3 ms·

If this is just a warning, that's one thing. If it becomes a solid block, it means more hassle for everyone running an intranet, and a huge liability for millio

If this is just a warning, that's one thing. If it becomes a solid block, it means more hassle for everyone running an intranet, and a huge liability for millions of long-lived devices with embedded web servers for browser-based configuration.

tjalfi 9y ago
Chrome 64 is already a hassle for intranets. It adds "Not Secure" to the address bar whenever the user enters text on an HTTP site.
protomyth 9y ago
Actually, I want a way to turn off the warning on my intranet because of all those printers, sensors, and control units on my intranet that are not going to get upgraded. I don't think I can find an HVAC or sensors with https, and I doubt anyone will authorize a 10's of thousand dollar replacement. I do not want a call anytime people have to deal with these devices and get a scary warning. Telling them to ignore it is not going to generate the right attitude when they go on the internet.
- Silhouette 9y ago
  An inappropriate warning is still counterproductive, I agree, but it's in a different league to a solid block. Not so long ago, I was dealing with the browsers vs. Java applets war, which had a similar effect on many devices as they became progressively harder and ultimately impossible to use. The attitude demonstrated by many defending those browser changes -- as if completely and permanently breaking useful, long-developed, working software on a private network was somehow a good thing -- was somewhere between smug, dismissive and arrogant, and actually quite offensive in some cases.
  - protomyth 9y ago
    Developers often wonder why people use iSeries (AS/400) machines. Well, the software is long lived and keeps working. The whole IoT is not going to go forward when the software infrastructure is sand as opposed to stone. I get the feeling if this stuff keeps up, it would be wise for some infrastructure company (e.g. Honeywell) to sponsor an OS specifically for infrastructure with some version of a remote desktop to talk to it. Obviously, web browsers are the wrong way to control long lived devices.
    - Silhouette 9y ago
      The whole IoT is not going to go forward when the software infrastructure is sand as opposed to stone. I agree with you about longevity, though I think IoT is mostly a solution in search of a problem anyway, even if the hype train is clearly going to run for a long time yet. Connectivity is obviously useful for some devices, but most of the products I have ever seen in the IoT space weren't IoT to benefit the user, they were IoT to benefit the developer, and they often made the user's experience worse. The other day I visited a friend, and he couldn't change the settings for the lights in his home because his Internet connection was playing up! Obviously, web browsers are the wrong way to control long lived devices. There, I will respectfully disagree. Web browsers are, or at least were, a useful way to access devices over well-defined and standardised protocols that were supported on many client devices. They allow UIs much more user-friendly than a command line for non-technical users, and they don't depend on native applications for each client or customised control protocols for each product. I've built many browser-based UIs for clients over the years with good results, and the only thing that has ever seriously broken them was when browsers started dropping support for useful, long-established functionality -- hence my concern in the current case.
      - protomyth 9y ago
        There, I will respectfully disagree. Web browsers are, or at least were, a useful way to access devices over well-defined and standardised protocols that were supported on many client devices. I think its the "were" part that getting me. We had a standardized protocol: http which is now being phased out and a whole lot of developers of embedded systems jumped on it as a control mechanism for their devices. Now we have this crowd of other developers that focus on a different market segment and don't really give a damn about the problems that causes for others. "Move fast and break things" is fine for startups, but not for anything that our profession built into things. I just a little sick of a disposable culture. I agree https is a great thing and needed, but putting scary warnings on http that cannot be mitigated is a pain in the butt because at some point they will remove http entirely. At this point, I honestly wish the embedded device programmers would jump off the web train and move on to something else.
  - sk5t 9y ago
    One might understand an extra-hostile stance against Java applets, having witnessed tortured attempts to keep a vendor's applet running when that applet required a very, very specific (and even then very obsolete) version of Java 1.3 incompatible with some other awful software's requirements. Breaking other, innocent software would have seemed like a pretty fantastic deal, in order to reduce future applet pain.
- jweather 9y ago
  That was my life a few years ago when Java applets switched from being the best thing since sliced bread to being anathema. Or take ActiveX for another example. Trying to do business with consumer-grade browsers is just one pain point after another.
- noway421 9y ago
  If that's really an issue, surely there's an option of putting a reverse https proxy? Definitely less then 10's of thousands dollars.
  - protomyth 9y ago
    It’s really an issue, and why am I setting up another server app to fix something that should be a switch for the administrator in software that worked before?

tjalfi 9y ago

Chrome 64 is already a hassle for intranets. It adds "Not Secure" to the address bar whenever the user enters text on an HTTP site.

protomyth 9y ago

Actually, I want a way to turn off the warning on my intranet because of all those printers, sensors, and control units on my intranet that are not going to get upgraded. I don't think I can find an HVAC or sensors with https, and I doubt anyone will authorize a 10's of thousand dollar replacement. I do not want a call anytime people have to deal with these devices and get a scary warning. Telling them to ignore it is not going to generate the right attitude when they go on the internet.

Silhouette 9y ago
An inappropriate warning is still counterproductive, I agree, but it's in a different league to a solid block. Not so long ago, I was dealing with the browsers vs. Java applets war, which had a similar effect on many devices as they became progressively harder and ultimately impossible to use. The attitude demonstrated by many defending those browser changes -- as if completely and permanently breaking useful, long-developed, working software on a private network was somehow a good thing -- was somewhere between smug, dismissive and arrogant, and actually quite offensive in some cases.
- protomyth 9y ago
  Developers often wonder why people use iSeries (AS/400) machines. Well, the software is long lived and keeps working. The whole IoT is not going to go forward when the software infrastructure is sand as opposed to stone. I get the feeling if this stuff keeps up, it would be wise for some infrastructure company (e.g. Honeywell) to sponsor an OS specifically for infrastructure with some version of a remote desktop to talk to it. Obviously, web browsers are the wrong way to control long lived devices.
  - Silhouette 9y ago
    The whole IoT is not going to go forward when the software infrastructure is sand as opposed to stone. I agree with you about longevity, though I think IoT is mostly a solution in search of a problem anyway, even if the hype train is clearly going to run for a long time yet. Connectivity is obviously useful for some devices, but most of the products I have ever seen in the IoT space weren't IoT to benefit the user, they were IoT to benefit the developer, and they often made the user's experience worse. The other day I visited a friend, and he couldn't change the settings for the lights in his home because his Internet connection was playing up! Obviously, web browsers are the wrong way to control long lived devices. There, I will respectfully disagree. Web browsers are, or at least were, a useful way to access devices over well-defined and standardised protocols that were supported on many client devices. They allow UIs much more user-friendly than a command line for non-technical users, and they don't depend on native applications for each client or customised control protocols for each product. I've built many browser-based UIs for clients over the years with good results, and the only thing that has ever seriously broken them was when browsers started dropping support for useful, long-established functionality -- hence my concern in the current case.
    - protomyth 9y ago
      There, I will respectfully disagree. Web browsers are, or at least were, a useful way to access devices over well-defined and standardised protocols that were supported on many client devices. I think its the "were" part that getting me. We had a standardized protocol: http which is now being phased out and a whole lot of developers of embedded systems jumped on it as a control mechanism for their devices. Now we have this crowd of other developers that focus on a different market segment and don't really give a damn about the problems that causes for others. "Move fast and break things" is fine for startups, but not for anything that our profession built into things. I just a little sick of a disposable culture. I agree https is a great thing and needed, but putting scary warnings on http that cannot be mitigated is a pain in the butt because at some point they will remove http entirely. At this point, I honestly wish the embedded device programmers would jump off the web train and move on to something else.
- sk5t 9y ago
  One might understand an extra-hostile stance against Java applets, having witnessed tortured attempts to keep a vendor's applet running when that applet required a very, very specific (and even then very obsolete) version of Java 1.3 incompatible with some other awful software's requirements. Breaking other, innocent software would have seemed like a pretty fantastic deal, in order to reduce future applet pain.
jweather 9y ago
That was my life a few years ago when Java applets switched from being the best thing since sliced bread to being anathema. Or take ActiveX for another example. Trying to do business with consumer-grade browsers is just one pain point after another.
noway421 9y ago
If that's really an issue, surely there's an option of putting a reverse https proxy? Definitely less then 10's of thousands dollars.
- protomyth 9y ago
  It’s really an issue, and why am I setting up another server app to fix something that should be a switch for the administrator in software that worked before?