requires 
encrypted connections for everything, so I don't like it.

You're probably not convinced. Maybe you think that I don't 
understand all of the advantages of encrypted connections. Or maybe 
you just think I'm grumpy about encryption because I can't get a 
new version of OpenSSH compiled on this PC so that I can connect 
easily to aussies.space and submit this post, and on that you're 
not that far wrong (though on that alone I'd just as well be 
complaining about the bloody configure script refusing to find the 
specified OpenSSL directory whenever there are any files in it!).

I get that someone intercepting the packets can work out which 
pages you're viewing on a site. But if you're really concerned 
about that then remember that which site you're viewing, and in 
what pattern, are often revealed by the IP adresses regardless of 
encryption anyway, unless you use a VPN/TOR (where you still have 
to trust that the service providers aren't infiltrated by some 
nation's security service). Say you're browsing with an encrypted 
Gopher protocol: your first connection is to one of the phlog 
aggregator pages, then you check through the recently updated 
phlogs that you like. Someone watching the IP addresses that you 
connect to (eg. at your ISP) would see that your first connection 
was to a server running a phlog aggregator (ammounting to the 
majority of its traffic), followed by a sequence of two connections 
to various other servers corresponding to new links in the phlog 
list. Do this enough, and they know what phlogs you folow, and 
therefore what phlog posts you read (further helped by analysing 
how long you spend reading posts - equating to time between new 
connections).

American company Cloudflare have an answer along the lines of "make 
all servers connect to users via us so that they're all using our 
IP addresses instead of one corresponding to each server". Very 
convenient for them that they then get to control access to every 
server on the internet, and also without any protection against 
security services getting their hooks into Cloudflare just like 
they might with ISPs.

So just encrypting your read-only access to a server with the aim 
of blindfolding a suspected big brother is a half-arsed measure at 
best[1]. Nothing wrong with having the option of course, but not 
worth forcing everyone to do it with HTTP to HTTPS redirects, or 
protocols only supporting encrypted connections, and thereby making 
the corresponding sacrifices.

What sacrifices? Very significant ones actually, for individuals 
respecting the promise of a light and frugle internet.

Encryption has an expiry date. As technology and cryptographic 
research progresses, old systems inevitably become insecure. To be 
of use not just for the anyway unreliable obscuration of your 
habits when downloading public content, but also for the more 
important job of protecting passwords and other private information 
sent over the internet, software must be continuously and endlessly 
upgraded.

What then if developers fail to keep upgrading this software? It 
cannot be used. If none support software fr a particular platform, 
then that platform becomes unusable. If that means you have to buy 
a new device or use software that you don't like, though luck. If 
you can't afford a new device or there isn't suitable alternative 
software, tough luck. If you want to write internet software 
yourself but can't commit the time to routinely adapt to changes in 
the encryption libraries, tough luck.

At the same time, the efficiency of encryption will always get 
worse, as more processing power is always required to encrypt data 
so that newer, more powerful, computers used to break that 
encryption can never catch up. So older computers will need to be 
upgraded just so that they are powerful enough to handle the more 
resource-intensive encryption, even when they could otherwise have 
been used yet for decades (yes decades, I'm coming to you from a 
25yo PC). Hardware-based encryption built into CPUs allows them to 
perform better with the cyphers used when they're made, but cannot 
be upgraded for systems that will be used in the future. The 
encryption-cracking possibilities of quantum computers threatens to 
cause demand for a new suite of post-quantum cryptographic 
technologies, custom hardware for which is already being developed. 
When that becomes the new standard and integraded into new 
hardware, old CPUs will be forced back to using slow software-only 
encryption and may become unusuable. If, of course, this hasn't 
already happened by progression of conventional encryption 
technology.

What I LOVE about Gopher is that I can still use the original 
University of Minnesota "Internet Gopher Information Client" to 
browse all of it[2], even though nobody has touched the code in the 
official release for over a decade. Plus I can use it without 
requiring a fast modern computer in order to take the load of 
modern encryption libraries. When I first discovered Gopher many 
years ago and wanted to see what a Gopher client was really like 
(not within Firefox's then still built-in support), I used a long 
since unmaintained closed-source gopher client on Windows XP (got 
to hand it to M$, backwards compatibility did work well sometimes). 
That would never have still worked if the protocol demanded 
encryption and therefore needed software to be updated every few 
years to keep pace.

Compare that to the web, for which a lot of more obscure 
open-source browsers have recently become unusable because they 
weren't updated to be built against OpenSSL 1.1. Furthermore, 
obscure unmaintained closed-source browsers on Windows, and also 
those for proprietary systems like old mobile phones, have been 
unusuable for many years because their encryption libraries 
couldn't be updated this far.

By removing the option of unencrypted connections for accessing 
public read-only content, server admins, and protocol designers, 
are shrinking the choice available to users over what software they 
use, and the range of hardware available to run it. They are 
putting an expiry date on both the software and the computers their 
users run it on.

I don't propose that users should be permitted to mistakenly send 
passwords, credit card details, or any other private info into over 
the internet unencrypted, or using insecure protocols. But for the 
case of public read-only access, where no such private information 
is submitted, as is the case for so much of the web that _I_ use, 
and all of Gopher (which by lack of session tracking, forms, or 
client-side scripting, pretty much precludes other applications 
anyway), encrypted connections are not essential. They are in fact 
not even widely effective when used in isolation for the benefit of 
privacy. As a choice, they are as welcome as the choice to use 
Gopher instead of the web. But as a rule, they are a gatekeeper to 
the internet forbidding entry to those who'se preferences or 
finances precluded an upgrade before the expiry date was up.

- The Free Thinker

[1] Another cause given for using encryption for read-only access 
to public info is that it prevents someone from modifying the 
content before it gets to you. This is a valid concern for users 
who may be silly enough to enter personal details into a fake page 
injected by a scammer. Though if there's no cause for the page to 
ask for such information, then a user going ahead and providing it 
would just as easily be scammed over an encrypted connection by 
sites that genuninely are run by scammers themselves. Such users' 
problems are only properly solved by improving their own education 
about internet usage. Such an attempt wouldn't be very convincing 
on Gopher anyway given its limitations and usual applications.

Also, evil overlords could subtly modify the content to secretly 
manipulate us. I don't think anyone is manipulating phlog posts in 
order to control the Gopher-reading population, so I don't care 
about this with my own usage. You make up your own mind.

[2] With the exception of some pages where people try to cheat and 
use gophermaps instead of text files so that they can have 
HTML-like in-page links. But that's just abuse of Gopher attempt at 
a structured, yet still customisable, navigation system unlike 
HTML's handing of a link shotgun to web designers with which they 
can then shoot themselves in the foot.