3 ms·

But most of the websites today are not sending sensitive data back and forth, they are simply sending public data from public websites. And here the HTTPS crow

But most of the websites today are not sending sensitive data back and forth, they are simply sending public data from public websites. And here the HTTPS crowd‘S argument is that an evil attacker can inject malicious JS if MITMed, and this according to them is why everyone must have HTTPS for everything. No middle ground. But if JS was not a default permission, that wouldn’t be a problem and plain HTTP would go a long way for most people, without risking stuff like heart bleed and insecure servers, due to an overly complicated and often vulnerable crypto stack. Edit: I don’t see why people think this is a crazy suggestion. We used to treat MSWord-documents the same way we treat web-documents now. That is, once op deed, the document had the permission and capability to run any embedded script it wanted. In the end everyone realized this was a bad idea, and now Word-documents have to request the script-permission from the user before scripts are allowed to run. The result? MSWord-based worms and malware almost eliminated over night. And I’d like to see anyone argue that we should give HTML-email script-permissions by default. You know why that is a bad idea. So why wouldn’t want the same for the web? Why should not the web be safe by default? Why should we have to accept scripts we haven’t authorised?

UncleMeat 6y ago
Making 99.9% of websites ask for js permissions, and often break if the user clicks no, is just adding unneeded friction for the huge majority of cases. “Do you want to accept X” is also a terrible security boundary since most users won’t be able to tell when it is reasonable vs an attack scenario. The HN community loves static sites and the old web. But this is a tiny tiny tiny minority.
- josteink 6y ago
  > Making 99.9% of websites ask for js permissions, and often break if the user clicks no, is just adding unneeded friction for the huge majority of cases. That problem is solved by making sites avoid needless JS. Today I can browse almost every major news-site without JS and they won’t visually break. Same for documentation. It’s all documents after all. If I enable JS they load megabytes of scripts and still act just the same. What did those scripts bring me? Increased CPU load and lowered battery life. What is it wrong with not wanting that as default?
  - UncleMeat 6y ago
    You want that as a default. You aren't wrong for your own needs. But your needs are different than other people. The large majority of web usage is not interacting with documents. It is interacting with applications. "I wish things were like the 90s, but with broadband" is a constant refrain among techies but go talk to the rest of the world and it is absolutely not what people want.
acdha 6y ago
> But most of the websites today are not sending sensitive data back and forth, they are simply sending public data from public websites. Really? Most websites don't have login systems? Don't ever have content you might not want everyone to know you're reading? Don't allow you to post messages you might want to keep separate? Don't allow you to search for things you want to keep private?
icebraining 6y ago
> But most of the websites today are not sending sensitive data back and forth, they are simply sending public data from public websites. I disagree. Most websites include some sort of login system, at least for the editors to use (e.g. Wordpress). And the few that don't, often include data that doesn't need to be private, but should be signed (e.g. GPG key fingerprints).

UncleMeat 6y ago

Making 99.9% of websites ask for js permissions, and often break if the user clicks no, is just adding unneeded friction for the huge majority of cases. “Do you want to accept X” is also a terrible security boundary since most users won’t be able to tell when it is reasonable vs an attack scenario. The HN community loves static sites and the old web. But this is a tiny tiny tiny minority.

josteink 6y ago
> Making 99.9% of websites ask for js permissions, and often break if the user clicks no, is just adding unneeded friction for the huge majority of cases. That problem is solved by making sites avoid needless JS. Today I can browse almost every major news-site without JS and they won’t visually break. Same for documentation. It’s all documents after all. If I enable JS they load megabytes of scripts and still act just the same. What did those scripts bring me? Increased CPU load and lowered battery life. What is it wrong with not wanting that as default?
- UncleMeat 6y ago
  You want that as a default. You aren't wrong for your own needs. But your needs are different than other people. The large majority of web usage is not interacting with documents. It is interacting with applications. "I wish things were like the 90s, but with broadband" is a constant refrain among techies but go talk to the rest of the world and it is absolutely not what people want.

acdha 6y ago

> But most of the websites today are not sending sensitive data back and forth, they are simply sending public data from public websites. Really? Most websites don't have login systems? Don't ever have content you might not want everyone to know you're reading? Don't allow you to post messages you might want to keep separate? Don't allow you to search for things you want to keep private?

icebraining 6y ago

> But most of the websites today are not sending sensitive data back and forth, they are simply sending public data from public websites. I disagree. Most websites include some sort of login system, at least for the editors to use (e.g. Wordpress). And the few that don't, often include data that doesn't need to be private, but should be signed (e.g. GPG key fingerprints).