3 ms·

> People are going to dismiss Dave Winer as a crank […] Maybe he shouldn't have launched an incomprehensible crusade against widespread SSL deployment in a pos

> People are going to dismiss Dave Winer as a crank […] Maybe he shouldn't have launched an incomprehensible crusade against widespread SSL deployment in a post-Snowden world?

chipotle_coyote 8y ago
SSL is terrific for things that need to be secured, but there are a lot of web sites out there -- an arguably increasing number given the rise in popularity of static site generators -- that derive absolutely no benefit from being served as HTTPS rather than plain HTTP. Not "modest" benefit, not even "negligible" benefit, but no benefit. I've built relatively large sites that are entirely archives. They have no logins. They have no forms. I am not sure why it's "incomprehensible" to you that I'm less than thrilled that Google has decided I'd damn well better make sure my publicly accessible, 100% static, entirely form-free web site is served only over SSL. I'd describe Dave Winer as more of an iconoclast than a crank, from what I've seen. But his point is that an awful lot of the Web As It Exists is unsecured, particularly the older personal pages and sites that are still hanging on, and that if Google decides that Chrome will simply no longer browse to unsecured web sites -- or worse, that their search engine won't just deprioritize but will delist unsecured sites -- a lot of the web will be effectively lost.
- level3 8y ago
  HTTPS is not just about preventing eavesdropping of private data; it is also about preventing MITM and data tampering. I agree that from your perspective, you might see no benefit, but the HTTPS push is primarily for the users (and as a result, the web at large).
- chowell 8y ago
  Do you drop tracking cookies or scripts that fingerprint the users visiting your site? No? Well by resisting the push to TLS, you're allowing ISPs and who knows who else to inject that content into the sessions of your users.
- deleted 8y ago
  [deleted]
davewiner 8y ago
I don't have anything against SSL, and say so in the Google and HTTP piece. My concern is Google presuming to make the rules for the open web. They're guests here, as we all are, and guests don't make the rules.

> People are going to dismiss Dave Winer as a crank […] Maybe he shouldn't have launched an incomprehensible crusade against widespread SSL deployment in a post-Snowden world?

chipotle_coyote 8y ago

SSL is terrific for things that need to be secured, but there are a lot of web sites out there -- an arguably increasing number given the rise in popularity of static site generators -- that derive absolutely no benefit from being served as HTTPS rather than plain HTTP. Not "modest" benefit, not even "negligible" benefit, but no benefit. I've built relatively large sites that are entirely archives. They have no logins. They have no forms. I am not sure why it's "incomprehensible" to you that I'm less than thrilled that Google has decided I'd damn well better make sure my publicly accessible, 100% static, entirely form-free web site is served only over SSL. I'd describe Dave Winer as more of an iconoclast than a crank, from what I've seen. But his point is that an awful lot of the Web As It Exists is unsecured, particularly the older personal pages and sites that are still hanging on, and that if Google decides that Chrome will simply no longer browse to unsecured web sites -- or worse, that their search engine won't just deprioritize but will delist unsecured sites -- a lot of the web will be effectively lost.

level3 8y ago
HTTPS is not just about preventing eavesdropping of private data; it is also about preventing MITM and data tampering. I agree that from your perspective, you might see no benefit, but the HTTPS push is primarily for the users (and as a result, the web at large).
chowell 8y ago
Do you drop tracking cookies or scripts that fingerprint the users visiting your site? No? Well by resisting the push to TLS, you're allowing ISPs and who knows who else to inject that content into the sessions of your users.
deleted 8y ago
[deleted]

davewiner 8y ago

I don't have anything against SSL, and say so in the Google and HTTP piece. My concern is Google presuming to make the rules for the open web. They're guests here, as we all are, and guests don't make the rules.