5 ms·

All legacy content heritage that is hosted using http protocol just became not secure in Chrome. What solution does google suggest? Who will pay to upgrade old

All legacy content heritage that is hosted using http protocol just became not secure in Chrome. What solution does google suggest? Who will pay to upgrade old infrastructure? Pandora box.

ealhad 8y ago
All legacy content that is hosted using http protocol is, in fact, not secure. It's definitely not a bad thing to warn people.
- Dolores12 8y ago
  For general public 'not secure' imply something like 'not safe'.
  - beezle 8y ago
    That is exactly why Google's choice of wording is so poor. Far better would be 'encrypted/not encrypted' as that is all https really is. Safe can have far to many meanings and I won't be at all surprised when Google faces a class action when 'unsafe' things happen on a website they deem 'safe.' Personally don't understand the heavy push to force https on everything and anything. The maintenance/time required to set up and maintain is not insignificant and is really quite pointless in many situations. Do you really need an encrypted connection to LOLCats?
    - ealhad 8y ago
      You need an encrypted connection, period. If you only use an encrypted connection when you need it, then one can know that, well, you need it. You have nothing to hide... until you do.
- mynewaccount0 8y ago
  Somebody better warn the Debian maintainers that their packages have been Not Secure for the past decade-or-more.
matthewmacleod 8y ago
Yes, that's right – because it _is_ insecure, fundamentally. These sites will continue to be entirely accessible, so I have no idea what solution you think is required. If a provider wants to upgrade such that their site is no longer insecure, then they can pay to upgrade it themselves.
- mynewaccount0 8y ago
  This is absolutely, entirely wrong. It's so wrong that I need to wonder why you don't even realize you're wrong. A HTTP website with my GPG-signed data is _more_ secure than an HTTPS website. Relying on a CA is not the only way to secure a website. But this isn't about securing websites, this is about forcing us to rely on CAs.
RandomInteger4 8y ago
Presumably the businesses that should have seen this coming a long time ago.
realusername 8y ago
You can still browse it, it's just written non-secure because it's actually not secure.
ahje 8y ago
I recommend you have a look at this one: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...
- Dolores12 8y ago
  That is exactly what i am talking about. Who will pay to update legacy website content to include meta tag or update webserver config to include http header?

All legacy content heritage that is hosted using http protocol just became not secure in Chrome. What solution does google suggest? Who will pay to upgrade old infrastructure? Pandora box.

ealhad 8y ago

All legacy content that is hosted using http protocol is, in fact, not secure. It's definitely not a bad thing to warn people.

Dolores12 8y ago
For general public 'not secure' imply something like 'not safe'.
- beezle 8y ago
  That is exactly why Google's choice of wording is so poor. Far better would be 'encrypted/not encrypted' as that is all https really is. Safe can have far to many meanings and I won't be at all surprised when Google faces a class action when 'unsafe' things happen on a website they deem 'safe.' Personally don't understand the heavy push to force https on everything and anything. The maintenance/time required to set up and maintain is not insignificant and is really quite pointless in many situations. Do you really need an encrypted connection to LOLCats?
  - ealhad 8y ago
    You need an encrypted connection, period. If you only use an encrypted connection when you need it, then one can know that, well, you need it. You have nothing to hide... until you do.
mynewaccount0 8y ago
Somebody better warn the Debian maintainers that their packages have been Not Secure for the past decade-or-more.

matthewmacleod 8y ago

Yes, that's right – because it _is_ insecure, fundamentally. These sites will continue to be entirely accessible, so I have no idea what solution you think is required. If a provider wants to upgrade such that their site is no longer insecure, then they can pay to upgrade it themselves.

mynewaccount0 8y ago
This is absolutely, entirely wrong. It's so wrong that I need to wonder why you don't even realize you're wrong. A HTTP website with my GPG-signed data is _more_ secure than an HTTPS website. Relying on a CA is not the only way to secure a website. But this isn't about securing websites, this is about forcing us to rely on CAs.

RandomInteger4 8y ago

Presumably the businesses that should have seen this coming a long time ago.

realusername 8y ago

You can still browse it, it's just written non-secure because it's actually not secure.

ahje 8y ago

I recommend you have a look at this one: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

Dolores12 8y ago
That is exactly what i am talking about. Who will pay to update legacy website content to include meta tag or update webserver config to include http header?