6 ms·

You have javascript disabled. I do not. I happen to use plenty of sites that require javascript, with HN being one of them. Most of the users out there do not h

by yzmtf2008 9y ago

You have javascript disabled. I do not. I happen to use plenty of sites that require javascript, with HN being one of them. Most of the users out there do not have javascript disabled either. How do you account for their security? > and I'm sure if your car's GPS indicated locations with high crime rates as "not safe" and prevented you from going there, there would be much outrage. This is just a warning though, no one is preventing you from "going there", it's merely a warning that it might not be safe. Your analogy is more similar to "there's a slow down on that road, let me navigate you somewhere else, but feel free to go there if you want". You have exactly the same amount of freedom. How exactly is using HTTPS "gain control over the masses"? Google does not control the HTTPS infrastructure. It's not like those sites are gone either. There's always archive.org.

zerostar07 9y ago
the gps could also be just a warning. same effect also we know how these things go. first a warning, then a ban, then extinction from history
- yzmtf2008 9y ago
  Let's not start the whole slippery slope logic, please.
  - zerostar07 9y ago
    didn't that happen with whatever technology google deemed unfit for the batteries of their phones, like Flash for example?`
    - gowld 9y ago
      Flash was a proprietary non-mobile-friendly technology from the start until its demise at the hands of its creators. No heavy-handed dictatorship, just bad products dying, and products that unfortunately depended on them died along with them. http://blogs.adobe.com/flashplayer/2012/06/flash-player-and-android-update.html#sthash.X0uGKiDQ.tb6utxIW.dpbs http://blogs.adobe.com/flashplayer/2012/06/flash-player-and-...
ori_b 9y ago
> I happen to use plenty of sites that require javascript, with HN being one of them. HN works just fine without Javascript. The only thing that doesn't work is collapsing comment threads.
- yzmtf2008 9y ago
  And I consider that one of the greatest things to happen to HN.
  - ori_b 9y ago
    It's a bit nice, but not nice enough to convince me to enable Javascript.
- app4soft 9y ago
  > HN works just fine without Javascript. Confirmed by me[0] using HN throw Links2, screenshot[1] attached ;-) > The only thing that doesn't work is collapsing comment threads. Voting on comments also not work without JavaScript on HN, but in same time voting on threads work without JS. [0] https://news.ycombinator.com/item?id=16191843 https://news.ycombinator.com/item?id=16191843 [1] http://www.hnng.moe/f/ZZJ http://www.hnng.moe/f/ZZJ
- avhon1 9y ago
  Hacker News's search feature requires javascript.
nbadg 9y ago
The irony of (mis)quoting "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety" in the same breath as saying "And I have JS off by default" is definitely worth pointing out here
- xg15 9y ago
  How is preventing sites to run arbitrary code on your machine giving up essential liberty?
  - Ethcad 9y ago
    Right back at you. How is buying an iPhone over an Android giving up essential liberty? I always have the right to sell it, go to the store, and buy a device that lets me do whatever I want.
  - userbinator 9y ago
    Indeed. I, the user, get to choose whether to allow JS or not. Now consider that things like Meltdown and Spectre have JavaScript PoCs If this was instead 'Chrome 68 will mark all JS-using sites as "not secure"', I wouldn't want that warning either, but then I'd be in agreement with the majority...
  - Avamander 9y ago
    I am free to run it to get it's benefits and it's downsides, limiting me for the sake of security isn't okay.
xg15 9y ago
Except browsers today are continuously developed, often with larger strategies in mind. Google has stated very openly that their ideal state is a world where there is no insecure HTTP at all and they intend to move everything as close as possible to that state. To reach this, the browser behavior is slowly tightened over a long number of releases. So a better analogy would be a carmaker announcing that they don't want people to drive to unsafe areas. They'll monitor people's driving behavior via telemetry and OTA-update the car's software accordingly to nudge people's behavior closer to that goal. So the warning would probably be the first step. Driving to unsafe areas will still be technically possible but it will become progressively more cumbersome until you just give up.
ajnin 9y ago
I think that imposing decisions on others for their own good is a dangerous path to take. You stop considering them as adults capable of taking rational decisions but as children that need ot be shown the light, by employing authority and force if necessary. The enlightened technological elite thinks that HTTPS is better so they have decided to impose that decision on everyone else. It should always be a choice. If something is insecure, show a warning, in big red bold letters if you have to, but allow the freedom of choice to the end-user. But here, what do we have ? Many newer Javascript, HTML or HTTP features are restricted to HTTPS. Even things like Brotli stream compression which bear no security implications. This is done only to coerce people to use HTTPS.

zerostar07 9y ago

the gps could also be just a warning. same effect also we know how these things go. first a warning, then a ban, then extinction from history

yzmtf2008 9y ago
Let's not start the whole slippery slope logic, please.
- zerostar07 9y ago
  didn't that happen with whatever technology google deemed unfit for the batteries of their phones, like Flash for example?`
  - gowld 9y ago
    Flash was a proprietary non-mobile-friendly technology from the start until its demise at the hands of its creators. No heavy-handed dictatorship, just bad products dying, and products that unfortunately depended on them died along with them. http://blogs.adobe.com/flashplayer/2012/06/flash-player-and-android-update.html#sthash.X0uGKiDQ.tb6utxIW.dpbs http://blogs.adobe.com/flashplayer/2012/06/flash-player-and-...

ori_b 9y ago

> I happen to use plenty of sites that require javascript, with HN being one of them. HN works just fine without Javascript. The only thing that doesn't work is collapsing comment threads.

yzmtf2008 9y ago
And I consider that one of the greatest things to happen to HN.
- ori_b 9y ago
  It's a bit nice, but not nice enough to convince me to enable Javascript.
app4soft 9y ago
> HN works just fine without Javascript. Confirmed by me[0] using HN throw Links2, screenshot[1] attached ;-) > The only thing that doesn't work is collapsing comment threads. Voting on comments also not work without JavaScript on HN, but in same time voting on threads work without JS. [0] https://news.ycombinator.com/item?id=16191843 https://news.ycombinator.com/item?id=16191843 [1] http://www.hnng.moe/f/ZZJ http://www.hnng.moe/f/ZZJ
avhon1 9y ago
Hacker News's search feature requires javascript.

nbadg 9y ago

The irony of (mis)quoting "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety" in the same breath as saying "And I have JS off by default" is definitely worth pointing out here

xg15 9y ago
How is preventing sites to run arbitrary code on your machine giving up essential liberty?
- Ethcad 9y ago
  Right back at you. How is buying an iPhone over an Android giving up essential liberty? I always have the right to sell it, go to the store, and buy a device that lets me do whatever I want.
- userbinator 9y ago
  Indeed. I, the user, get to choose whether to allow JS or not. Now consider that things like Meltdown and Spectre have JavaScript PoCs If this was instead 'Chrome 68 will mark all JS-using sites as "not secure"', I wouldn't want that warning either, but then I'd be in agreement with the majority...
- Avamander 9y ago
  I am free to run it to get it's benefits and it's downsides, limiting me for the sake of security isn't okay.

xg15 9y ago

Except browsers today are continuously developed, often with larger strategies in mind. Google has stated very openly that their ideal state is a world where there is no insecure HTTP at all and they intend to move everything as close as possible to that state. To reach this, the browser behavior is slowly tightened over a long number of releases. So a better analogy would be a carmaker announcing that they don't want people to drive to unsafe areas. They'll monitor people's driving behavior via telemetry and OTA-update the car's software accordingly to nudge people's behavior closer to that goal. So the warning would probably be the first step. Driving to unsafe areas will still be technically possible but it will become progressively more cumbersome until you just give up.

ajnin 9y ago

I think that imposing decisions on others for their own good is a dangerous path to take. You stop considering them as adults capable of taking rational decisions but as children that need ot be shown the light, by employing authority and force if necessary. The enlightened technological elite thinks that HTTPS is better so they have decided to impose that decision on everyone else. It should always be a choice. If something is insecure, show a warning, in big red bold letters if you have to, but allow the freedom of choice to the end-user. But here, what do we have ? Many newer Javascript, HTML or HTTP features are restricted to HTTPS. Even things like Brotli stream compression which bear no security implications. This is done only to coerce people to use HTTPS.