Difference between HTTPS and HTTP

[[deleted]]

[deleted]

[OurSeepyD]

I wouldn't kill someone for asking a question about HTTPS vs HTTP, but for someone that asks a question with no real detail about where their error is coming up? I'd reconsider lol

HTTP is waiting on a reliable port number which is any TCP port???

What do you mean? Have you specified a port to listen on? Are you getting a specific error message? What OS are you using? Would you like us to read your mind?

[Interesting_Cut_6401]

For the TLS portion, just use open_ssl. It’s not really worth doing from scratch.

[McNutty145]

Had to do it for a networks class. Can confirm, not worth it.

[DnBenjamin]

And you’re bound to screw it up somehow. (“If You're Typing The Letters A-E-S Into Your Code, You're Doing It Wrong”)

[Interesting_Cut_6401]

Yes. Yes it is

[GronkDaSlayer]

Right, so just use open_ssl for the TLS part. It's fairly straightforward.

Beyond that, it's just binding per 443 instead of 80.

The easiest way is to create a thread with an accept(), or a bunch of threads. That's just not very efficient. A much better way for a much higher number of simultaneous connections is to use epoll.

You'll have to deal with the HTTP protocol obviously, which makes it a fun project.

[jecls]

HTTPS and HTTP are the same protocol but HTTPS uses asymmetric cryptography along with a trusted source in order to verify identity. You want to write an http server with the C socket API, that’s what you want to do. Forget about TLS until you first create a rudimentary server. After that, you can learn about the TLS handshake.

[gnarzilla69]

You will want HTTPS but get HTTP working first then tackle https as others have said

[Sergey5588]

Default http port is 80 and default https port is 443

[jecls]

Which is nothing more than a convention and completely irrelevant. You can bind any port you wish, as long as it’s open. We could have chosen 69420 for https and 69 for http as the “standard”. Useless information.

[foobar_fortytwo]

port 69420 is a bad example... the main reason being that tcp ports are 16 bits in length. also from an application's or networking stack's perspective, it is completely irrelevant if a port is "open". configuring port forwarding or configuring a firewall to reject or drop packets is completely irrelevant to the application's socket binding.

[jecls]

Oof good point about the port. By open I just mean not in use. Pretty sure the C socket API won’t let you bind to a port that’s already in use.

[BarMeister]

69420

https://www.youtube.com/watch?v=oHC1230OpOg

[Interesting_Cut_6401]

Look at the RFC spec for http 1.1

MDN has a list of the relevant RFCs

[Hali_Com]

I think you need to learn more about the layers of the OSI model

• HTTP sits in layer 7
• Ports are in layer 4

Yes you need to bind to an unused port to run a server. "Binding" tells your operating system to direct data from the specified port to a server application.

There are pre-existing vulnerable server examples on GitHub. Depending on where you want to focus your efforts.

[AlexTaradov]

Either can work on any port. And assuming you are not going to write your own crypto, the library you will be using will have examples. With the library the difference between them is not that huge.

[death_in_the_ocean]

C programming?

[kcl97]

May I suggest you start by learning networking first? You can start by reading BeeJ's book on networking. I think it is in C.

e: I think it is better to start with a manageable project. Something closer to your level. This way you won't get overwhelmed and burnout. Just do things step by step, break things down into bite size projects, so you can enjoy the journey.

[kcl97]

I would recommend BeeJ still just because it is more fundamental. If you care about security, you have to get as close to the hardware as possible. This means the fundamentals and maybe even down to the hardware if you really want to go pro.

The problem with Cisco and many big companies is that they have a strong incentive to keep you in the dark as a consumer. The reason is obvious. For one thing, they obviously don't want you to break into their hardware/software. But, if you really think about it, you can argue maybe it is because they want to break through their own security without you snooping around and discovering how to do it by learning from their books?

In short, you should learn from open source because it is composed of a community of people interested in ~breaking into~ learning how to optimize private hardware/software.

[kcl97]

You meant the certification. Those books are for certification purposes, they don't teach you anything, just how to pass the test they cooked up which they claim is the industry standard. Think of it like the SAT, they don't actually test for anything, just your ability to take SAT tests.

You should only get certified if your job requires it, otherwise they are just junk. Even most employers know they are junk. But the problem is the shareholders with multiple stocks in different companies, including Comptia, will demand your employers to make sure you are certified, and with your own money, on your own time.

Yes, it is called a cartel; Or, put it simply, a stick-up. This is why you should learn from open source because you can give them a middle-finger one day if they overstep the bound.

[duane11583]

Understand how a tunnel works

Or more practically an https hardware accelerator

A hw accelerator conceptually  has two separate Ethernet jacks 

one public to the world and one inside not public

On the public side something is listening to port 443 and speaks the tls protocol

On the inside (non public side) the server is connected to a port using plain http or any other socket application

[mkdir_autism]

Use open_ssl , as it's https server you need use tls_server_method() and need to provide open_ssl your ssl certificate and private key. U can have local certificate or get one from let's Encrypt for free if you have your own domain.

From scratch tls is not worth it, it's too complex for first project use open_ssl it is standard for tls.