But the the user is more often than not, not under attack. Think back to the last ten or so security warnings you go while browsing the internet. How many of t

But the the user is more often than not, not under attack. Think back to the last ten or so security warnings you go while browsing the internet. How many of them were a result of a pretty blatant configuration error? Things like self signed certs on personal/toy sites, T+1d expiration, subdomains using the main domain's cert (or vice versa), bad local clock, things like that that? How many of them were ambiguous? How many of them were unmistakably fishy? If your breakdown is anything like mine, it'll be 9/1/0. I speak of intent because the original person I replied to suggested that security warnings should not be dismissable. I vehemently disagree, because it is my decision to make whether accessing the information I clicked on is more or less important than the risks for the particular class of cert problem that presented itself. Hide it behind an about:config variable or explicit cert trusting or something else, I don't care. That is still superior to telling me that I can't access something for my own protection.