4 ms·

> browsers are hiding the URI prefix Maybe browsers should stop with that idiocy then.

by serge2k 10y ago

jedberg 10y ago
You've clearly never worked with the 99% of people who use the internet who don't care about https, much less know what it is. They don't understand that when someone says "go to google.com" that something isn't wrong when the url bar says "https://google.com" https://google.com". They think they something is broken. Heck, Safari now be default doesn't even show you the path, they just show the domain, because once people get to foo.com they don't even understand about the paths, nor care.
- nitrogen 10y ago
  Just like learning what stoplights mean when driving a car, those users need to adapt to the basic signals of the web.
  - groby_b 10y ago
    Those "basic signals of the web" are useless to the user. They carry no meaningful information for them. You don't need to learn about the Dewey decimal system when reading books, either. For the same reason - it's helpful for finding things, it allows you to classify books, and it doesn't matter at all since there are better ways to find books now.
  - nommm-nommm 10y ago
    There's no web surfing license or web surfing test, that's the big difference.
- eatbitseveryday 10y ago
  > people who use the internet who don't care about https, much less know what it is. While I agree, I do not believe this is an appropriate excuse for ignorance (I am not accusing you of anything, just criticizing the viewpoint itself). Computers are part of life. People know about antibiotics, vaccine, stem cells, black holes, and they know atomic radiation causes cancer and the same material can be used for atomic bombs, about wavelengths, and certain ones (UV) cause cancer by breaking DNA, etc. But, not technology? How is there such a well-formed ignorance when it comes to technology? It's fed to us by the media too, who cite "computer glitches"[1,2,3] when something goes wrong, or when there is a breach of the system and all credentials stolen. And, not understanding URLs leads to susceptibility to information being stolen from phishing attacks. Whose "fault" is there here? [1] "Glitch" http://money.cnn.com/2013/12/26/news/companies/delta-ticket-price-glitch/index.html http://money.cnn.com/2013/12/26/news/companies/delta-ticket-... [2] "Something broke" https://www.theguardian.com/technology/2016/feb/08/department-of-justice-homeland-security-hacking https://www.theguardian.com/technology/2016/feb/08/departmen... [3] "Glitch" http://www.nbcnews.com/video/nightly-news/48088061 http://www.nbcnews.com/video/nightly-news/48088061
- ploxiln 10y ago
  Because people like you, and "UI/UX experts", have put so much effort into downplaying and hiding simple important pieces of information. This shit is as easy, and as useful, as traffic signs.
matt4077 10y ago
The protocol prefix is a technical implementation detail. It'd be quite a coincidence if it also happened to be the best users interface. Browser developers aren't in a position to retrain users to their preferred ideology. Their job is to find ways to make the web easier to use. And in fact they have: green URL bars, padlocks etc. – these are UI metaphors that do a much better job than a one-letter change in a cryptic initialism from the 70'ies. Even holier-than-thou professionals should profit from this: a green URL actually means the connection is protected, whereas it's quite easy to use https without actually using encryption or at least using completely insecure ciphers.
- ploxiln 10y ago
  Have you used browsers since 1999 or so? First, browsers added a padlock icon on the left for https:// https:// sites. Then, phishing sites, and even banking websites, started using a padlock for their favicon, and users couldn't tell the difference. So it was abandoned. Then, the whole background of the URL bar was turned a sort of gold-yellow color when the site was secure. It was like this: http://www.facebookloginhut.com/wp-content/uploads/2010/07/step2_facebook_login.png http://www.facebookloginhut.com/wp-content/uploads/2010/07/s... Then that effect was removed, I think it scared some users, or they didn't know to look for it, I don't know. Now, favicons are never shown in the URL bar so a padlock favicon can no longer mislead. Some browser started hiding "http://" http://", some started coloring "https://" https://". (Now many do both.) The extended-validation green pill thing was added. It's harder than ever to allow a self-signed cert when you're using a service you set up yourself on your LAN. Apparently there are more changes planned, every year or so. "users" have no chance of keeping this stuff straight, only "experts" like me and you do.
  - lstamour 10y ago
    I think people learn to follow whatever their browser does, assuming they bother to notice in the first place. I wouldn't worry as much about how to get people to notice security, browser vendors are on the right track by popping up giant notices for insecure sites and sites with malware. They just need to extend the "untrusted download" concept from operating systems to email where you could have "untrusted link" warnings in your browser instead. "Are you sure you want to visit paypal.28753272.server? You really shouldn't trust this link..."

> browsers are hiding the URI prefix Maybe browsers should stop with that idiocy then.

by serge2k 10y ago

> browsers are hiding the URI prefix Maybe browsers should stop with that idiocy then.

You've clearly never worked with the 99% of people who use the internet who don't care about https, much less know what it is. They don't understand that when someone says "go to google.com" that something isn't wrong when the url bar says "https://google.com" https://google.com". They think they something is broken. Heck, Safari now be default doesn't even show you the path, they just show the domain, because once people get to foo.com they don't even understand about the paths, nor care.

nitrogen 10y ago
Just like learning what stoplights mean when driving a car, those users need to adapt to the basic signals of the web.
- groby_b 10y ago
  Those "basic signals of the web" are useless to the user. They carry no meaningful information for them. You don't need to learn about the Dewey decimal system when reading books, either. For the same reason - it's helpful for finding things, it allows you to classify books, and it doesn't matter at all since there are better ways to find books now.
- nommm-nommm 10y ago
  There's no web surfing license or web surfing test, that's the big difference.
eatbitseveryday 10y ago
> people who use the internet who don't care about https, much less know what it is. While I agree, I do not believe this is an appropriate excuse for ignorance (I am not accusing you of anything, just criticizing the viewpoint itself). Computers are part of life. People know about antibiotics, vaccine, stem cells, black holes, and they know atomic radiation causes cancer and the same material can be used for atomic bombs, about wavelengths, and certain ones (UV) cause cancer by breaking DNA, etc. But, not technology? How is there such a well-formed ignorance when it comes to technology? It's fed to us by the media too, who cite "computer glitches"[1,2,3] when something goes wrong, or when there is a breach of the system and all credentials stolen. And, not understanding URLs leads to susceptibility to information being stolen from phishing attacks. Whose "fault" is there here? [1] "Glitch" http://money.cnn.com/2013/12/26/news/companies/delta-ticket-price-glitch/index.html http://money.cnn.com/2013/12/26/news/companies/delta-ticket-... [2] "Something broke" https://www.theguardian.com/technology/2016/feb/08/department-of-justice-homeland-security-hacking https://www.theguardian.com/technology/2016/feb/08/departmen... [3] "Glitch" http://www.nbcnews.com/video/nightly-news/48088061 http://www.nbcnews.com/video/nightly-news/48088061
ploxiln 10y ago
Because people like you, and "UI/UX experts", have put so much effort into downplaying and hiding simple important pieces of information. This shit is as easy, and as useful, as traffic signs.

matt4077 10y ago

The protocol prefix is a technical implementation detail. It'd be quite a coincidence if it also happened to be the best users interface. Browser developers aren't in a position to retrain users to their preferred ideology. Their job is to find ways to make the web easier to use. And in fact they have: green URL bars, padlocks etc. – these are UI metaphors that do a much better job than a one-letter change in a cryptic initialism from the 70'ies. Even holier-than-thou professionals should profit from this: a green URL actually means the connection is protected, whereas it's quite easy to use https without actually using encryption or at least using completely insecure ciphers.

ploxiln 10y ago
Have you used browsers since 1999 or so? First, browsers added a padlock icon on the left for https:// https:// sites. Then, phishing sites, and even banking websites, started using a padlock for their favicon, and users couldn't tell the difference. So it was abandoned. Then, the whole background of the URL bar was turned a sort of gold-yellow color when the site was secure. It was like this: http://www.facebookloginhut.com/wp-content/uploads/2010/07/step2_facebook_login.png http://www.facebookloginhut.com/wp-content/uploads/2010/07/s... Then that effect was removed, I think it scared some users, or they didn't know to look for it, I don't know. Now, favicons are never shown in the URL bar so a padlock favicon can no longer mislead. Some browser started hiding "http://" http://", some started coloring "https://" https://". (Now many do both.) The extended-validation green pill thing was added. It's harder than ever to allow a self-signed cert when you're using a service you set up yourself on your LAN. Apparently there are more changes planned, every year or so. "users" have no chance of keeping this stuff straight, only "experts" like me and you do.
- lstamour 10y ago
  I think people learn to follow whatever their browser does, assuming they bother to notice in the first place. I wouldn't worry as much about how to get people to notice security, browser vendors are on the right track by popping up giant notices for insecure sites and sites with malware. They just need to extend the "untrusted download" concept from operating systems to email where you could have "untrusted link" warnings in your browser instead. "Are you sure you want to visit paypal.28753272.server? You really shouldn't trust this link..."