4 ms·

The article is very short and to the point. Bravo! This Firefox change sounds reasonable to me. Why would this not be a good idea?

jeroenhd 5y ago
As long as they plan to keep the option up download over HTTP forever, I think this is a good idea. However, I fear the day Mozilla will consider HTTP downloads obsolete the same wah they did away with FTP. The direction Mozilla is taking Firefox makes me distrust any barriers they're throwing up that are coined as "security" features.
- Santosh83 5y ago
  Mozilla is being forced to follow the industry leaders here. And if ever HTTP is completely removed, that will first happen from their tech giants and browser choke hold, and Mozilla will have little choice but to follow behind.
  - Buttons840 5y ago
    If Chrome blocks plain old HTTP, why would Firefox have to do the same?
  - LocalH 5y ago
    That doesn't make sense. Mozilla is forced to do nothing just because Chrome does it. In what way are they "forced"?
- sp332 5y ago
  Firefox Nightly did just block the downloads for a while. I think this implementation must have been based on feedback from that very annoying experiment.
- breakingcups 5y ago
  I run Nightly and it had the very annoying issue that overruling the browser to actually download the HTTP-only download would fail 100% of the time. I hope they fixed that because there are still hundreds of valuable, older resources out there that I regularly download documents from.
superkuh 5y ago
The modern take that TLS only is required and must be enforced for everything, combined with the fact that TLS cert providers operate with normal power law popularity, means that by blocking HTTP sites and making mixed HTTP+HTTPS sites unusable in ways like this large segments of the web will have single points of technical or political failure. TLS-*only* centralizes. LetsEncrypt's charter is made to resist corruption but as it's scale and the money involved grows it will probably end up going bad like dot Org did. That would be very bad for the web. Keeping HTTP and HTTP+HTTPS support around without stigmatizing or hiding it behind 2+ clickthrough warnings would prevent that failure mode.
- heurisko 5y ago
  > TLS-only centralizes. It depends what you mean by centralizes. I can buy an SSL certificate from any number of companies. There has to be some initial root point of trust.
  - Santosh83 5y ago
    > There has to be some initial root point of trust. For security critical web apps, this makes sense. For mere documents and simple sites without authentication or sensitive information, self-signed certificates should become acceptable, IMO.
    - theandrewbailey 5y ago
      How does a browser know which URLs are 'critical web apps' so that it can, if necessary, throw a big scary warning to the user? What stops a random website from self-identifying as critical (or not)? The S in HTTPS guarantees things. If those guarantees are loosened, that can cause bad problems.
  - hulitu 5y ago
    Do you trust this root point ? Are you sure that the root is not compromised ? Because Google is saying so ?
LinuxBender 5y ago
The option to continue to allow non TLS should alleviate concerns. I can think of cases where vendor managed internal self signed certs are problematic and some IoT don't do TLS. Without getting into ideological debates, having a way to work around old, incomplete or clunky systems may be important to keep the browser relevant or useful.
hulitu 5y ago
If the big strong boy does it, it must be good. Who is firefox to decide about my actions ? Why a stoopid program prone to RCE shall know better ? Why do i have to go to about:config and disable safe browsing to be able to surf the web ?

jeroenhd 5y ago

As long as they plan to keep the option up download over HTTP forever, I think this is a good idea. However, I fear the day Mozilla will consider HTTP downloads obsolete the same wah they did away with FTP. The direction Mozilla is taking Firefox makes me distrust any barriers they're throwing up that are coined as "security" features.

Santosh83 5y ago
Mozilla is being forced to follow the industry leaders here. And if ever HTTP is completely removed, that will first happen from their tech giants and browser choke hold, and Mozilla will have little choice but to follow behind.
- Buttons840 5y ago
  If Chrome blocks plain old HTTP, why would Firefox have to do the same?
- LocalH 5y ago
  That doesn't make sense. Mozilla is forced to do nothing just because Chrome does it. In what way are they "forced"?
sp332 5y ago
Firefox Nightly did just block the downloads for a while. I think this implementation must have been based on feedback from that very annoying experiment.
breakingcups 5y ago
I run Nightly and it had the very annoying issue that overruling the browser to actually download the HTTP-only download would fail 100% of the time. I hope they fixed that because there are still hundreds of valuable, older resources out there that I regularly download documents from.

superkuh 5y ago

The modern take that TLS only is required and must be enforced for everything, combined with the fact that TLS cert providers operate with normal power law popularity, means that by blocking HTTP sites and making mixed HTTP+HTTPS sites unusable in ways like this large segments of the web will have single points of technical or political failure. TLS-*only* centralizes. LetsEncrypt's charter is made to resist corruption but as it's scale and the money involved grows it will probably end up going bad like dot Org did. That would be very bad for the web. Keeping HTTP and HTTP+HTTPS support around without stigmatizing or hiding it behind 2+ clickthrough warnings would prevent that failure mode.

heurisko 5y ago
> TLS-only centralizes. It depends what you mean by centralizes. I can buy an SSL certificate from any number of companies. There has to be some initial root point of trust.
- Santosh83 5y ago
  > There has to be some initial root point of trust. For security critical web apps, this makes sense. For mere documents and simple sites without authentication or sensitive information, self-signed certificates should become acceptable, IMO.
  - theandrewbailey 5y ago
    How does a browser know which URLs are 'critical web apps' so that it can, if necessary, throw a big scary warning to the user? What stops a random website from self-identifying as critical (or not)? The S in HTTPS guarantees things. If those guarantees are loosened, that can cause bad problems.
- hulitu 5y ago
  Do you trust this root point ? Are you sure that the root is not compromised ? Because Google is saying so ?

LinuxBender 5y ago

The option to continue to allow non TLS should alleviate concerns. I can think of cases where vendor managed internal self signed certs are problematic and some IoT don't do TLS. Without getting into ideological debates, having a way to work around old, incomplete or clunky systems may be important to keep the browser relevant or useful.

hulitu 5y ago

If the big strong boy does it, it must be good. Who is firefox to decide about my actions ? Why a stoopid program prone to RCE shall know better ? Why do i have to go to about:config and disable safe browsing to be able to surf the web ?