6 ms·

People are going to dismiss Dave Winer as a crank right up until the day they or one of the things on which they rely get "googled," and then they will wish the

People are going to dismiss Dave Winer as a crank right up until the day they or one of the things on which they rely get "googled," and then they will wish they'd listened sooner. Google's power over the web today, already, is not healthy. There are a lot of people within Google who care deeply about the free and open web, and a lot of people who don't, or who define "free" or "open" in ways that involving trusting a for-profit corporation more than anybody wise ever should. Many people get upset when they see Google being attacked, because the part of Google they depend on is a part that really supports the free and open web, or because they themselves don't value the freeness and openness as much as they should. Google delivers a lot of value right now, and without people pushing back, hard, that value will enable them to get away with anything. Anybody who has been around long enough ought to understand that power you grant to someone you trust inevitably ends up in the hands of someone you don't. Political parties switch back and forth, CEOs and corporate priorities come and go. Sometimes it's best to accept an option that is second-best today in order to avoid giving too much power to the organization providing the first-best for them to misuse tomorrow.

fredgrott 8y ago
BUT, Google does not have exactly ultimate power hat DW implies..ever here of Facebook? how about other content social players?
dnomad 8y ago
> Google delivers a lot of value right now, and without people pushing back, hard, that value will enable them to get away with anything. So the more Google does for the web the more dangerous they become. Should Google then start fighting the open web? Would that make the web... better?
quanticle 8y ago
I agree that Google has far too much control over the web. However, this is a silly reason to argue against HTTPS. HTTPS is an open standard. Google doesn't control it. HTTPS doesn't require anyone to use any Google product. You can use HTTPS just fine by getting your certificates from LetsEncrypt and browsing with Mozilla Firefox. Or Microsoft Edge. Or Internet Explorer. Moreover, the security guarantees that HTTPS brings to the web benefit everyone, not just Google. More generally, Dave Winer seems to have an attitude of reflexively opposing everything that Google advocates, merely because it is Google that is advocating for it. It reminds me of the late 90's and early 2000's when open-source people talked about "M$" and reflexively opposed everything that Microsoft did merely because it was Microsoft that was doing it, leaving aside technical merits or other considerations. Corporations are neither pure good, nor pure evil. They are collections of people with collective interests that they pursue. Sometimes, like in the case of HTTPS, or net neutrality, those interests align with our interests as developers and users. In those cases, we should ally ourselves with corporations and use their leverage to effect change more quickly. In other cases, such as with RSS, and vendor lock-in, our interests diverge and we should oppose them with all our might so that we don't lose the free and open Internet that we've become accustomed to. In both cases, however, we should examine the issue on the merits of that issue, and neither support nor oppose merely because the "right" or "wrong" organization is pushing for it.
- amanzi 8y ago
  > HTTPS is an open standard. Google doesn't control it. HTTPS doesn't require anyone to use any Google product. The problem is that Google controls the most popular interfaces to consuming HTTP and HTTPS, i.e. their Chrome browser and their search engine. And so Google is in a position where they control how these protocols are consumed, which is the crux of Dave's argument. Google is already discouraging the use of HTTP through warning messages in Chrome and by adjusting search rank algorithms for HTTP sites. Dave's concern is that Google will "turn off" HTTP access in the same way they did with RSS after capturing the market share for consuming RSS feeds and then shutting down Google Reader and removing discoverabilty of RSS feeds in Chrome. Dave Winer has been around the Web for longer than most and you'd be foolish to write him off as a curmudgeon. Dave is to the open Web what RMS is to FOSS.
  - pwinnski 8y ago
    > Dave is to the open Web what RMS is to FOSS. This is a great analogy!
    - davewiner 8y ago
      Thank you, that's a very nice thing to say. Over the years I've come to respect Stallman's way of viewing things more and more. The open web is worth fighting for. And Google is moving into new territory now, by deciding to force sites to switch to HTTPS. Most of the arguments you hear are about new sites, but people are missing that the web has been used for 25 years as an archiving medium. If you want to save something so it's available for others (and yourself too) in the future, put it on the web. It's been incredibly stable platform, far more so than the ones run by the tech industry, and precisely because it isn't run by the tech industry. That's about to change. Read the original post. Today's post is just a continuation of that one. http://this.how/googleAndHttp/ http://this.how/googleAndHttp/ And be a little more kind to Stallman. :-) Dave
      - derf_ 8y ago
        With all due respect, I read the original post, and it does not seem terribly compelling to me. > Something bad could happen to my pages in transit from a server to the user's web browser. This already happens. Verizon injects tracking cookies into unencrypted requests [1]. Hotels inject advertising on top of the existing advertising [personal experience]. They will do it when I read your blog archive from 2001. They will inject arbitrary JavaScript that records my every keystroke and mouse movement [2]. State actors will use persistent surveillance of all unencrypted cookies to pierce firewalls and target individual engineers in charge of anything they happen to find useful [3]. They will do worse things as compute becomes cheaper and cheaper. If your argument is that there are lots of HTTP sites that are historically important and also that are unmaintained and that will never be upgraded, okay. That is a solvable technical problem [4]. If you want to know why you have to force people to do it, it is because security is a public health issue [5]. It is the same reason you have to force people to get vaccinations. I don't work for Google (in fact I work for a direct competitor), and I disagree with a lot of the things that they do or want to do (unsurprisingly). But having more security on the web is not one of them. We live in a very different world than we did 25-plus years ago. [1] https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh [2] https://www.wired.com/story/the-dark-side-of-replay-sessions-that-record-your-every-move-online/ https://www.wired.com/story/the-dark-side-of-replay-sessions... [3] https://theintercept.com/2014/12/13/belgacom-hack-gchq-inside-story/ https://theintercept.com/2014/12/13/belgacom-hack-gchq-insid... (search for MUTANT BROTH) [4] https://archive.org/ https://archive.org/ [5] https://www.schneier.com/blog/archives/2014/03/security_as_a_p.html https://www.schneier.com/blog/archives/2014/03/security_as_a...
jasonmp85 8y ago
> People are going to dismiss Dave Winer as a crank […] Maybe he shouldn't have launched an incomprehensible crusade against widespread SSL deployment in a post-Snowden world?
- chipotle_coyote 8y ago
  SSL is terrific for things that need to be secured, but there are a lot of web sites out there -- an arguably increasing number given the rise in popularity of static site generators -- that derive absolutely no benefit from being served as HTTPS rather than plain HTTP. Not "modest" benefit, not even "negligible" benefit, but no benefit. I've built relatively large sites that are entirely archives. They have no logins. They have no forms. I am not sure why it's "incomprehensible" to you that I'm less than thrilled that Google has decided I'd damn well better make sure my publicly accessible, 100% static, entirely form-free web site is served only over SSL. I'd describe Dave Winer as more of an iconoclast than a crank, from what I've seen. But his point is that an awful lot of the Web As It Exists is unsecured, particularly the older personal pages and sites that are still hanging on, and that if Google decides that Chrome will simply no longer browse to unsecured web sites -- or worse, that their search engine won't just deprioritize but will delist unsecured sites -- a lot of the web will be effectively lost.
  - level3 8y ago
    HTTPS is not just about preventing eavesdropping of private data; it is also about preventing MITM and data tampering. I agree that from your perspective, you might see no benefit, but the HTTPS push is primarily for the users (and as a result, the web at large).
  - chowell 8y ago
    Do you drop tracking cookies or scripts that fingerprint the users visiting your site? No? Well by resisting the push to TLS, you're allowing ISPs and who knows who else to inject that content into the sessions of your users.
  - deleted 8y ago
    [deleted]

fredgrott 8y ago

BUT, Google does not have exactly ultimate power hat DW implies..ever here of Facebook? how about other content social players?

dnomad 8y ago

> Google delivers a lot of value right now, and without people pushing back, hard, that value will enable them to get away with anything. So the more Google does for the web the more dangerous they become. Should Google then start fighting the open web? Would that make the web... better?

quanticle 8y ago

I agree that Google has far too much control over the web. However, this is a silly reason to argue against HTTPS. HTTPS is an open standard. Google doesn't control it. HTTPS doesn't require anyone to use any Google product. You can use HTTPS just fine by getting your certificates from LetsEncrypt and browsing with Mozilla Firefox. Or Microsoft Edge. Or Internet Explorer. Moreover, the security guarantees that HTTPS brings to the web benefit everyone, not just Google. More generally, Dave Winer seems to have an attitude of reflexively opposing everything that Google advocates, merely because it is Google that is advocating for it. It reminds me of the late 90's and early 2000's when open-source people talked about "M$" and reflexively opposed everything that Microsoft did merely because it was Microsoft that was doing it, leaving aside technical merits or other considerations. Corporations are neither pure good, nor pure evil. They are collections of people with collective interests that they pursue. Sometimes, like in the case of HTTPS, or net neutrality, those interests align with our interests as developers and users. In those cases, we should ally ourselves with corporations and use their leverage to effect change more quickly. In other cases, such as with RSS, and vendor lock-in, our interests diverge and we should oppose them with all our might so that we don't lose the free and open Internet that we've become accustomed to. In both cases, however, we should examine the issue on the merits of that issue, and neither support nor oppose merely because the "right" or "wrong" organization is pushing for it.

amanzi 8y ago
> HTTPS is an open standard. Google doesn't control it. HTTPS doesn't require anyone to use any Google product. The problem is that Google controls the most popular interfaces to consuming HTTP and HTTPS, i.e. their Chrome browser and their search engine. And so Google is in a position where they control how these protocols are consumed, which is the crux of Dave's argument. Google is already discouraging the use of HTTP through warning messages in Chrome and by adjusting search rank algorithms for HTTP sites. Dave's concern is that Google will "turn off" HTTP access in the same way they did with RSS after capturing the market share for consuming RSS feeds and then shutting down Google Reader and removing discoverabilty of RSS feeds in Chrome. Dave Winer has been around the Web for longer than most and you'd be foolish to write him off as a curmudgeon. Dave is to the open Web what RMS is to FOSS.
- pwinnski 8y ago
  > Dave is to the open Web what RMS is to FOSS. This is a great analogy!
  - davewiner 8y ago
    Thank you, that's a very nice thing to say. Over the years I've come to respect Stallman's way of viewing things more and more. The open web is worth fighting for. And Google is moving into new territory now, by deciding to force sites to switch to HTTPS. Most of the arguments you hear are about new sites, but people are missing that the web has been used for 25 years as an archiving medium. If you want to save something so it's available for others (and yourself too) in the future, put it on the web. It's been incredibly stable platform, far more so than the ones run by the tech industry, and precisely because it isn't run by the tech industry. That's about to change. Read the original post. Today's post is just a continuation of that one. http://this.how/googleAndHttp/ http://this.how/googleAndHttp/ And be a little more kind to Stallman. :-) Dave
    - derf_ 8y ago
      With all due respect, I read the original post, and it does not seem terribly compelling to me. > Something bad could happen to my pages in transit from a server to the user's web browser. This already happens. Verizon injects tracking cookies into unencrypted requests [1]. Hotels inject advertising on top of the existing advertising [personal experience]. They will do it when I read your blog archive from 2001. They will inject arbitrary JavaScript that records my every keystroke and mouse movement [2]. State actors will use persistent surveillance of all unencrypted cookies to pierce firewalls and target individual engineers in charge of anything they happen to find useful [3]. They will do worse things as compute becomes cheaper and cheaper. If your argument is that there are lots of HTTP sites that are historically important and also that are unmaintained and that will never be upgraded, okay. That is a solvable technical problem [4]. If you want to know why you have to force people to do it, it is because security is a public health issue [5]. It is the same reason you have to force people to get vaccinations. I don't work for Google (in fact I work for a direct competitor), and I disagree with a lot of the things that they do or want to do (unsurprisingly). But having more security on the web is not one of them. We live in a very different world than we did 25-plus years ago. [1] https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh [2] https://www.wired.com/story/the-dark-side-of-replay-sessions-that-record-your-every-move-online/ https://www.wired.com/story/the-dark-side-of-replay-sessions... [3] https://theintercept.com/2014/12/13/belgacom-hack-gchq-inside-story/ https://theintercept.com/2014/12/13/belgacom-hack-gchq-insid... (search for MUTANT BROTH) [4] https://archive.org/ https://archive.org/ [5] https://www.schneier.com/blog/archives/2014/03/security_as_a_p.html https://www.schneier.com/blog/archives/2014/03/security_as_a...

jasonmp85 8y ago

> People are going to dismiss Dave Winer as a crank […] Maybe he shouldn't have launched an incomprehensible crusade against widespread SSL deployment in a post-Snowden world?

chipotle_coyote 8y ago
SSL is terrific for things that need to be secured, but there are a lot of web sites out there -- an arguably increasing number given the rise in popularity of static site generators -- that derive absolutely no benefit from being served as HTTPS rather than plain HTTP. Not "modest" benefit, not even "negligible" benefit, but no benefit. I've built relatively large sites that are entirely archives. They have no logins. They have no forms. I am not sure why it's "incomprehensible" to you that I'm less than thrilled that Google has decided I'd damn well better make sure my publicly accessible, 100% static, entirely form-free web site is served only over SSL. I'd describe Dave Winer as more of an iconoclast than a crank, from what I've seen. But his point is that an awful lot of the Web As It Exists is unsecured, particularly the older personal pages and sites that are still hanging on, and that if Google decides that Chrome will simply no longer browse to unsecured web sites -- or worse, that their search engine won't just deprioritize but will delist unsecured sites -- a lot of the web will be effectively lost.
- level3 8y ago
  HTTPS is not just about preventing eavesdropping of private data; it is also about preventing MITM and data tampering. I agree that from your perspective, you might see no benefit, but the HTTPS push is primarily for the users (and as a result, the web at large).
- chowell 8y ago
  Do you drop tracking cookies or scripts that fingerprint the users visiting your site? No? Well by resisting the push to TLS, you're allowing ISPs and who knows who else to inject that content into the sessions of your users.
- deleted 8y ago
  [deleted]