7 ms·

These are not solved by progressive enhancement but by SSL.

by allendoerfer 10y ago

pmlnr 10y ago
How exactly SSL will solve this when there is a middleman proxy?
- allendoerfer 10y ago
  It is the whole point of SSL that there are not any.
  - robin_reala 10y ago
    My last point about the user’s country linked to the example of Kazakhstan, where all HTTPS traffic is blocked unless you install a government-supplied middleman cert.
    - pjc50 10y ago
      And here's a good example of one hand giving while the other takes away; other parts of the UK government are quite cozy with Kazakhstan. We probably sold them the HTTPS interception solution.
  - NoGravitas 10y ago
    Unfortunately, most employers and many countries violate this expectation. I expect businesses providing wifi to customers to start doing this, too.
    - madeofpalk 10y ago
      I don't know about 'most' employers - so far I haven't worked for one that has. But I'm sure there are many that do.
  - zeveb 10y ago
    > It is the whole point of SSL that there are not any [middleman proxies]. Hahahahahaha, you should do stand-up! In my more cynical moments, I wonder if the whole point of SSL is to obscure when middleman proxies are in use. Seriously, examine your browser's trusted CA list. Do you really trust every single one of those CAs to vouch for any website in the world?
    - CJefferson 10y ago
      If someone has got a CA to produce a fake certificate for your website, you have more serious things to worry about that progressive enhancement!
asib 10y ago
The author doesn't say that they are, he's simply listing reasons that a user may have JS disabled, and hence why it's a good idea to employ progressive enhancement, so that such users are not entirely locked out of using your app.
- allendoerfer 10y ago
  If you want to tackle these specific reasons, just serve the site via SSL. Other reasons for progressive enhancements might still persist, but the listed cause bigger troubles than "JavaScript does not work correctly" and SSL is a complete solution to all of them.
  - richmarr 10y ago
    You're conflating user and service designer here. The user has a problem (including but not limited to those listed) and so turns off JS. The service then has the problem that JS is disabled... no amount of SSL will help if your pages require JS to load. Edit to clarify: The user turning off JS and using the service are likely to happen at entirely different times. If you browse with JS turned off, it's likely off by default and only enabled when needed (if at all).
    - lmm 10y ago
      How many users actually disable JS for these (or any other) reasons? Might it be cheaper to e.g. have a call center that trained to use the website on behalf of such users, rather than increasing the development costs of every government site?
      - robin_reala 10y ago
        Last time we checked we get ~180k visits a month from people who specifically disable JS, ~810k further visits a month from people who don’t have JS available. So no, it’d be more expensive to have a call centre.
      - asib 10y ago
neximo64 10y ago
Not everywhere, sometimes organisations such as the university i'm in make you install a certificate to access the network. SSL is supposed to work a certain way, in practice it doesn't always work that way.
zeveb 10y ago
SSL won't do any good against a nation-state with a CA key, so it won't do any good against JavaScript injection by such a state.
aarongustafson 10y ago
You mean this SSL? http://www.symantec.com/connect/blogs/gogo-inflight-internet-intentionally-issuing-fake-ssl-certificates http://www.symantec.com/connect/blogs/gogo-inflight-internet...

These are not solved by progressive enhancement but by SSL.

pmlnr 10y ago

How exactly SSL will solve this when there is a middleman proxy?

allendoerfer 10y ago
It is the whole point of SSL that there are not any.
- robin_reala 10y ago
  My last point about the user’s country linked to the example of Kazakhstan, where all HTTPS traffic is blocked unless you install a government-supplied middleman cert.
  - pjc50 10y ago
    And here's a good example of one hand giving while the other takes away; other parts of the UK government are quite cozy with Kazakhstan. We probably sold them the HTTPS interception solution.
- NoGravitas 10y ago
  Unfortunately, most employers and many countries violate this expectation. I expect businesses providing wifi to customers to start doing this, too.
  - madeofpalk 10y ago
    I don't know about 'most' employers - so far I haven't worked for one that has. But I'm sure there are many that do.
- zeveb 10y ago
  > It is the whole point of SSL that there are not any [middleman proxies]. Hahahahahaha, you should do stand-up! In my more cynical moments, I wonder if the whole point of SSL is to obscure when middleman proxies are in use. Seriously, examine your browser's trusted CA list. Do you really trust every single one of those CAs to vouch for any website in the world?
  - CJefferson 10y ago
    If someone has got a CA to produce a fake certificate for your website, you have more serious things to worry about that progressive enhancement!

asib 10y ago

The author doesn't say that they are, he's simply listing reasons that a user may have JS disabled, and hence why it's a good idea to employ progressive enhancement, so that such users are not entirely locked out of using your app.

allendoerfer 10y ago
If you want to tackle these specific reasons, just serve the site via SSL. Other reasons for progressive enhancements might still persist, but the listed cause bigger troubles than "JavaScript does not work correctly" and SSL is a complete solution to all of them.
- richmarr 10y ago
  You're conflating user and service designer here. The user has a problem (including but not limited to those listed) and so turns off JS. The service then has the problem that JS is disabled... no amount of SSL will help if your pages require JS to load. Edit to clarify: The user turning off JS and using the service are likely to happen at entirely different times. If you browse with JS turned off, it's likely off by default and only enabled when needed (if at all).
  - lmm 10y ago
    How many users actually disable JS for these (or any other) reasons? Might it be cheaper to e.g. have a call center that trained to use the website on behalf of such users, rather than increasing the development costs of every government site?
    - robin_reala 10y ago
      Last time we checked we get ~180k visits a month from people who specifically disable JS, ~810k further visits a month from people who don’t have JS available. So no, it’d be more expensive to have a call centre.
    - asib 10y ago

neximo64 10y ago

Not everywhere, sometimes organisations such as the university i'm in make you install a certificate to access the network. SSL is supposed to work a certain way, in practice it doesn't always work that way.

zeveb 10y ago

SSL won't do any good against a nation-state with a CA key, so it won't do any good against JavaScript injection by such a state.

aarongustafson 10y ago

You mean this SSL? http://www.symantec.com/connect/blogs/gogo-inflight-internet-intentionally-issuing-fake-ssl-certificates http://www.symantec.com/connect/blogs/gogo-inflight-internet...