7 ms·

This is exactly what I said would happen when Google started making all of us use HTTPS.

by 06983234 8y ago

detaro 8y ago
What is "this"?
- 06983234 8y ago
  Being wiped from the internet by a disagreeable CA authority. If that is what "this" is.
  - middleclick 8y ago
    FWIW, onion addresses don't require a cert, they are end-to-end encrypted by design.
    - mynameisvlad 8y ago
      Technically, nothing requires a cert. It's just best practice to have one.
  - matthewmacleod 8y ago
    That is not what "this" is.
    - codedokode 8y ago
      The grandparent comment is right. I am not going to mess with default browser settings, and almost nobody is.
  - MikkoFinell 8y ago
    http://sci-hub.tw/ http://sci-hub.tw/ is reachable no problem. Cut down on the hyperbole please.
- AnIdiotOnTheNet 8y ago
  Likely they mean censorship via certificate revocation, which it isn't clear yet that this is, but they have a valid point. If you put control over your trust in a third party, you give them the power to do this kind of thing.
  - tscs37 8y ago
    You can always manually trust certificates via various means, it's the basis for almost any corporate network, most browsers also offer a simply dialog to bypass certificate warnings.
    - detaro 8y ago
      You can also just use HTTP, since sci-hub doesn't force HTTPS.
    - 0x00000000 8y ago
      Browsers seem to be moving towards making it harder to bypass, which is probably a good thing for the average user. I wouldn't be surprised to see the ability to ignore https errors (or access http sites at all) locked behind a developer setting or something.
      - tscs37 8y ago
        On Chrome I can see that but I doubt Firefox would make that move. Plus, they won't remove the functionality to manually trust a cert (Business Users would complain).
        Sir_Substance 8y ago
        > On Chrome I can see that but I doubt Firefox would make that move. Firefox has implemented the same rules around .dev tld's as google. I use vivaldi when accessing internal company .dev domains because firefox won't let me tell it to accept the self-signed certificate.
googledystopia 8y ago
Oh, look. Google as the absolute arbiter of information. Who could've ever predicted that they'd start using their position for evil?
- detaro 8y ago
  How exactly do you see Google doing anything here, outside of a general "they encourage HTTPS" (but the site still works fine over HTTP)?
userbinator 8y ago
You're not the only one. I hypothesised about this before in previous SciHub discussions, and SciHub isn't the only site that is/will be affected. Security is the ostensible benefit, and it's the one they advertise the most; easier censorship and centralised access control is the other---something which a lot of the pro-(traditional)-HTTPS advocates don't advertise. Make HTTPS mandatory (so no more HTTP), make it near impossible to bypass in browsers, and you have created a very effective censorship system controlled by the CAs and whatever interests they serve. Slowly ostracising and forcing "compliance" of those who don't toe the line is easier than before. They want you to be obedient sheep, living in an illusion of security and safety while continuing to mindlessly consume under their control. I will resist the urge to post that memorable Franklin quote.
- x0x0 8y ago
  Let's not pretend the real reason google isn't so gung-ho about https everywhere is to prevent the ISPs from muscling into their businesses: * ads on page * seeing all internet traffic to enhance targeting
  - dagenix 8y ago
    You make it sound like this is a bad thing. Regardless of if it also benefits Google's business model, both of these things benefit users and website owners. The only thing that benefits from injecting ads into a page or deeper ISP tracking is some ISP executive's bonus.
    - dagenix 8y ago
      Challenge: Next person that downvotes me, also leave a comment explaining why.
- saagarjha 8y ago
  But then you have the other issue of your ISP having the ability to meddle with what it's sending you and silently injecting or removing content from the page. Really, I don't see a great solution either way.

This is exactly what I said would happen when Google started making all of us use HTTPS.

detaro 8y ago

What is "this"?

06983234 8y ago
Being wiped from the internet by a disagreeable CA authority. If that is what "this" is.
- middleclick 8y ago
  FWIW, onion addresses don't require a cert, they are end-to-end encrypted by design.
  - mynameisvlad 8y ago
    Technically, nothing requires a cert. It's just best practice to have one.
- matthewmacleod 8y ago
  That is not what "this" is.
  - codedokode 8y ago
    The grandparent comment is right. I am not going to mess with default browser settings, and almost nobody is.
- MikkoFinell 8y ago
  http://sci-hub.tw/ http://sci-hub.tw/ is reachable no problem. Cut down on the hyperbole please.
AnIdiotOnTheNet 8y ago
Likely they mean censorship via certificate revocation, which it isn't clear yet that this is, but they have a valid point. If you put control over your trust in a third party, you give them the power to do this kind of thing.
- tscs37 8y ago
  You can always manually trust certificates via various means, it's the basis for almost any corporate network, most browsers also offer a simply dialog to bypass certificate warnings.
  - detaro 8y ago
    You can also just use HTTP, since sci-hub doesn't force HTTPS.
  - 0x00000000 8y ago
    Browsers seem to be moving towards making it harder to bypass, which is probably a good thing for the average user. I wouldn't be surprised to see the ability to ignore https errors (or access http sites at all) locked behind a developer setting or something.
    - tscs37 8y ago
      On Chrome I can see that but I doubt Firefox would make that move. Plus, they won't remove the functionality to manually trust a cert (Business Users would complain).
      - Sir_Substance 8y ago
        > On Chrome I can see that but I doubt Firefox would make that move. Firefox has implemented the same rules around .dev tld's as google. I use vivaldi when accessing internal company .dev domains because firefox won't let me tell it to accept the self-signed certificate.

googledystopia 8y ago

Oh, look. Google as the absolute arbiter of information. Who could've ever predicted that they'd start using their position for evil?

detaro 8y ago
How exactly do you see Google doing anything here, outside of a general "they encourage HTTPS" (but the site still works fine over HTTP)?

userbinator 8y ago

You're not the only one. I hypothesised about this before in previous SciHub discussions, and SciHub isn't the only site that is/will be affected. Security is the ostensible benefit, and it's the one they advertise the most; easier censorship and centralised access control is the other---something which a lot of the pro-(traditional)-HTTPS advocates don't advertise. Make HTTPS mandatory (so no more HTTP), make it near impossible to bypass in browsers, and you have created a very effective censorship system controlled by the CAs and whatever interests they serve. Slowly ostracising and forcing "compliance" of those who don't toe the line is easier than before. They want you to be obedient sheep, living in an illusion of security and safety while continuing to mindlessly consume under their control. I will resist the urge to post that memorable Franklin quote.

x0x0 8y ago
Let's not pretend the real reason google isn't so gung-ho about https everywhere is to prevent the ISPs from muscling into their businesses: * ads on page * seeing all internet traffic to enhance targeting
- dagenix 8y ago
  You make it sound like this is a bad thing. Regardless of if it also benefits Google's business model, both of these things benefit users and website owners. The only thing that benefits from injecting ads into a page or deeper ISP tracking is some ISP executive's bonus.
  - dagenix 8y ago
    Challenge: Next person that downvotes me, also leave a comment explaining why.
saagarjha 8y ago
But then you have the other issue of your ISP having the ability to meddle with what it's sending you and silently injecting or removing content from the page. Really, I don't see a great solution either way.