5 ms·
> ...it requires HTTPS to connect to all .dev websites. This protects people who visit your site against ad malware and tracking injection by internet service p
by strictnein 8y ago
> ...it requires HTTPS to connect to all .dev websites. This protects people who visit your site against ad malware and tracking injection by internet service providers
The latter is true (it protects against injection), but I'm not sure how the former is. How would it protect against ad malware?
- toast0 8y agoIt protects against ad malware injection by ISPs. It certainly doesn't protect users from the other end of the TLS socket.
- dragonwriter 8y agoI think you are reading it wrong. It's not “(ad malware) and (tracking injection by ISPs)” but “(ad malware and tracking) injection by ISPs”.
- josteink 8y agoBut nobody with any respect for themselves has an un-ISP doing borderline illegal shit like that. It hardly seems like a worthwhile problem to solve at gTLD-scale.
- dragonwriter 8y ago> But nobody with any respect for themselves has an un-ISP doing borderline illegal shit like that. advertising and malware (both ad-related and not) injection by ISPs is a well documented global issue.
- CydeWeys 8y agoAnd not just ISPs. Governments, state-sponsored attackers, garden variety scammers, malware, compromised WiFi routers, etc.
- josteink 8y agoIf so, that’s a local problem and you fix it with regulation, not technology.
- dragonwriter 8y ago> If so, that’s a local problem It's a well-documented global problem. > and you fix it with regulation, Governments are often not opposed, and sometimes active encouragers or procurers of the ISP injection. Also, the HTTPS requirement for .dev domains is regulation, even if it isn't government regulation.
- CydeWeys 8y agoBurglary is illegal but you still lock your front door. Defrauding someone electronically is illegal but you still encrypt your data in transit.
- jerluc 8y agoMy assumption from that sentence is that both "ad malware" and "ad tracking" are injected by some ISPs somewhere between the client and the server. By forcing HTTPS, you'd prevent some amount of this by ensuring the data in transit from client-to-server-to-client is encrypted (and thus mostly tamper-proof) using the .dev domain's public cert.
- CydeWeys 8y agoAlso commonly injected by malicious or compromised WiFi routers.
- jmull 8y agoMaybe they mean both the ad malware and tracking are injected by your ISP?