3 ms·

I see a lot of hypocritical bullshit on Hacker News - a lot of it from websites which frustratingly lack HTTPS support - but this takes the cake. This has got

I see a lot of hypocritical bullshit on Hacker News - a lot of it from websites which frustratingly lack HTTPS support - but this takes the cake. This has got to be some of the most hypocritical bullshit I've ever read. This all-text website, wherein the author espouses the benefits of "the open web" and rails against the corporate overlords who would destroy the web... this all-text website won't even load unless you enable third-party JavaScript access from FOUR external domains[1]. A fifth domain loads a font from - you guessed it - Google Fonts. This has got to be satire. [1](https://i.imgur.com/rKj4Xkv.png https://i.imgur.com/rKj4Xkv.png) P.S. Nobody's mentioned encryption as a means against against surveillance. You might be fine browsing websites openly in HTTP, but the poor soul in China might just appreciate transport-level encryption and encrypted DNS when they choose to read whatever innocuous pro-democracy blog their country has deemed unsuitable.

galkk 3y ago
Alas, in $CURRENT_YEAR I do think that for non-technical people the https can not guarantee no eyesdropping by government. In fact, I personally believe that in many countries this is already happening in one way or another. example from 2019: https://meduza-io.translate.goog/cards/zhiteley-kazahstana-zastavlyayut-ustanovit-natsionalnyy-sertifikat-bezopasnosti-chto-proishodit?_x_tr_sl=en&_x_tr_tl=ru&_x_tr_hl=en&_x_tr_pto=wapp https://meduza-io.translate.goog/cards/zhiteley-kazahstana-z...
johnea 3y ago
You're not wrong about the javascript, but that doesn't make you right about the https. This enforcement is ridiculous. I've wondered if I had chance at a law suite against goggle (and their lapdogs at mozzila foundation) for calling some of my domains "illegitimate" because I use self-signed certs. Just because I didn't pay twate, or get my cert from someone else who paid twate, doesn't mean my site is "illegitimate". Luckily for me, I'm not trying to launch the next twitverse. I use those domains for my own work, they're not out there to be popular. The article never delves into the world of small network attached devices, some of which are in use long long after their manufactures have been purchased and shut down by the same asshole trying to make you throw it out because it's encryption algorithms are too old, or, Oh No!!!, it uses http for it's webinterface. In the end, https only is goggle power play propped up by fanboi-ism...

galkk 3y ago

Alas, in $CURRENT_YEAR I do think that for non-technical people the https can not guarantee no eyesdropping by government. In fact, I personally believe that in many countries this is already happening in one way or another. example from 2019: https://meduza-io.translate.goog/cards/zhiteley-kazahstana-zastavlyayut-ustanovit-natsionalnyy-sertifikat-bezopasnosti-chto-proishodit?_x_tr_sl=en&_x_tr_tl=ru&_x_tr_hl=en&_x_tr_pto=wapp https://meduza-io.translate.goog/cards/zhiteley-kazahstana-z...

johnea 3y ago

You're not wrong about the javascript, but that doesn't make you right about the https. This enforcement is ridiculous. I've wondered if I had chance at a law suite against goggle (and their lapdogs at mozzila foundation) for calling some of my domains "illegitimate" because I use self-signed certs. Just because I didn't pay twate, or get my cert from someone else who paid twate, doesn't mean my site is "illegitimate". Luckily for me, I'm not trying to launch the next twitverse. I use those domains for my own work, they're not out there to be popular. The article never delves into the world of small network attached devices, some of which are in use long long after their manufactures have been purchased and shut down by the same asshole trying to make you throw it out because it's encryption algorithms are too old, or, Oh No!!!, it uses http for it's webinterface. In the end, https only is goggle power play propped up by fanboi-ism...