5 ms·

Perhaps, but I have personally gone back all in with Firefox. I've gained the ability to not have a wanker tell me how https works and be a total pain. Cr bro

Perhaps, but I have personally gone back all in with Firefox. I've gained the ability to not have a wanker tell me how https works and be a total pain. Cr browsers will never enter saved creds into a site that isn't "fully trusted". FF will respect your choice after quite a lot of admonishment. I've been using SSL and TLS longer than some of the knobends programming these fucking things have been alive. There is a difference between being opinionated and a dick. FF is opinionated and Cr is a dick. To be fair: FF and Cr have an equally awful "show me the fucking cert and stop making my life more miserable" workflow. Why is it such a drawn out routine to see the cert details? I personally spend a lot ... a lot of my time with SSL/TLS - and you fuckwits literally make my life harder by hiding it away in some silly "don't worry your pretty head" thing. My first browser was telnet and I am mildly irritated.

netsharc 3y ago
Recently I opened Firefox and it said "Thank you for loving Firefox"... Geezus, maybe I should fork it and add the Overly Attached Girlfriend memes all over the place: https://knowyourmeme.com/memes/overly-attached-girlfriend https://knowyourmeme.com/memes/overly-attached-girlfriend
- gerdesj 3y ago
  Yes, that too is getting on my tits. What on earth passes for rational thought these days?
_jal 3y ago
Heard. FF is the least irritating of a bad lot. I'd really like a "programmer's build" or something, with knobs for this stuff - FF used to be better about exposing them in preferences, even if it was a bit obscure. I can usually get by with curl and/or wget for troubleshooting purposes, but dealing with broken things you actually need to use to fix is far more annoying than it should be, "for my own good". The thing that irrationally irritates me the most about FF is the uncounted minutes of my life spent waiting for the countdown buttons to let me click them.
- gerdesj 3y ago
  Perhaps if we whine about this in an environment populated with a lot of like minded folk, the message might get through. I can't help but think that there are people in Google/Mozzie/n Co that simply put up with all this nonsense. Has anyone, developing a browser ever bothered to think that the audience is quite diverse, that say, there are multiple uses for a browser? Also that there are different people using the bloody things? My wife has rather different use cases for her browser than I do. The lack of imagination from web browser developers - or at least their directors or specifiers is absolutely breathtaking. You will have to do rather better than "Here be dragons" etc as a UI for this sort of thing.
- julianlam 3y ago
  Oh, the knobs are all there, in about:config heh.
  - gerdesj 3y ago
    Yes they are ... hidden away in about:config. I assert there is more than one way to rig a browser and the current config nonsense ... is nonsense and wankery. OK I am a bit peeved. No one is served properly with the current model of one browser config fits all. Why can't I have a browser that accepts that I know what I am doing wrt SSL/TLS?
  - TylerE 3y ago
    With a sign on the door saying Beware of the Leopard
- turboponyy 3y ago
  The programmer's builds are already there, e.g. Librewolf. Firefox's defaults are terrible, but most unhelpful behavior can be disabled in about:config.
- lmm 3y ago
  > FF is the least irritating of a bad lot. I'd really like a "programmer's build" or something, with knobs for this stuff - FF used to be better about exposing them in preferences, even if it was a bit obscure. Better than Konqueror?
wbl 3y ago
Because we have data showing that anything less leads to easy impersonations of sites. Browser security UI is hard.
- dcow 3y ago
  Where can I review this data?
- hedora 3y ago
  Showing certificate details on the "OMFG SOMETHING IS WRONG" page makes it easier to impersonate sites? Why not show the certificate details, explain what is wrong, and then still have the annoying click through flow?
  - mook 3y ago
    At least you're not using Firefox for Android; that doesn't even let you view cert data on sites with proper certs (like this one). Chrome on Android does.
  - dzikimarian 3y ago
    Non-technical user often concludes "this app is broken" if screen shows anything more than one liner in the tune of "website/internet connection is bad". User actually reading the screen is sadly scarce resource today.
- gerdesj 3y ago
  "Browser security UI is hard." That's my problem, not "yours". Start writing perfect code and then I will delegate. The current browser UI for SSL/TLS is actively punishing people like me who wish to get SSL working. Why not follow the example of Lets Encrypt and make it easier instead of harder? The current UI is crap for both me and my wife and we are at the polar extremes of the audience for it. Perhaps we need a faster DNS implementation or a rewrite in Rust.
nijave 3y ago
If you have admin/root, it's usually easier to just add the leaf cert to the CA trust store.
- gerdesj 3y ago
  I do but do you have any idea how many of the bloody things I have to add? I have lots of customers with VMware - the vCentres each have a CA. ... all their switches, routers, other stuff ... a lot of stuff. Each one is secure, or at least I decide if it is - I know where it is and I keep its firmware up to date. I communicate with each device over https and I know all is good. Where this nonsense goes wrong is that a browser programmer thinks that they know better than me and impose their policy on me, with no recourse. My tenon saw does not tell me how to use it. If I bark my knuckles or cut off my fingers that is my fault. My browser (maintained by fucking children) thinks it knows best for me. I suggest that the cool kids have a major rethink about who knows what's best in quite a few scenarios that they never even considered and basically grow up. That's what I had to do, back in the day and is pretty much what all adults will eventually confess to because that is what growing up means.
  - midasuni 3y ago
    That’s sort of stuff sits on an isolated vlan. My proxy (with a decent trusted very) talks to them, either via http or self signed https. Proxy also handles the authentication (via oidc or x509) and logging.
- briHass 3y ago
  I do that at home, but you still have annoyances, like Android forever warning you that you're impure because your cert hasn't been kissed by a real CA. Also, some random things are a real PITA to put your signed cert on, like Ubiquiti Unifi, where you have to mess around with the Java keystore. I wouldn't bother with any of it if it wasn't for Crome thinking I shouldn't save passwords for HTTP, even though they could clearly make an exception for domain names that resolve to private IP blocks.
dclowd9901 3y ago
Kind of tangential: I recently wanted to move the hosting of my hobby/side gig site to an S3 static site (site generated by me). Thought it would be a few configuration details in s3 and good to go. A full day later just to be usable in Chrome (since it defaults to https) I had to get a cert and standup a CDN just to make sure your average dingus web user wouldn’t try to navigate to my page and hit nothing. To be clear, my site doesn’t even have Javascript, and certainly no form submission. HTTPS is complete overkill and now it’s even more overkill overkill since I could be bombarded by half the world population and my site would likely stand up to it. In a way, they killed the hobbyist website with that bullshit.
- bruce511 3y ago
  So firstly, I agree - browsers should default to https not http if the protocol is not specified. It's a pain that they do http because it means I have to open port 80 and issue a redirect. That in itself is no big deal, since I usually have port 80 open anyway (for LetsEncrypt support.) That said, you raise a point I see a lot - your site is too "plain" to need https. Personally I think this argument is outdated. The key issue with plain sites being HTTP is that -additional- content can be injected into them. In others people might be reading text, or seeing images, that are not what you built. Advertising, sure. ISPs have fine that, but that's the least problem. What about injecting a political endorsement? What about altering any links to include (not your) affiliate id? Once you start thinking about the value of HTTP sites in this way you start to appreciate the many ways unencrypted sites can be exploited. Back in the day "amateur" meant better (because the creator had time to do it right) not worse. Being "professional" was code for "you get what you pay for, no more than that". I encourage all "hobbyist" Web producers to embrace that, to make it excellent, rather than to simply treat it as a "waste of time".
  - beachy 3y ago
    > That said, you raise a point I see a lot - your site is too "plain" to need https. Personally I think this argument is outdated. In the early days, sites would often be mainly http, then the payment part would switch to https. That soon died and I think you are correct.
rkagerer 3y ago
I agree it's retarded how the important features keep getting buried under deeper sequences of clicks.
jofla_net 3y ago
absolutely. add cache behavior to that as well, nothing is cached from non "fully trusted" pages either...
BrandoElFollito 3y ago
Probably because 99.985% of people who use a browser call it "the internet" and of these a tiny fraction knows that if there is a padlock nothing bad can happen (yes I know that the padlock is now gone because everything wasn't that safe, apparently). Then you have the 0.0something population that heard that a certificate ensures you that the site is the one you want to go to. And since it is not always the case they have up. Then there is the sub-Planck- number of these who understand what a cert is and what it is for.

netsharc 3y ago

Recently I opened Firefox and it said "Thank you for loving Firefox"... Geezus, maybe I should fork it and add the Overly Attached Girlfriend memes all over the place: https://knowyourmeme.com/memes/overly-attached-girlfriend https://knowyourmeme.com/memes/overly-attached-girlfriend

gerdesj 3y ago
Yes, that too is getting on my tits. What on earth passes for rational thought these days?

_jal 3y ago

Heard. FF is the least irritating of a bad lot. I'd really like a "programmer's build" or something, with knobs for this stuff - FF used to be better about exposing them in preferences, even if it was a bit obscure. I can usually get by with curl and/or wget for troubleshooting purposes, but dealing with broken things you actually need to use to fix is far more annoying than it should be, "for my own good". The thing that irrationally irritates me the most about FF is the uncounted minutes of my life spent waiting for the countdown buttons to let me click them.

gerdesj 3y ago
Perhaps if we whine about this in an environment populated with a lot of like minded folk, the message might get through. I can't help but think that there are people in Google/Mozzie/n Co that simply put up with all this nonsense. Has anyone, developing a browser ever bothered to think that the audience is quite diverse, that say, there are multiple uses for a browser? Also that there are different people using the bloody things? My wife has rather different use cases for her browser than I do. The lack of imagination from web browser developers - or at least their directors or specifiers is absolutely breathtaking. You will have to do rather better than "Here be dragons" etc as a UI for this sort of thing.
julianlam 3y ago
Oh, the knobs are all there, in about:config heh.
- gerdesj 3y ago
  Yes they are ... hidden away in about:config. I assert there is more than one way to rig a browser and the current config nonsense ... is nonsense and wankery. OK I am a bit peeved. No one is served properly with the current model of one browser config fits all. Why can't I have a browser that accepts that I know what I am doing wrt SSL/TLS?
- TylerE 3y ago
  With a sign on the door saying Beware of the Leopard
turboponyy 3y ago
The programmer's builds are already there, e.g. Librewolf. Firefox's defaults are terrible, but most unhelpful behavior can be disabled in about:config.
lmm 3y ago
> FF is the least irritating of a bad lot. I'd really like a "programmer's build" or something, with knobs for this stuff - FF used to be better about exposing them in preferences, even if it was a bit obscure. Better than Konqueror?

wbl 3y ago

Because we have data showing that anything less leads to easy impersonations of sites. Browser security UI is hard.

dcow 3y ago
Where can I review this data?
hedora 3y ago
Showing certificate details on the "OMFG SOMETHING IS WRONG" page makes it easier to impersonate sites? Why not show the certificate details, explain what is wrong, and then still have the annoying click through flow?
- mook 3y ago
  At least you're not using Firefox for Android; that doesn't even let you view cert data on sites with proper certs (like this one). Chrome on Android does.
- dzikimarian 3y ago
  Non-technical user often concludes "this app is broken" if screen shows anything more than one liner in the tune of "website/internet connection is bad". User actually reading the screen is sadly scarce resource today.
gerdesj 3y ago
"Browser security UI is hard." That's my problem, not "yours". Start writing perfect code and then I will delegate. The current browser UI for SSL/TLS is actively punishing people like me who wish to get SSL working. Why not follow the example of Lets Encrypt and make it easier instead of harder? The current UI is crap for both me and my wife and we are at the polar extremes of the audience for it. Perhaps we need a faster DNS implementation or a rewrite in Rust.

nijave 3y ago

If you have admin/root, it's usually easier to just add the leaf cert to the CA trust store.

gerdesj 3y ago
I do but do you have any idea how many of the bloody things I have to add? I have lots of customers with VMware - the vCentres each have a CA. ... all their switches, routers, other stuff ... a lot of stuff. Each one is secure, or at least I decide if it is - I know where it is and I keep its firmware up to date. I communicate with each device over https and I know all is good. Where this nonsense goes wrong is that a browser programmer thinks that they know better than me and impose their policy on me, with no recourse. My tenon saw does not tell me how to use it. If I bark my knuckles or cut off my fingers that is my fault. My browser (maintained by fucking children) thinks it knows best for me. I suggest that the cool kids have a major rethink about who knows what's best in quite a few scenarios that they never even considered and basically grow up. That's what I had to do, back in the day and is pretty much what all adults will eventually confess to because that is what growing up means.
- midasuni 3y ago
  That’s sort of stuff sits on an isolated vlan. My proxy (with a decent trusted very) talks to them, either via http or self signed https. Proxy also handles the authentication (via oidc or x509) and logging.
briHass 3y ago
I do that at home, but you still have annoyances, like Android forever warning you that you're impure because your cert hasn't been kissed by a real CA. Also, some random things are a real PITA to put your signed cert on, like Ubiquiti Unifi, where you have to mess around with the Java keystore. I wouldn't bother with any of it if it wasn't for Crome thinking I shouldn't save passwords for HTTP, even though they could clearly make an exception for domain names that resolve to private IP blocks.

dclowd9901 3y ago

Kind of tangential: I recently wanted to move the hosting of my hobby/side gig site to an S3 static site (site generated by me). Thought it would be a few configuration details in s3 and good to go. A full day later just to be usable in Chrome (since it defaults to https) I had to get a cert and standup a CDN just to make sure your average dingus web user wouldn’t try to navigate to my page and hit nothing. To be clear, my site doesn’t even have Javascript, and certainly no form submission. HTTPS is complete overkill and now it’s even more overkill overkill since I could be bombarded by half the world population and my site would likely stand up to it. In a way, they killed the hobbyist website with that bullshit.

bruce511 3y ago
So firstly, I agree - browsers should default to https not http if the protocol is not specified. It's a pain that they do http because it means I have to open port 80 and issue a redirect. That in itself is no big deal, since I usually have port 80 open anyway (for LetsEncrypt support.) That said, you raise a point I see a lot - your site is too "plain" to need https. Personally I think this argument is outdated. The key issue with plain sites being HTTP is that -additional- content can be injected into them. In others people might be reading text, or seeing images, that are not what you built. Advertising, sure. ISPs have fine that, but that's the least problem. What about injecting a political endorsement? What about altering any links to include (not your) affiliate id? Once you start thinking about the value of HTTP sites in this way you start to appreciate the many ways unencrypted sites can be exploited. Back in the day "amateur" meant better (because the creator had time to do it right) not worse. Being "professional" was code for "you get what you pay for, no more than that". I encourage all "hobbyist" Web producers to embrace that, to make it excellent, rather than to simply treat it as a "waste of time".
- beachy 3y ago
  > That said, you raise a point I see a lot - your site is too "plain" to need https. Personally I think this argument is outdated. In the early days, sites would often be mainly http, then the payment part would switch to https. That soon died and I think you are correct.

rkagerer 3y ago

I agree it's retarded how the important features keep getting buried under deeper sequences of clicks.

jofla_net 3y ago

absolutely. add cache behavior to that as well, nothing is cached from non "fully trusted" pages either...

BrandoElFollito 3y ago

Probably because 99.985% of people who use a browser call it "the internet" and of these a tiny fraction knows that if there is a padlock nothing bad can happen (yes I know that the padlock is now gone because everything wasn't that safe, apparently). Then you have the 0.0something population that heard that a certificate ensures you that the site is the one you want to go to. And since it is not always the case they have up. Then there is the sub-Planck- number of these who understand what a cert is and what it is for.