3 ms·

I find it sad that corporations have decided the internet should be predominantly a private space. Think of it, all of those brilliant http://c2.org http://c2.

by cjhanks 10y ago

I find it sad that corporations have decided the internet should be predominantly a private space. Think of it, all of those brilliant http://c2.org http://c2.org wiki's and ASCII-doc sites are now marked "insecure". Fundamentally -- some wonderful scientists and engineers created a paradise of free exchange. Commercial enterprise introduced the concept of 'money'. A bunch of thieves robbed them. And so we all have to put up walls with locks on them.

savanaly 10y ago
It's not just about money, right? Even if it was just scientists writing essays and sharing them with each other we would still need https to prevent, say, providers from snooping on or altering page contents.
- semi-extrinsic 10y ago
  Since I am the creator and maintainer of a scientific web app for molecular dynamics (shameless plug: http://www.bottledsaft.org http://www.bottledsaft.org) which is not on https (yet), I decided to check whether scientists browsing the net will quickly learn to ignore this warning. Finding so far: Yes, they will. No need to hurry, but I will go https eventually. Of the sites I checked quickly, these are running non-https by default: http://www.tandf.co.uk http://www.tandf.co.uk (Taylor & Francis, bunch of engineering journals) http://www.aps.org http://www.aps.org (American Physical Society, i.e. all the Phys. Rev. journals) http://journals.cambridge.org http://journals.cambridge.org (bunch of math and physics journals) http://www.thomsonreuters.com http://www.thomsonreuters.com (ManuscriptCentral, Scopus, the home of Impact Factor) http://www.sciencemag.org http://www.sciencemag.org (Science and other AIAA journals) http://www.nature.com http://www.nature.com (Nature Publishing Group) ... and I couldn't be bothered to check more
  - jtruk 10y ago
    As another data point, It's the same story for international web-tech conferences. Scatter sample: https://www.techdiary.co.uk/elsewhere https://www.techdiary.co.uk/elsewhere [1] [1] I run this, though only keep the NE section updated just now.
  - JadeNB 10y ago
    While this is good evidence of what is actually happening, please let's not suggest, even implicitly, that publishers are a place to look for guides to best practices [0]. I don't know about the sciences more generally, but, in math, "because the publishers do it" is just about the best reason possible not to do it [1]. [0] Except maybe that they publish them. :-) [1] Except the AMS, which, in my limited experience, seems to be populated by, and perhaps even more important, in the charge of, people who Get It.
    - semi-extrinsic 10y ago
      I agree. As I said, I really should get https working. I also really should finish a bunch of papers in various stages of completion and review, etc. This lets me decide whether the new Chrome behaviour rearranges my priorities or not.
hannob 10y ago
Yes, all these terrible corporations that want to make the Internet more secure. Who will stop them?
msbarnett 10y ago
> I find it sad that corporations have decided the internet should be predominantly a private space. This has very little to do with "corporations deciding the internet should be a predominantly private space", and everything to do with governments deciding that the internet is open season for information warfare and spying on citizens. The big push for HTTPS-everywhere hasn't been driven by "corporations affected by thieves", it's been driven in the wake of the Snowden revelations. As long as Advanced Persistent Threats exist, you have no way of verifying you're even reading the real c2.org, or ASCII-doc site, or some censored replacement a privileged network opponent is impersonating it with. HTTPS gives us some measure of security that we're talking with who we think we're talking with back.
danjoc 10y ago
>c2.org >This site requires JavaScript and Cookies to be enabled. Executing JavaScript from insecure http is a bad idea.[1] Especially for developers/IT admins who are targets of state sponsored hacking.[2] >Please change your browser settings or upgrade your browser. How about, no? There's a reason I block JS with noscript. It's not about page load speed, browser responsiveness, or ad blocking. (Although it helps in those areas remarkably) I block JS because executing untrusted JS code[3] is a good way to get hacked. [1]http://www.metafilter.com/130629/Possible-FBI-infiltration-of-TOR http://www.metafilter.com/130629/Possible-FBI-infiltration-o... [2]http://www.infoworld.com/article/2609621/hacking/uk-spy-agency-uses-nsa-attack-to-hack-slashdot--linkedin-users.html http://www.infoworld.com/article/2609621/hacking/uk-spy-agen... [3]https://mazinahmed.net/uploads/Bypassing%20NoScript%20Security%20Suite%20Using%20Cross-Site%20Scripting%20and%20MITM%20Attacks.pdf https://mazinahmed.net/uploads/Bypassing%20NoScript%20Securi...
- cjhanks 10y ago
  That is very helpful information. I am surprised it had JS, I would have to read why. Cookies are still harmful if no JS?
  - danjoc 10y ago
    I consider cookies much more secure than the alternatives. Here's a detailed explanation as it relates to JWT. The main takeaway is, if properly configured by the site, cookies are more secure than alternatives like web storage. https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage https://stormpath.com/blog/where-to-store-your-jwts-cookies-... But that's coming from a site admin point of view. As a user, it would be great to have a browser plugin that allows me to reject cookies that aren't secure/httponly.

by cjhanks 10y ago

savanaly 10y ago

It's not just about money, right? Even if it was just scientists writing essays and sharing them with each other we would still need https to prevent, say, providers from snooping on or altering page contents.

semi-extrinsic 10y ago
Since I am the creator and maintainer of a scientific web app for molecular dynamics (shameless plug: http://www.bottledsaft.org http://www.bottledsaft.org) which is not on https (yet), I decided to check whether scientists browsing the net will quickly learn to ignore this warning. Finding so far: Yes, they will. No need to hurry, but I will go https eventually. Of the sites I checked quickly, these are running non-https by default: http://www.tandf.co.uk http://www.tandf.co.uk (Taylor & Francis, bunch of engineering journals) http://www.aps.org http://www.aps.org (American Physical Society, i.e. all the Phys. Rev. journals) http://journals.cambridge.org http://journals.cambridge.org (bunch of math and physics journals) http://www.thomsonreuters.com http://www.thomsonreuters.com (ManuscriptCentral, Scopus, the home of Impact Factor) http://www.sciencemag.org http://www.sciencemag.org (Science and other AIAA journals) http://www.nature.com http://www.nature.com (Nature Publishing Group) ... and I couldn't be bothered to check more
- jtruk 10y ago
  As another data point, It's the same story for international web-tech conferences. Scatter sample: https://www.techdiary.co.uk/elsewhere https://www.techdiary.co.uk/elsewhere [1] [1] I run this, though only keep the NE section updated just now.
- JadeNB 10y ago
  While this is good evidence of what is actually happening, please let's not suggest, even implicitly, that publishers are a place to look for guides to best practices [0]. I don't know about the sciences more generally, but, in math, "because the publishers do it" is just about the best reason possible not to do it [1]. [0] Except maybe that they publish them. :-) [1] Except the AMS, which, in my limited experience, seems to be populated by, and perhaps even more important, in the charge of, people who Get It.
  - semi-extrinsic 10y ago
    I agree. As I said, I really should get https working. I also really should finish a bunch of papers in various stages of completion and review, etc. This lets me decide whether the new Chrome behaviour rearranges my priorities or not.

hannob 10y ago

Yes, all these terrible corporations that want to make the Internet more secure. Who will stop them?

msbarnett 10y ago

> I find it sad that corporations have decided the internet should be predominantly a private space. This has very little to do with "corporations deciding the internet should be a predominantly private space", and everything to do with governments deciding that the internet is open season for information warfare and spying on citizens. The big push for HTTPS-everywhere hasn't been driven by "corporations affected by thieves", it's been driven in the wake of the Snowden revelations. As long as Advanced Persistent Threats exist, you have no way of verifying you're even reading the real c2.org, or ASCII-doc site, or some censored replacement a privileged network opponent is impersonating it with. HTTPS gives us some measure of security that we're talking with who we think we're talking with back.

danjoc 10y ago

>c2.org >This site requires JavaScript and Cookies to be enabled. Executing JavaScript from insecure http is a bad idea.[1] Especially for developers/IT admins who are targets of state sponsored hacking.[2] >Please change your browser settings or upgrade your browser. How about, no? There's a reason I block JS with noscript. It's not about page load speed, browser responsiveness, or ad blocking. (Although it helps in those areas remarkably) I block JS because executing untrusted JS code[3] is a good way to get hacked. [1]http://www.metafilter.com/130629/Possible-FBI-infiltration-of-TOR http://www.metafilter.com/130629/Possible-FBI-infiltration-o... [2]http://www.infoworld.com/article/2609621/hacking/uk-spy-agency-uses-nsa-attack-to-hack-slashdot--linkedin-users.html http://www.infoworld.com/article/2609621/hacking/uk-spy-agen... [3]https://mazinahmed.net/uploads/Bypassing%20NoScript%20Security%20Suite%20Using%20Cross-Site%20Scripting%20and%20MITM%20Attacks.pdf https://mazinahmed.net/uploads/Bypassing%20NoScript%20Securi...

cjhanks 10y ago
That is very helpful information. I am surprised it had JS, I would have to read why. Cookies are still harmful if no JS?
- danjoc 10y ago
  I consider cookies much more secure than the alternatives. Here's a detailed explanation as it relates to JWT. The main takeaway is, if properly configured by the site, cookies are more secure than alternatives like web storage. https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage https://stormpath.com/blog/where-to-store-your-jwts-cookies-... But that's coming from a site admin point of view. As a user, it would be great to have a browser plugin that allows me to reject cookies that aren't secure/httponly.