5 ms·

That's almost a list of the countries that US has present embargoes with – close enough anyway to make me think it's not a coincidence. Perhaps they're using s

by wheels 16y ago

That's almost a list of the countries that US has present embargoes with – close enough anyway to make me think it's not a coincidence. Perhaps they're using strong cryptography and those are the nations which are not approved to export crypto to (and hence, perhaps not supported in local versions of IE)? http://en.wikipedia.org/wiki/United_States_embargoes http://en.wikipedia.org/wiki/United_States_embargoes http://en.wikipedia.org/wiki/Export_of_cryptography_in_the_United_States#Current_status http://en.wikipedia.org/wiki/Export_of_cryptography_in_the_U...

tshtf 16y ago
Libya is a glaring omission, and there's a war there. There are also countries being blocked that are not on the crypto embargo list. Regardless, a response from Microsoft would be appropriate here.
- rbanffy 16y ago
  > Libya is a glaring omission, and there's a war there. Maybe not all governments are Microsoft-friendly...
  - daeken 16y ago
    Do you really think this crypto blacklist is a result of internal politics rather than external? If so, why?
    - rbanffy 16y ago
      Isn't the timing a little bit suspicious for many countries on the list? Is Microsoft being pressed by the US government about allowing citizens of those countries to use HTTPS (is allowing HTTPS exporting crypto?)? Are they being pressured not to drop HTTPS for Libyans?
Natsu 16y ago
El Reg talked to Microsoft and claims it's a bug. Still, why would changing one's country make HTTPS available again? Why those countries? All in all, it really makes them look bad, even if there's an innocent explanation. http://www.theregister.co.uk/2011/03/26/microsoft_https_hotmail_syria/ http://www.theregister.co.uk/2011/03/26/microsoft_https_hotm...
- WalterGR 16y ago
  Still, why would changing one's country make HTTPS available again? Despite EFF's headline, it doesn't sound like this made HTTPS unavailable, but rather the "always-use-HTTPS" setting. Why those countries? Here's a guess: it was a localization issue. I bet changing your country changes your default language. And I also bet that the availability of localized strings (i.e. "Is string 8230 available in language X?") affects what options are shown to the user. After all, if a descriptive string isn't available in the user's current language, how do you show them the option? So what exactly happened? I don't know. Maybe they whacked some part of a localization table. Or rolled back to a previous localization table. Or mangled mappings from "language" to "current localization table". Software is complex. All in all, it really makes them look bad, even if there's an innocent explanation. The timing certainly invites theories of maliciousness.
  - Natsu 16y ago
    While that seems like a plausible explanation, I have a hard time understanding what changed to trigger it. I mean, surely they had it translated beforehand, so what mangled things to make it believe there was no translation? Also, weirdly enough, the error that got shown was in English. Not that it proves anything, but it makes it seem like the language settings were set to English, in spite of the location. So, yeah, I'm going to be very curious about the explanation of this one. For the record, I do think that it could be innocent, but this kind of thing really invites people to think the worst.
- JonnieCache 16y ago
  Still, why would changing one's country make HTTPS available again? Could also be to do with geographical regions being on different infrastructure, perhaps with slightly different versions of the code deployed to them. Maybe some broken logic in a proxy or something. All it could take is a couple of bits flipped. There are many, many possible reasons for glitches like this in a system this large.

by wheels 16y ago

tshtf 16y ago

Libya is a glaring omission, and there's a war there. There are also countries being blocked that are not on the crypto embargo list. Regardless, a response from Microsoft would be appropriate here.

rbanffy 16y ago
> Libya is a glaring omission, and there's a war there. Maybe not all governments are Microsoft-friendly...
- daeken 16y ago
  Do you really think this crypto blacklist is a result of internal politics rather than external? If so, why?
  - rbanffy 16y ago
    Isn't the timing a little bit suspicious for many countries on the list? Is Microsoft being pressed by the US government about allowing citizens of those countries to use HTTPS (is allowing HTTPS exporting crypto?)? Are they being pressured not to drop HTTPS for Libyans?

Natsu 16y ago

El Reg talked to Microsoft and claims it's a bug. Still, why would changing one's country make HTTPS available again? Why those countries? All in all, it really makes them look bad, even if there's an innocent explanation. http://www.theregister.co.uk/2011/03/26/microsoft_https_hotmail_syria/ http://www.theregister.co.uk/2011/03/26/microsoft_https_hotm...

WalterGR 16y ago
Still, why would changing one's country make HTTPS available again? Despite EFF's headline, it doesn't sound like this made HTTPS unavailable, but rather the "always-use-HTTPS" setting. Why those countries? Here's a guess: it was a localization issue. I bet changing your country changes your default language. And I also bet that the availability of localized strings (i.e. "Is string 8230 available in language X?") affects what options are shown to the user. After all, if a descriptive string isn't available in the user's current language, how do you show them the option? So what exactly happened? I don't know. Maybe they whacked some part of a localization table. Or rolled back to a previous localization table. Or mangled mappings from "language" to "current localization table". Software is complex. All in all, it really makes them look bad, even if there's an innocent explanation. The timing certainly invites theories of maliciousness.
- Natsu 16y ago
  While that seems like a plausible explanation, I have a hard time understanding what changed to trigger it. I mean, surely they had it translated beforehand, so what mangled things to make it believe there was no translation? Also, weirdly enough, the error that got shown was in English. Not that it proves anything, but it makes it seem like the language settings were set to English, in spite of the location. So, yeah, I'm going to be very curious about the explanation of this one. For the record, I do think that it could be innocent, but this kind of thing really invites people to think the worst.
JonnieCache 16y ago
Still, why would changing one's country make HTTPS available again? Could also be to do with geographical regions being on different infrastructure, perhaps with slightly different versions of the code deployed to them. Maybe some broken logic in a proxy or something. All it could take is a couple of bits flipped. There are many, many possible reasons for glitches like this in a system this large.