3 ms·

Maciej has a well known track record as a security expert. He has testified very recently before the US Congress [0] on these matters as well as single-handedly

Maciej has a well known track record as a security expert. He has testified very recently before the US Congress [0] on these matters as well as single-handedly (to the best of my knowledge) built and maintains the fantastic Pinboard bookmarking service [1]. Just because he has a mixed content warning on a image of a fish (his site logo it appears) and has a Google search form inline (not ajax mind you, an actual standard HTML form with a real submit button) should not cause you to consider him unskilled or untrustworthy. Furthermore, lack of HSTS or a CSP shouldn't be a red flag since it is his own personal blog, therefore it's probably not worth his own time to configure either. I'm not sure what your personal threat model looks like, but I think we can assume most people that read HN wouldn't worry about such things. Full disclosure: I am a Pinboard lifetime member but to the best of my knowledge have never contacted or been contacted by Maciej, and obviously he didn't ask me to vouch for him, these are my thoughts alone. 0: https://www.americanrhetoric.com/speeches/maciejceglowskicongressprivacy.htm https://www.americanrhetoric.com/speeches/maciejceglowskicon... 1: http://pinboard.in/ http://pinboard.in/ EDIT: Added links & "to the best of my knowledge"

tptacek 7y ago
.
- robbiet480 7y ago
  Yeah I was trying to decide if they were trolling or not, gave the benefit of the doubt on this one.
  - idlewords 7y ago
    This whole exchange makes me regret adding https to the blog last month.
    - rurounijones 7y ago
      To be a brief Devil's advocate: I can sort of see the OPs point from a layman's point of view. If a security expert cannot (I use "cannot" here from the layman's point) secure the website (According to a tool that shows scary red X's) then what chance does a mere mortal have, or is it that important? Now, we know that spending the time securing a personal blog the whole nine yards is probably not worth it; but to an uninformed person who cannot make that judgement? Black and White is so much easier than greyscale. This is why I usually go all or nothing in this kind of situation. Of course doing nothing would probably have resulted in a "His site isn't even https!". Damned if you do and damned if you don't. At least take solace in the fact that the comment has been judged appropriately and you have admirers correcting the superficial opinion.

tptacek 7y ago

robbiet480 7y ago
Yeah I was trying to decide if they were trolling or not, gave the benefit of the doubt on this one.
- idlewords 7y ago
  This whole exchange makes me regret adding https to the blog last month.
  - rurounijones 7y ago
    To be a brief Devil's advocate: I can sort of see the OPs point from a layman's point of view. If a security expert cannot (I use "cannot" here from the layman's point) secure the website (According to a tool that shows scary red X's) then what chance does a mere mortal have, or is it that important? Now, we know that spending the time securing a personal blog the whole nine yards is probably not worth it; but to an uninformed person who cannot make that judgement? Black and White is so much easier than greyscale. This is why I usually go all or nothing in this kind of situation. Of course doing nothing would probably have resulted in a "His site isn't even https!". Damned if you do and damned if you don't. At least take solace in the fact that the comment has been judged appropriately and you have admirers correcting the superficial opinion.