3 ms·

> The situation with bad application behaviors being "baked into the code" and propagating to all the "free" distributions is very sad, similar to what's happen

> The situation with bad application behaviors being "baked into the code" and propagating to all the "free" distributions is very sad, similar to what's happening with both Chrome and Firefox. > For example, HSTS is now baked into the all the standard distributions and there's absolutely no way (that I've found) to turn it off. I understand the "security" reasons behind it for regular users, but as someone mindful and often completely unable to access a website only because their certificate has expired, I am quite miffed. I triple checked because I wanted to be absolutely sure: HSTS is a response header (Strict-Transport-Security) sent by the server. It is expressed as the intent of the website you’re trying to visit that it shouldn’t be accessed insecurely. The “bad application behavior” is honoring the site’s express intent and the standard, voluntarily adopted by the server you’re trying to access. You’re certainly welcome to use or write your own HTTP client which ignores the intent of resources you want to access. You’re just as welcome to write your own browser which ignores CORS and all manner of other client/user protections. It’s baffling that you feel entitled to have people do that work for you. Particularly because nearly all of the work already has been done for you, and you’re still miffed because they didn’t cater to your preferences in the exact way you want.

zzo38computer 4y ago
They aren't the only one; many people have similar opinions (including myself), that it should do what the end user specifies instead of what the server specifies. Better web browsers will need to be written, and it isn't so simple to do. (I have some ideas about it, though.) (You are right that HSTS is a response header, but I think that it is a bad idea. Even though I have a old version of Firefox, I had to edit one of the files to make it unable to recognize that response header, and change many other things.)
- eyelidlessness 4y ago
  > Even though I have a old version of Firefox, I had to edit one of the files to make it unable to recognize that response header, and change many other things. You can edit newer versions too. It’s fully open source, the world is your insecure oyster! > You are right that HSTS is a response header, but I think that it is a bad idea. Fortunately for both of us, I can enjoy the good idea and you can enjoy exposing yourself to potentially compromised websites! Hopefully no one is harmed.
denkmoon 4y ago
About HSTS that is only true sometimes. Google helpfully enabled HSTS on all .dev domains by putting it on the hsts preload list. Now I cannot practically serve HTTP from a .dev domain even if I wanted to. That's hardly voluntary. Baffling to me is that one would assume .dev domains are being used for development adjacent purposes. I might, for example, have a piece of in-development software or infrastructure where it is not convenient or even possible without significant effort to get a valid SSL certificate. Now I just can't use that with my .dev domain. Can't use self signed certs on a "development" domain either - who would want to do that though! :)

zzo38computer 4y ago

They aren't the only one; many people have similar opinions (including myself), that it should do what the end user specifies instead of what the server specifies. Better web browsers will need to be written, and it isn't so simple to do. (I have some ideas about it, though.) (You are right that HSTS is a response header, but I think that it is a bad idea. Even though I have a old version of Firefox, I had to edit one of the files to make it unable to recognize that response header, and change many other things.)

eyelidlessness 4y ago
> Even though I have a old version of Firefox, I had to edit one of the files to make it unable to recognize that response header, and change many other things. You can edit newer versions too. It’s fully open source, the world is your insecure oyster! > You are right that HSTS is a response header, but I think that it is a bad idea. Fortunately for both of us, I can enjoy the good idea and you can enjoy exposing yourself to potentially compromised websites! Hopefully no one is harmed.

denkmoon 4y ago

About HSTS that is only true sometimes. Google helpfully enabled HSTS on all .dev domains by putting it on the hsts preload list. Now I cannot practically serve HTTP from a .dev domain even if I wanted to. That's hardly voluntary. Baffling to me is that one would assume .dev domains are being used for development adjacent purposes. I might, for example, have a piece of in-development software or infrastructure where it is not convenient or even possible without significant effort to get a valid SSL certificate. Now I just can't use that with my .dev domain. Can't use self signed certs on a "development" domain either - who would want to do that though! :)