3 ms·

Analog TV had to be moved because it was taking up limited resources. Old websites aren't taking up valuable real estate. There's no benefit to shutting them do

by sp332 7y ago

Analog TV had to be moved because it was taking up limited resources. Old websites aren't taking up valuable real estate. There's no benefit to shutting them down.

crazygringo 7y ago
Of course there is. If they're HTTP, they're insecure, which makes them an open attack vector. Modern computer security is about removing as many known possible attack vectors as possible. So that's the benefit. EDIT: to those saying browsers are sandboxed or that there's nothing sensitive, it projects against e.g. Comcast injecting JavaScript into pages from other sites. [1] There are all sorts of types of bad actors out there. Surely I don't need to list them all here. [1] https://thenextweb.com/insights/2017/12/11/comcast-continues-to-inject-its-own-code-into-websites-you-visit/ https://thenextweb.com/insights/2017/12/11/comcast-continues...
- sp332 7y ago
  There's no point having a web browser that doesn't browse just because it's more secure that way! Browsers have never had better sandboxes. Firefox disables certain features for sites served via plain HTTP. It's safer now to browse unencrypted sites than it was five years ago. There's no reason to remove functionality now.
  - bow_ 7y ago
    Here I disagree. HTTPS gives guarantee to visitors of the site that they can trust the information being served to them. A malicious actor hijacking plain HTTP connections does not necessarily have to inject code that harms the user's computer directly. He/she could also just alter bits and pieces of the served content to trick the user into doing something not in his/her interest. So while having better browser sandboxing and protection is good (and welcome), HTTPS is still necessary.
- ComputerGuru 7y ago
  Old and unmaintained websites are not collecting any information, let alone sensitive information. They’re mainly read-only, informative content that the web would be infinitely worse-off without.
  - JoshTriplett 7y ago
    The Internet Archive helps maintain that information far more reliably than a 20-year-old unpatched webserver could.
    - ComputerGuru 7y ago
      The internet archive is unfortunately poorly indexed/searchable bordering on not at all.
- josteink 7y ago
  > Of course there is. If they're HTTP, they're insecure, which makes them an open attack vector. If so they are only insecure because malicious JS can be MITMed into them, and realistically speaking browsers can’t defend against malicious JS. > Modern computer security is about removing as many known possible attack vectors as possible. So let’s remove enabled-by-default JS permissions instead of removing HTTP-content. Most old websites don’t depend on JS and would in fact be just fine. Even better: make JS opt-in only for HTTP websites, and let users like me refuse the “upgrade” to HTTPS.
- zzo38computer 7y ago
  > If they're HTTP, they're insecure, which makes them an open attack vector. No it doesn't. HTTPS ensures that the data is not spied on or tampered with by those in the middle (so it does protect against what Comcast does), but does not prevent any other sorts of attacks (e.g. the server operator adding malicious files into their own server).
- zzo38computer 7y ago
  > it projects against e.g. Comcast injecting JavaScript into pages from other sites. I should add a script to detect such things then, and if it finds one, display its own message to the user, to tell the user to disable JavaScript, with instructions about how to do so.

by sp332 7y ago

Analog TV had to be moved because it was taking up limited resources. Old websites aren't taking up valuable real estate. There's no benefit to shutting them down.

crazygringo 7y ago

Of course there is. If they're HTTP, they're insecure, which makes them an open attack vector. Modern computer security is about removing as many known possible attack vectors as possible. So that's the benefit. EDIT: to those saying browsers are sandboxed or that there's nothing sensitive, it projects against e.g. Comcast injecting JavaScript into pages from other sites. [1] There are all sorts of types of bad actors out there. Surely I don't need to list them all here. [1] https://thenextweb.com/insights/2017/12/11/comcast-continues-to-inject-its-own-code-into-websites-you-visit/ https://thenextweb.com/insights/2017/12/11/comcast-continues...

sp332 7y ago
There's no point having a web browser that doesn't browse just because it's more secure that way! Browsers have never had better sandboxes. Firefox disables certain features for sites served via plain HTTP. It's safer now to browse unencrypted sites than it was five years ago. There's no reason to remove functionality now.
- bow_ 7y ago
  Here I disagree. HTTPS gives guarantee to visitors of the site that they can trust the information being served to them. A malicious actor hijacking plain HTTP connections does not necessarily have to inject code that harms the user's computer directly. He/she could also just alter bits and pieces of the served content to trick the user into doing something not in his/her interest. So while having better browser sandboxing and protection is good (and welcome), HTTPS is still necessary.
ComputerGuru 7y ago
Old and unmaintained websites are not collecting any information, let alone sensitive information. They’re mainly read-only, informative content that the web would be infinitely worse-off without.
- JoshTriplett 7y ago
  The Internet Archive helps maintain that information far more reliably than a 20-year-old unpatched webserver could.
  - ComputerGuru 7y ago
    The internet archive is unfortunately poorly indexed/searchable bordering on not at all.
josteink 7y ago
> Of course there is. If they're HTTP, they're insecure, which makes them an open attack vector. If so they are only insecure because malicious JS can be MITMed into them, and realistically speaking browsers can’t defend against malicious JS. > Modern computer security is about removing as many known possible attack vectors as possible. So let’s remove enabled-by-default JS permissions instead of removing HTTP-content. Most old websites don’t depend on JS and would in fact be just fine. Even better: make JS opt-in only for HTTP websites, and let users like me refuse the “upgrade” to HTTPS.
zzo38computer 7y ago
> If they're HTTP, they're insecure, which makes them an open attack vector. No it doesn't. HTTPS ensures that the data is not spied on or tampered with by those in the middle (so it does protect against what Comcast does), but does not prevent any other sorts of attacks (e.g. the server operator adding malicious files into their own server).
zzo38computer 7y ago
> it projects against e.g. Comcast injecting JavaScript into pages from other sites. I should add a script to detect such things then, and if it finds one, display its own message to the user, to tell the user to disable JavaScript, with instructions about how to do so.