Hacker News Search

quickthrower2 4y ago
Yellow address bar when getting near to expiration would also work, right without changes to what expiration means. Then people using SSL will renew earlier to avoid embarrassment.
- ocdtrekkie 4y ago
  That's also arguably acceptable, yes, though the renewal timeline is already quite aggressive if you aren't able to use ACME for whatever particular reason. I have yet to see any example of a real security risk involving a barely expired certificate. It seems that we invented a way to make the web extremely fragile for... really no good reason.
  - execveat 4y ago
    Without HSTS browser might fall back to HTTP which would disclose passwords and sessions leading to account compromise. I'm a penetration tester / red teamer and we do this all the time. DEFCON has been hosting a Wall of Sheep since forever. They capture and analyze traffic then publish the leaked credentials and other fun stuff. Apparently it's still going: https://www.youtube.com/watch?v=4ZabsNgMHCM https://www.youtube.com/watch?v=4ZabsNgMHCM . Here's your example.
  - josephcsible 4y ago
    > if you aren't able to use ACME for whatever particular reason. What are some technical reasons you might not be able to do this? I've only ever seen stupid bureaucratic reasons firsthand.
    - ocdtrekkie 4y ago
      So a lot of times you may be feeding a certificate into a bespoke enterprise application. Some of them just load it into IIS and off you go, but some of them end up being Java platform crud where you need weird incantations just to import them at all. (And sometimes it's those same weird applications that also decide to opt you into HSTS...)
josephcsible 4y ago
> HSTS should be considered hostile and not recommended until amended with the removal of the "no user agency" clause. Have you seen the new malicious websites with fake CAPTCHAs that say "click allow to this dialog box to prove you're human"? If you give nontechnical users an easy way to bypass a security check, the bad guys will just tell them to do so, and they'll listen. And remember that if a technical user really does need to bypass HSTS, they can, even if it means editing a SQLite database by hand.

narrator 4y ago

Go over to the dark side http://Yandex.com http://Yandex.com . It's the only thing that's decent that doesn't rely on Google or Bing.

BurningPenguin 4y ago
Only if you want to read Russian propaganda.
- coffeeblack 4y ago
  Probably depends what you are searching for. Some sql or Go topic should be fine. Info in NATO probably not. Then again, there are topics that are full of propaganda on Google too, sadly.
  - BurningPenguin 4y ago
    Google simply shows you what it thinks you want to see, as long as nobody (with money) complains. Yandex shows you what the Russian state wants you to see. And they aren't even subtle.
    - whimsicalism 4y ago
      Do you have an example? A simple search of information around the Russia-Ukraine conflict has Yandex actively suggesting I search for the "Russian-Ukraine war" (despite references to a war being illegal in Russia) and the first result is a Russian wikipedia article that seems, if anything, pro-Ukraine. Looking up "Putin election" delivers me several prominent articles saying Russia's most recent election was fraudulent. I'm guessing it is different if you are actually based in mainland Russia and using Yandex, but it does not seem so tilted as you are suggesting for Western, english users.
      - coffeeblack 4y ago
        Interesting, I never used Yandex tbh. I thought it was under indirect state control, like vk and others. Will try to use it more often to see what results it has.
        BurningPenguin 4y ago
        They are. Their news section only has media that is state approved. They probably don't even have much of a choice, if they don't want to be shut down...
      - BurningPenguin 4y ago
        I'm in Germany. I simply searched for "Ukraine" and set the result language to "German". The first two results are from "Russia Today" and "News-Front", both well known for skewing facts or outright lying. "News-Front" for example reports that Putin is supposedly very popular in Germany and Austria. This isn't true at all. The only people who are worshiping him are the far-right and far-left. They are not the majority. Searching for "Deutschland" results in "deutschland.de" which is ok but then, once again, followed by "News-Front" and "anti-spiegel", some crappy Wordpress conspiracy blog. I also took the liberty to search for "Proteste in Deutschland" (protests in Germany), and low and behold: First 3 results: Wikipedia, "Russia Today" and "Report24". The last one yet another propaganda website run by "Querdenker" (our version of Qanon-style Antivaxx nutjobs). Searching for "Ukraine Krieg" (Ukraine war) once again leads to RT and News-Front. "Energiewende" is also a quite popular word in Germany. What does yandex say to this? Again, first 2 results are ok. Third result? That shitty Querdenker page "Report24" again. 5th result is Russia Today. And somewhere at the end i even spot "Reitschuster", a known right-extremist blog. There is no way in hell, that these websites are so well optimized, that they outperform every single outlet in existence, for pretty much every keyword i can think of just now. Especially not some shitty Wordpress page (Report24) that was clicked together in mere days and online for just a single year. Searching for these keywords in the localized version of Google and even Bing gives wildly different results. There is no sign that any outlets are preferred. Sometimes i see right-leaning sources on the top of the first page, sometimes it's left-leaning, other times it's some trash tabloid like the "BILD". So either their search algorithm is complete and utter trash, or they are actively boosting pro-russian websites and mix them up with a few established news outlets, to make them seem more trustworthy. Since their "news" section is also only allowed to show state-approved media, my guess wouldn't be very far off.
        whimsicalism 4y ago
        interesting. I see what you mean when I just search "Ukraine" on Yandex in English, with both RT & Sputnik featuring prominently. Multi-word searches seem less prone to this. What happens if you search "Putin election" in German? Do you get articles critiquing the election or still praiseworthy articles?
    - coffeeblack 4y ago
      Google too seems to ideologically clean up certain search results.
      - BurningPenguin 4y ago
        Not really. They may filter some stuff, if it is outright illegal and has caused enough outrage or someone complains about copyright. And if you have an account there, they'll try and give you results you most likely want to read. Which opens up the risk to end up in an echo chamber.