4 ms·

I agree. Why would you think that I thought the free Internet is the only thing that has value? That's a nonsensical position. My point was that if a company sh

by gfodor 6y ago

I agree. Why would you think that I thought the free Internet is the only thing that has value? That's a nonsensical position. My point was that if a company shuts this down with an SSL cert hack of some kind, it may be just or even backed by law enforcement, but it exposes a vector for suppression by corporations of the Internet that I had not considered before and we need to understand the high order effects from that.

PaulDavisThe1st 6y ago
Just yesterday HN had a link to an article on plaintext HTTP for the modern era. I'm not condoning illegal/dubious attempts to silence dissent, but loss of an SSL cert doesn't really suppress anyone's ability to communicate. Tell me I'm wrong.
- gfodor 6y ago
  You're wrong to the degree SSL becomes a requirement burned into browsers, which seems highly likely and is partially true already for certain domains. Unless you're going to argue that being forced onto the non-web is not suppressing your ability to communicate, but if so that's a tough argument to dig into here. edit: I should add here the thought exercise is that you are participating in speech that is legal and ethical but are overruled by SSL cert providers and are unable to get a root signed cert from anyone (or whatever other means of preventing SSL.) In that case, even if you are not hard blocked, having your speech be passed around the internet in cleartext also seems like it affects your ability to communicate in a negative way.
  - PaulDavisThe1st 6y ago
    as noted by others, you do not need an SSL cert to be on the web. You need an SSL cert to use https, which is something entirely different.
- beerandt 6y ago
  1) Browsers no longer let you (easily/ 2-click) override some ssl errors, and the overwhelming trend has been to start treating a lack of https similar to an ssl error, as far as ui goes. 2) Is this practically any different than saying newsgroups, or even bbs(?), still exist, so those avenues for free speech are viable remedies for being otherwise suppressed.
  - farisjarrah 6y ago
    To your first point: Firefox still lets you easily override a ssl error with 2 clicks. Go to the site, click "Advanced" and then click "Accept the risk and continue". Using the most up to date version of firefox on MacOS, Linux and Windows.
    - beerandt 6y ago
      Only for certain types of ssl errors. The advanced button has been removed from some of the error pages. *Although it's mostly been chrome. I did at least see it on Firefox while att tried to MitM errors during a recent outage. I believe the recent att router bit-flipping issue resulted in the same.
    - tsimionescu 6y ago
      I'm pretty sure that even FF won't let you easily override an error on a site with HSTS that presents an invalid certificate.
  - grkvlt 6y ago
    1. seems unlikely. I don't think there's any mainstream browser that presents http://myrandomsite.whatever/ http://myrandomsite.whatever/ as an SSL error, in the same way as, say https://google.com/ https://google.com/ having an invalid certificate, nor is there ever likely to be.

by gfodor 6y ago

PaulDavisThe1st 6y ago

Just yesterday HN had a link to an article on plaintext HTTP for the modern era. I'm not condoning illegal/dubious attempts to silence dissent, but loss of an SSL cert doesn't really suppress anyone's ability to communicate. Tell me I'm wrong.

gfodor 6y ago
You're wrong to the degree SSL becomes a requirement burned into browsers, which seems highly likely and is partially true already for certain domains. Unless you're going to argue that being forced onto the non-web is not suppressing your ability to communicate, but if so that's a tough argument to dig into here. edit: I should add here the thought exercise is that you are participating in speech that is legal and ethical but are overruled by SSL cert providers and are unable to get a root signed cert from anyone (or whatever other means of preventing SSL.) In that case, even if you are not hard blocked, having your speech be passed around the internet in cleartext also seems like it affects your ability to communicate in a negative way.
- PaulDavisThe1st 6y ago
  as noted by others, you do not need an SSL cert to be on the web. You need an SSL cert to use https, which is something entirely different.
beerandt 6y ago
1) Browsers no longer let you (easily/ 2-click) override some ssl errors, and the overwhelming trend has been to start treating a lack of https similar to an ssl error, as far as ui goes. 2) Is this practically any different than saying newsgroups, or even bbs(?), still exist, so those avenues for free speech are viable remedies for being otherwise suppressed.
- farisjarrah 6y ago
  To your first point: Firefox still lets you easily override a ssl error with 2 clicks. Go to the site, click "Advanced" and then click "Accept the risk and continue". Using the most up to date version of firefox on MacOS, Linux and Windows.
  - beerandt 6y ago
    Only for certain types of ssl errors. The advanced button has been removed from some of the error pages. *Although it's mostly been chrome. I did at least see it on Firefox while att tried to MitM errors during a recent outage. I believe the recent att router bit-flipping issue resulted in the same.
  - tsimionescu 6y ago
    I'm pretty sure that even FF won't let you easily override an error on a site with HSTS that presents an invalid certificate.
- grkvlt 6y ago
  1. seems unlikely. I don't think there's any mainstream browser that presents http://myrandomsite.whatever/ http://myrandomsite.whatever/ as an SSL error, in the same way as, say https://google.com/ https://google.com/ having an invalid certificate, nor is there ever likely to be.