5 ms·

I agree that Google has far too much control over the web. However, this is a silly reason to argue against HTTPS. HTTPS is an open standard. Google doesn't con

I agree that Google has far too much control over the web. However, this is a silly reason to argue against HTTPS. HTTPS is an open standard. Google doesn't control it. HTTPS doesn't require anyone to use any Google product. You can use HTTPS just fine by getting your certificates from LetsEncrypt and browsing with Mozilla Firefox. Or Microsoft Edge. Or Internet Explorer. Moreover, the security guarantees that HTTPS brings to the web benefit everyone, not just Google. More generally, Dave Winer seems to have an attitude of reflexively opposing everything that Google advocates, merely because it is Google that is advocating for it. It reminds me of the late 90's and early 2000's when open-source people talked about "M$" and reflexively opposed everything that Microsoft did merely because it was Microsoft that was doing it, leaving aside technical merits or other considerations. Corporations are neither pure good, nor pure evil. They are collections of people with collective interests that they pursue. Sometimes, like in the case of HTTPS, or net neutrality, those interests align with our interests as developers and users. In those cases, we should ally ourselves with corporations and use their leverage to effect change more quickly. In other cases, such as with RSS, and vendor lock-in, our interests diverge and we should oppose them with all our might so that we don't lose the free and open Internet that we've become accustomed to. In both cases, however, we should examine the issue on the merits of that issue, and neither support nor oppose merely because the "right" or "wrong" organization is pushing for it.

amanzi 8y ago
> HTTPS is an open standard. Google doesn't control it. HTTPS doesn't require anyone to use any Google product. The problem is that Google controls the most popular interfaces to consuming HTTP and HTTPS, i.e. their Chrome browser and their search engine. And so Google is in a position where they control how these protocols are consumed, which is the crux of Dave's argument. Google is already discouraging the use of HTTP through warning messages in Chrome and by adjusting search rank algorithms for HTTP sites. Dave's concern is that Google will "turn off" HTTP access in the same way they did with RSS after capturing the market share for consuming RSS feeds and then shutting down Google Reader and removing discoverabilty of RSS feeds in Chrome. Dave Winer has been around the Web for longer than most and you'd be foolish to write him off as a curmudgeon. Dave is to the open Web what RMS is to FOSS.
- pwinnski 8y ago
  > Dave is to the open Web what RMS is to FOSS. This is a great analogy!
  - davewiner 8y ago
    Thank you, that's a very nice thing to say. Over the years I've come to respect Stallman's way of viewing things more and more. The open web is worth fighting for. And Google is moving into new territory now, by deciding to force sites to switch to HTTPS. Most of the arguments you hear are about new sites, but people are missing that the web has been used for 25 years as an archiving medium. If you want to save something so it's available for others (and yourself too) in the future, put it on the web. It's been incredibly stable platform, far more so than the ones run by the tech industry, and precisely because it isn't run by the tech industry. That's about to change. Read the original post. Today's post is just a continuation of that one. http://this.how/googleAndHttp/ http://this.how/googleAndHttp/ And be a little more kind to Stallman. :-) Dave
    - derf_ 8y ago
      With all due respect, I read the original post, and it does not seem terribly compelling to me. > Something bad could happen to my pages in transit from a server to the user's web browser. This already happens. Verizon injects tracking cookies into unencrypted requests [1]. Hotels inject advertising on top of the existing advertising [personal experience]. They will do it when I read your blog archive from 2001. They will inject arbitrary JavaScript that records my every keystroke and mouse movement [2]. State actors will use persistent surveillance of all unencrypted cookies to pierce firewalls and target individual engineers in charge of anything they happen to find useful [3]. They will do worse things as compute becomes cheaper and cheaper. If your argument is that there are lots of HTTP sites that are historically important and also that are unmaintained and that will never be upgraded, okay. That is a solvable technical problem [4]. If you want to know why you have to force people to do it, it is because security is a public health issue [5]. It is the same reason you have to force people to get vaccinations. I don't work for Google (in fact I work for a direct competitor), and I disagree with a lot of the things that they do or want to do (unsurprisingly). But having more security on the web is not one of them. We live in a very different world than we did 25-plus years ago. [1] https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh [2] https://www.wired.com/story/the-dark-side-of-replay-sessions-that-record-your-every-move-online/ https://www.wired.com/story/the-dark-side-of-replay-sessions... [3] https://theintercept.com/2014/12/13/belgacom-hack-gchq-inside-story/ https://theintercept.com/2014/12/13/belgacom-hack-gchq-insid... (search for MUTANT BROTH) [4] https://archive.org/ https://archive.org/ [5] https://www.schneier.com/blog/archives/2014/03/security_as_a_p.html https://www.schneier.com/blog/archives/2014/03/security_as_a...
aogl 8y ago
Did I miss something, or why are you discussing HTTPS as a counter argument?
aogl 8y ago
Did I miss something, or why are you discussing HTTPS as a counter argument here?
- schoen 8y ago
  Probably because Winer's post links to this earlier one at the bottom http://this.how/googleAndHttp/ http://this.how/googleAndHttp/ which criticizes Google's support for replacing HTTP with HTTPS. (As someone working on this issue from the opposite side from Dave Winer, I can confirm that Google's support has been incredibly consequential at every moment and at every level in HTTPS adoption.)
- arthurfm 8y ago
  > Did I miss something Yes. See the section titled 'Arguments against securing the web'. https://scotthelme.co.uk/https-anti-vaxxers/ https://scotthelme.co.uk/https-anti-vaxxers/
  - jessaustin 8y ago
    Yeah no thanks. I'm not going to read something so fair-minded as to call those with whom it disagrees "anti-vaxxers". Winer has a point that resonates with many people. You're not going to convince them by calling them idiots.
    - Flimm 8y ago
      You're right that the "anti-vaxxers" title is off-putting to many people. It's a shame that you choose not to look past that.
      - jessaustin 8y ago
        In this very thread I've gotten my fill of juvenile down-talking: "you must not understand how HTTPS works!" "Security is good, m'kay?" The points that Winer has made are more subtle than this. Any convincing rebuttal would be more subtle. That title is if anything less subtle. If there were a point at that link that was actually responsive to Winer, I presume you would have quoted it.
davewiner 8y ago
BTW, you're wrong about your "reflexive" theory. I use far too much Google stuff. I'm on GMail. I use Chrome. I am a Node developer which uses their V8 implementation of JavaScript. I hate it but I mostly use Google for search, habits die hard. It will be a huge pain to me if I have to fall back from using Google. I criticize them because I do use their products. When I stop, you can be pretty sure I will also stop writing about them.
- dredmorbius 8y ago
  I hear you, though I've largely stopped with direct feedback and commentary as it 1. seems to haveno positive effect, and 2. may be having the opposite of my intended outcome. I refer to this as my Denial of Feedback Attack. The alternatives exist and I recommend using them. This is coming to you via Chrome and Android, but elsewhere I rely on Linux ans MacOS, as well as Firefox and increasingly text-based browsers. (I'm special, I know.) Protonmail and DuckDuckGo are each quite good. I am divesting mysself of other digital services generally. As for networks, technology, monopoly, and power, I'm seeing them as increasingly tightly interrelated. Look up Jules Dupuit and his work on rail fares (and classes) and bridge tolls, among others.
- clouddrover 8y ago
  > It will be a huge pain to me if I have to fall back from using Google. Why? Aren't Firefox and DuckDuckGo two straightforward alternatives you could use right now? Switching to both of those would reduce your dependency on Google and be relatively pain free transitions.
  - BenjiWiebe 8y ago
    I've tried DuckDuckGo a number of times, and it always feels like it can't find the right results to a query, whereas Google gets it right more often than not.
ssss11 8y ago
> Corporations are neither pure good, nor pure evil. They are collections of people with collective interests that they pursue. In theory but not practice, let’s not be naive. Corporations end up serving the purpose of their owners (shareholders) which is to generate maximum profit. That objective causes the corporation to commonly behave much closer to pure evil on your scale (to generate the profit).
- paulddraper 8y ago
  > That objective causes the corporation to commonly behave much closer to pure evil on your scale (to generate the profit). I'd suggest that Google has done more for the Web than any other organization in the 21st century: Google, Gmail, Chrome, Docs. Nearly single-handedly, Google made the web useful to more than hobbiests and for more than single about me pages.
- tomnipotent 8y ago
  > Corporations end up serving the purpose of their owners (shareholders) Which are (gasp) still collections of people! What's naive is treating a corporation like a single individual with a single identify and set of known traits. That's just plain silly.
zelon88 8y ago
You're off on a tangent about a separate article and a separate issue, but I'll digress. >"In both cases, however, we should examine the issue on the merits of that issue, and neither support nor oppose merely because the "right" or "wrong" organization is pushing for it." You're missing the point. In the article you're referring to Dave says "Google is a guest on the web, as we all are. Guests don't make the rules." He's not advocating against HTTPS. He's advocating against Google pushing it down everyone's throat as the proprietor of the internet. And he's right in that if we allow Google to declare themselves the harbinger of digital trends then we're authorizing them to take it another step further. We're essentially endorsing the next stage, which would be to simply block http from Chrome or Android or whatever they feel like. He goes on to state "If HTTPS is such a great idea... Why force people to do it? This suggests that the main benefit is for Google, not for people who own the content. If it were such a pressing problem we'd do it because we want to, not because we're being forced to." He's right again. He isn't saying HTTPS is bad for the internet. He's saying letting Google decide in a vacuum that HTTPS should be the only way to internet is bad.

amanzi 8y ago

> HTTPS is an open standard. Google doesn't control it. HTTPS doesn't require anyone to use any Google product. The problem is that Google controls the most popular interfaces to consuming HTTP and HTTPS, i.e. their Chrome browser and their search engine. And so Google is in a position where they control how these protocols are consumed, which is the crux of Dave's argument. Google is already discouraging the use of HTTP through warning messages in Chrome and by adjusting search rank algorithms for HTTP sites. Dave's concern is that Google will "turn off" HTTP access in the same way they did with RSS after capturing the market share for consuming RSS feeds and then shutting down Google Reader and removing discoverabilty of RSS feeds in Chrome. Dave Winer has been around the Web for longer than most and you'd be foolish to write him off as a curmudgeon. Dave is to the open Web what RMS is to FOSS.

pwinnski 8y ago
> Dave is to the open Web what RMS is to FOSS. This is a great analogy!
- davewiner 8y ago
  Thank you, that's a very nice thing to say. Over the years I've come to respect Stallman's way of viewing things more and more. The open web is worth fighting for. And Google is moving into new territory now, by deciding to force sites to switch to HTTPS. Most of the arguments you hear are about new sites, but people are missing that the web has been used for 25 years as an archiving medium. If you want to save something so it's available for others (and yourself too) in the future, put it on the web. It's been incredibly stable platform, far more so than the ones run by the tech industry, and precisely because it isn't run by the tech industry. That's about to change. Read the original post. Today's post is just a continuation of that one. http://this.how/googleAndHttp/ http://this.how/googleAndHttp/ And be a little more kind to Stallman. :-) Dave
  - derf_ 8y ago
    With all due respect, I read the original post, and it does not seem terribly compelling to me. > Something bad could happen to my pages in transit from a server to the user's web browser. This already happens. Verizon injects tracking cookies into unencrypted requests [1]. Hotels inject advertising on top of the existing advertising [personal experience]. They will do it when I read your blog archive from 2001. They will inject arbitrary JavaScript that records my every keystroke and mouse movement [2]. State actors will use persistent surveillance of all unencrypted cookies to pierce firewalls and target individual engineers in charge of anything they happen to find useful [3]. They will do worse things as compute becomes cheaper and cheaper. If your argument is that there are lots of HTTP sites that are historically important and also that are unmaintained and that will never be upgraded, okay. That is a solvable technical problem [4]. If you want to know why you have to force people to do it, it is because security is a public health issue [5]. It is the same reason you have to force people to get vaccinations. I don't work for Google (in fact I work for a direct competitor), and I disagree with a lot of the things that they do or want to do (unsurprisingly). But having more security on the web is not one of them. We live in a very different world than we did 25-plus years ago. [1] https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh [2] https://www.wired.com/story/the-dark-side-of-replay-sessions-that-record-your-every-move-online/ https://www.wired.com/story/the-dark-side-of-replay-sessions... [3] https://theintercept.com/2014/12/13/belgacom-hack-gchq-inside-story/ https://theintercept.com/2014/12/13/belgacom-hack-gchq-insid... (search for MUTANT BROTH) [4] https://archive.org/ https://archive.org/ [5] https://www.schneier.com/blog/archives/2014/03/security_as_a_p.html https://www.schneier.com/blog/archives/2014/03/security_as_a...

aogl 8y ago

Did I miss something, or why are you discussing HTTPS as a counter argument?

aogl 8y ago

Did I miss something, or why are you discussing HTTPS as a counter argument here?

schoen 8y ago
Probably because Winer's post links to this earlier one at the bottom http://this.how/googleAndHttp/ http://this.how/googleAndHttp/ which criticizes Google's support for replacing HTTP with HTTPS. (As someone working on this issue from the opposite side from Dave Winer, I can confirm that Google's support has been incredibly consequential at every moment and at every level in HTTPS adoption.)
arthurfm 8y ago
> Did I miss something Yes. See the section titled 'Arguments against securing the web'. https://scotthelme.co.uk/https-anti-vaxxers/ https://scotthelme.co.uk/https-anti-vaxxers/
- jessaustin 8y ago
  Yeah no thanks. I'm not going to read something so fair-minded as to call those with whom it disagrees "anti-vaxxers". Winer has a point that resonates with many people. You're not going to convince them by calling them idiots.
  - Flimm 8y ago
    You're right that the "anti-vaxxers" title is off-putting to many people. It's a shame that you choose not to look past that.
    - jessaustin 8y ago
      In this very thread I've gotten my fill of juvenile down-talking: "you must not understand how HTTPS works!" "Security is good, m'kay?" The points that Winer has made are more subtle than this. Any convincing rebuttal would be more subtle. That title is if anything less subtle. If there were a point at that link that was actually responsive to Winer, I presume you would have quoted it.

davewiner 8y ago

BTW, you're wrong about your "reflexive" theory. I use far too much Google stuff. I'm on GMail. I use Chrome. I am a Node developer which uses their V8 implementation of JavaScript. I hate it but I mostly use Google for search, habits die hard. It will be a huge pain to me if I have to fall back from using Google. I criticize them because I do use their products. When I stop, you can be pretty sure I will also stop writing about them.

dredmorbius 8y ago
I hear you, though I've largely stopped with direct feedback and commentary as it 1. seems to haveno positive effect, and 2. may be having the opposite of my intended outcome. I refer to this as my Denial of Feedback Attack. The alternatives exist and I recommend using them. This is coming to you via Chrome and Android, but elsewhere I rely on Linux ans MacOS, as well as Firefox and increasingly text-based browsers. (I'm special, I know.) Protonmail and DuckDuckGo are each quite good. I am divesting mysself of other digital services generally. As for networks, technology, monopoly, and power, I'm seeing them as increasingly tightly interrelated. Look up Jules Dupuit and his work on rail fares (and classes) and bridge tolls, among others.
clouddrover 8y ago
> It will be a huge pain to me if I have to fall back from using Google. Why? Aren't Firefox and DuckDuckGo two straightforward alternatives you could use right now? Switching to both of those would reduce your dependency on Google and be relatively pain free transitions.
- BenjiWiebe 8y ago
  I've tried DuckDuckGo a number of times, and it always feels like it can't find the right results to a query, whereas Google gets it right more often than not.

ssss11 8y ago

> Corporations are neither pure good, nor pure evil. They are collections of people with collective interests that they pursue. In theory but not practice, let’s not be naive. Corporations end up serving the purpose of their owners (shareholders) which is to generate maximum profit. That objective causes the corporation to commonly behave much closer to pure evil on your scale (to generate the profit).

paulddraper 8y ago
> That objective causes the corporation to commonly behave much closer to pure evil on your scale (to generate the profit). I'd suggest that Google has done more for the Web than any other organization in the 21st century: Google, Gmail, Chrome, Docs. Nearly single-handedly, Google made the web useful to more than hobbiests and for more than single about me pages.
tomnipotent 8y ago
> Corporations end up serving the purpose of their owners (shareholders) Which are (gasp) still collections of people! What's naive is treating a corporation like a single individual with a single identify and set of known traits. That's just plain silly.

zelon88 8y ago

You're off on a tangent about a separate article and a separate issue, but I'll digress. >"In both cases, however, we should examine the issue on the merits of that issue, and neither support nor oppose merely because the "right" or "wrong" organization is pushing for it." You're missing the point. In the article you're referring to Dave says "Google is a guest on the web, as we all are. Guests don't make the rules." He's not advocating against HTTPS. He's advocating against Google pushing it down everyone's throat as the proprietor of the internet. And he's right in that if we allow Google to declare themselves the harbinger of digital trends then we're authorizing them to take it another step further. We're essentially endorsing the next stage, which would be to simply block http from Chrome or Android or whatever they feel like. He goes on to state "If HTTPS is such a great idea... Why force people to do it? This suggests that the main benefit is for Google, not for people who own the content. If it were such a pressing problem we'd do it because we want to, not because we're being forced to." He's right again. He isn't saying HTTPS is bad for the internet. He's saying letting Google decide in a vacuum that HTTPS should be the only way to internet is bad.