3 ms·

There's still plenty of useful websites that are HTTP-only or that have HTTPS misconfigured. The HTTPS-only mode will break them, whereas HTTPS Everywhere just

by jwilk 4y ago

There's still plenty of useful websites that are HTTP-only or that have HTTPS misconfigured. The HTTPS-only mode will break them, whereas HTTPS Everywhere just works.

thebeardisred 4y ago
+1. I was having this sort of issue setting up an Android tablet as a wifi CNC pendant. The controller is based on an ESP32 (which has limited storage for a full cert chain) and I run it without a gateway address on it's own VLAN. I'm certain it's "secure enough". Turns out Android + Firefox mobile keeps trying to turn "http" to "https" and at the same time specifying the IP + port explicitly in the URL is considered malicious by Firefox. "This address uses a network port which is normally used for purposes other than Web browsing. Firefox has canceled the request for your protection." I had to run a development version of Firefox just to be able to get to "about:config" to disable the behavior.
- tialaramex 4y ago
  But why pick a port that's never traditionally used for HTTP ? Firefox isn't just assuming all ports are prohibited, it has a relatively short list of ports where we know it's crazy to pick HTTP on those ports and sometimes people do it to exploit protocol parsing issues, so it forbids that.
deleted 4y ago
[deleted]
philsnow 4y ago
Exactly this. In Firefox, the suggested replacement is to use the force https setting, but that is for the whole browser instance instead of the domain of the current tab. If I disable force https to make some site work, I have to remember to turn it back on when I'm done, and if I'm going back and forth between sites on different tabs/windows where some support https and some don't, it's a huge pain. I don't even know how disabling it affects already-loaded pages in other tabs. If each page/tab caches the setting on page load and still respects it when it gets changed, maybe that's fine... but if js-driven background requests on all my other tabs suddenly don't force https when I disable the setting to visit paulgraham.com, then that's not a good replacement for https everywhere.
kevincox 4y ago
There is still a "use HTTP" button that shows up on these pages. So it just makes me aware of the insecure connection, not actually me from preventing me to use any HTTP sites that I choose to use.

by jwilk 4y ago

There's still plenty of useful websites that are HTTP-only or that have HTTPS misconfigured. The HTTPS-only mode will break them, whereas HTTPS Everywhere just works.

thebeardisred 4y ago

+1. I was having this sort of issue setting up an Android tablet as a wifi CNC pendant. The controller is based on an ESP32 (which has limited storage for a full cert chain) and I run it without a gateway address on it's own VLAN. I'm certain it's "secure enough". Turns out Android + Firefox mobile keeps trying to turn "http" to "https" and at the same time specifying the IP + port explicitly in the URL is considered malicious by Firefox. "This address uses a network port which is normally used for purposes other than Web browsing. Firefox has canceled the request for your protection." I had to run a development version of Firefox just to be able to get to "about:config" to disable the behavior.

tialaramex 4y ago
But why pick a port that's never traditionally used for HTTP ? Firefox isn't just assuming all ports are prohibited, it has a relatively short list of ports where we know it's crazy to pick HTTP on those ports and sometimes people do it to exploit protocol parsing issues, so it forbids that.

deleted 4y ago

[deleted]

philsnow 4y ago

Exactly this. In Firefox, the suggested replacement is to use the force https setting, but that is for the whole browser instance instead of the domain of the current tab. If I disable force https to make some site work, I have to remember to turn it back on when I'm done, and if I'm going back and forth between sites on different tabs/windows where some support https and some don't, it's a huge pain. I don't even know how disabling it affects already-loaded pages in other tabs. If each page/tab caches the setting on page load and still respects it when it gets changed, maybe that's fine... but if js-driven background requests on all my other tabs suddenly don't force https when I disable the setting to visit paulgraham.com, then that's not a good replacement for https everywhere.

kevincox 4y ago

There is still a "use HTTP" button that shows up on these pages. So it just makes me aware of the insecure connection, not actually me from preventing me to use any HTTP sites that I choose to use.