6 ms·

People who cheer for tons of stupid fucking HTTP warnings all over the place really bug me to be honest. Anyone who uses the web needs to be taught the differen

People who cheer for tons of stupid fucking HTTP warnings all over the place really bug me to be honest. Anyone who uses the web needs to be taught the difference between a secure and insecure connection and told where to look for signs (this assumes we burn stupid shit browsers that look to mangle URL bar by removing data from it). The grandma will not make better decision if you put in another dumb warning like this one https://i.imgur.com/rxmyWtF.png https://i.imgur.com/rxmyWtF.png to waste more and more of my time when I enter my password on the same website over and over. I KNOW IT'S INSECURE, JUST STFU already. I'm at the point where I will look to build my browsers from source after removing that shit (along with removing inability to add certificate exceptions for certain situations). Good thing they're open source.

JoshMnem 9y ago
> this assumes we burn stupid shit browsers that look to mangle URL bar by removing data from it That's just about every browser now. I think that full URLs are only available in Firefox, and only if you set `browser.urlbar.trimURLs` to `false` in about:config. Hiding URL information is a very bad trend.
- briandear 9y ago
  You can show full urls in Safari if you want.
  - Miredly 9y ago
    also Opera.
  - JoshMnem 9y ago
    Safari is the worst by default. I don't have any Apple devices, but when I look at screenshots of Safari's URLs, they are not full URLs. Also, it looks like you can't show the full URLs on iPads or iPhones. (You can on Firefox for Android.) Not a full URL: example.com Not the full URL: http://example.com http://example.com (the page will load after completing the URL with a trailing slash) This is the full URL for the homepage of example.com: http://example.com/ http://example.com/
- gmueckl 9y ago
  As it is demonstrated now, the indicators work to show the http part of the URL in a way that relates some of its subtext much better to average users. Now, if it were to stay that way, I would be fine with it. But if past performance is any indicator here, this will be just the first step on that silly warnings spiral. If browser vendors aren't careful, they'll flood users with too many warnings, which makes them ignore them entirely.
  - SquareWheel 9y ago
    >If browser vendors aren't careful But they are being careful. This rollout has been taking place slowly over the last two years, and continues to do so. Changes are incremental to give developers a chance to adapt, and to prevent users from getting used to warnings. HTTP/2 requires https. New APIs have started requiring https. And only forms with passwords or CC inputs will trigger security warnings. These are incremental steps. I don't know why people think browser vendors haven't considered this stuff before. Eventually vendors will start deprecating existing APIs to continue the migration towards requiring https. That will put more heat on developers, but only after they've ignored warnings for literal years. But even the change announced today is only a UI update to the omnibar. It's hardly earth shattering.
    - gmueckl 9y ago
      Browser vendors are clearly not careful enough. Requiring SSL brings with it a kind of baggage that is ill-suited for tons of use cases. Do not simply assume that all developers ignored these signs out of laziness. They might instead be unable to comply in a useful fashion. HTTP worked unchanged for close to 3 decades. People started to rely on that. Now they are trying apply crowbars to force that out. This is myopic.
    - deleted 9y ago
      [deleted]
jchw 9y ago
I don't get how so many people miss the point here, but alas. It's actually not so complicated: obviously, there's nothing actionable for the user to do here. The message is for the user, but only indirectly: it's there to push developers into better practices. Your boss may not care about encryption or privacy, but definitely will care about hundreds of phone calls asking why they are warned that the form is insecure when they try to login. With plenty of obscure pages accepting everything from passwords to credit card numbers on plain HTTP pages, this is important. There may not be someone browsing the page knowledgeable enough to catch this, but if any end user can know what they're doing is wrong, then it's much more likely it will be discovered. While mostly not actionable directly for users, one thing a user can, and probably should, do is close the page, if they can.
- CamperBob2 9y ago
  It's actually not so complicated: obviously, there's nothing actionable for the user to do here. The message is for the user, but only indirectly: it's there to push developers into better practices So it's the online equivalent of plastering Warning: Contains chemicals known to the state of California to cause cancer all over everything from gas pumps to gerbils. Yeah. Real useful.
  - jchw 9y ago
    Except it works. If it makes you mad, imagine how many other people it makes angry. And aside from recompiling your browser, all you can do is fix the problem and make the browsers happy.
    - CamperBob2 9y ago
      Except it works. No, it doesn't, unless your goal is to condition users to ignore yet another warning. There are downsides to doing that, believe it or not.
      - jchw 9y ago
        Frankly, if they could just drop plain HTTP support altogether, I'd prefer that. This is more of a friendly compromise.

JoshMnem 9y ago

> this assumes we burn stupid shit browsers that look to mangle URL bar by removing data from it That's just about every browser now. I think that full URLs are only available in Firefox, and only if you set `browser.urlbar.trimURLs` to `false` in about:config. Hiding URL information is a very bad trend.

briandear 9y ago
You can show full urls in Safari if you want.
- Miredly 9y ago
  also Opera.
- JoshMnem 9y ago
  Safari is the worst by default. I don't have any Apple devices, but when I look at screenshots of Safari's URLs, they are not full URLs. Also, it looks like you can't show the full URLs on iPads or iPhones. (You can on Firefox for Android.) Not a full URL: example.com Not the full URL: http://example.com http://example.com (the page will load after completing the URL with a trailing slash) This is the full URL for the homepage of example.com: http://example.com/ http://example.com/
gmueckl 9y ago
As it is demonstrated now, the indicators work to show the http part of the URL in a way that relates some of its subtext much better to average users. Now, if it were to stay that way, I would be fine with it. But if past performance is any indicator here, this will be just the first step on that silly warnings spiral. If browser vendors aren't careful, they'll flood users with too many warnings, which makes them ignore them entirely.
- SquareWheel 9y ago
  >If browser vendors aren't careful But they are being careful. This rollout has been taking place slowly over the last two years, and continues to do so. Changes are incremental to give developers a chance to adapt, and to prevent users from getting used to warnings. HTTP/2 requires https. New APIs have started requiring https. And only forms with passwords or CC inputs will trigger security warnings. These are incremental steps. I don't know why people think browser vendors haven't considered this stuff before. Eventually vendors will start deprecating existing APIs to continue the migration towards requiring https. That will put more heat on developers, but only after they've ignored warnings for literal years. But even the change announced today is only a UI update to the omnibar. It's hardly earth shattering.
  - gmueckl 9y ago
    Browser vendors are clearly not careful enough. Requiring SSL brings with it a kind of baggage that is ill-suited for tons of use cases. Do not simply assume that all developers ignored these signs out of laziness. They might instead be unable to comply in a useful fashion. HTTP worked unchanged for close to 3 decades. People started to rely on that. Now they are trying apply crowbars to force that out. This is myopic.
  - deleted 9y ago
    [deleted]

jchw 9y ago

I don't get how so many people miss the point here, but alas. It's actually not so complicated: obviously, there's nothing actionable for the user to do here. The message is for the user, but only indirectly: it's there to push developers into better practices. Your boss may not care about encryption or privacy, but definitely will care about hundreds of phone calls asking why they are warned that the form is insecure when they try to login. With plenty of obscure pages accepting everything from passwords to credit card numbers on plain HTTP pages, this is important. There may not be someone browsing the page knowledgeable enough to catch this, but if any end user can know what they're doing is wrong, then it's much more likely it will be discovered. While mostly not actionable directly for users, one thing a user can, and probably should, do is close the page, if they can.

CamperBob2 9y ago
It's actually not so complicated: obviously, there's nothing actionable for the user to do here. The message is for the user, but only indirectly: it's there to push developers into better practices So it's the online equivalent of plastering Warning: Contains chemicals known to the state of California to cause cancer all over everything from gas pumps to gerbils. Yeah. Real useful.
- jchw 9y ago
  Except it works. If it makes you mad, imagine how many other people it makes angry. And aside from recompiling your browser, all you can do is fix the problem and make the browsers happy.
  - CamperBob2 9y ago
    Except it works. No, it doesn't, unless your goal is to condition users to ignore yet another warning. There are downsides to doing that, believe it or not.
    - jchw 9y ago
      Frankly, if they could just drop plain HTTP support altogether, I'd prefer that. This is more of a friendly compromise.