3 ms·

The one thing I miss from Chrome is the `thisisunsafe` feature to ignore whatever misconfiguration the webpage you're trying to access uses. Recently, one of t

The one thing I miss from Chrome is the `thisisunsafe` feature to ignore whatever misconfiguration the webpage you're trying to access uses. Recently, one of the dev servers that I tried to access misconfigured HSTS, which made it really difficult for Firefox to access the web UI. I fired up chromium, simply typed the magic word, and accessed it no problem. Of course, ideally, there'd be no misconfigurations, but sometimes, I just need to access whatever dev server and I don't want to waste time on learning how to disable that particular security feature in Firefox temporarily.

elashri 3y ago
While not recommended, and I would run firefox developer edition for that, you can disable (make the value false) `security.ssl.enable_ocsp_stapling` in `about:config`. You will be able to view sites with invalid certs/config. But will still prompt you that that something is invalid, and you have the choice to proceed forward. Again, I would not recommend doing that on vanilla Firefox, they have Firefox developer edition version for these reasons. And you can run both side by side.
- BossingAround 3y ago
  That's exactly the problem though. I know it's somehow possible, but the fact that I have to search for what's the internal boolean name for whatever feature I want to disable is simply a bad dev UX. If there's a Firefox developer edition (I had no idea), they should enable all "I want to continue anyways" buttons by default. I mean, it's a developer edition!
  - jeroenhd 3y ago
    To be fair, "thisisunsafe" isn't exactly an advocated feature either. I would like a better way to bypass these TLS errors, but hidden booleans and secret phrases aren't that dissimilar.
    - BossingAround 3y ago
      The biggest difference is a catch-all phrase vs feature-specific booleans. So rather than have one place for everything, you have multiple of booleans. I agree that if there was at least one boolean to always show the "continue anyways" button, that'd be acceptable to me as well.
  - elashri 3y ago
    > That's exactly the problem though. I know it's somehow possible, but the fact that I have to search for what's the internal boolean name for whatever feature I want to disable is simply a bad dev UX. I think as a developer, searching for things are just part of the job, so if you have a niche need to debug or work with sites with invalid certs/configs, then it is not that hard to look on how to allow that. Firefox's docs are one of the best docs you can read to be fair. > If there's a Firefox developer edition (I had no idea), they should enable all "I want to continue anyways" buttons by default. I mean, it's a developer edition! To be honest, I use developer edition as my main browser and my profile is optimized and highly customized, so I don't remember is that was the default, or I changed it at some time (I keep it true). But for vanilla Firefox which most of the users or potential users are not developers, I think this is reasonable default.
  - sp332 3y ago
    Compared to typing a nonstandard string in a nonstandard place? Going to about:config where all the deep settings are and searching for "ocsp" is downright obvious.
    - BossingAround 3y ago
      Not really... I don't even remember `about:config`. I know of its existence, but is it `config`, `:config`, or `about`, or ...? So what I do is, I google, right? First page that comes up references how to fix the problem on both Firefox and Chromium-based browsers. So on Firefox, I have to type the config page, then search for ocsp, then disable it. Then, I can finally access the webpage, but of course, I should remember to re-enable it after I'm done on the misconfigured server. On Chrome, I can fire up an incognito window, type a magic keyword, do what I need, close the incognito window and go back to default. Honestly, the latter is a vastly better experience in my world (I do backend/integration dev, mostly Python nowadays, probably a FE engineer will not care either way).
      - elashri 3y ago
        > On Chrome, I can fire up an incognito window, type a magic keyword, do what I need, close the incognito window and go back to default. You can do the same on Firefox (at least developer edition). I thought that you want to do that without going to incognito mode.
    - toast0 3y ago
      How is searching for oscp obvious when the problem was HSTS?
      - sp332 3y ago
        I was just copying what someone else said in this thread. It might actually be network.stricttransportsecurity.preloadlist but I have not tried it.
        zamadatix 3y ago
  - godelski 3y ago
    > That's exactly the problem though. Is it? The default options are for default users. Default users are dumb. It sounds like you have a non-standard case and the capacity to know the difference between misconfiguration and actual threats. It also makes sense that you are able to turn off certain features for default users when you want to do non-standard (default) tasks.
swozey 3y ago
Browsers need some advanced/i'm-a-dev mode. I'm getting sick of things (TLS details, urls, unsafe) getting hidden away/removed. edit: Well comment below me just mentioned a Firefox developer version, wasn't aware of that.
Night_Thastus 3y ago
This drives me up a wall. I know the site. I trust the site. Yes, they screwed up something with their configuration or it's just ancient. I STILL WANT TO GO THERE!
ThatMedicIsASpy 3y ago
And I refuse use chrome because I use full-screen-api.ignore-widgets which makes videos full screen to the browser size.

elashri 3y ago

While not recommended, and I would run firefox developer edition for that, you can disable (make the value false) `security.ssl.enable_ocsp_stapling` in `about:config`. You will be able to view sites with invalid certs/config. But will still prompt you that that something is invalid, and you have the choice to proceed forward. Again, I would not recommend doing that on vanilla Firefox, they have Firefox developer edition version for these reasons. And you can run both side by side.

BossingAround 3y ago
That's exactly the problem though. I know it's somehow possible, but the fact that I have to search for what's the internal boolean name for whatever feature I want to disable is simply a bad dev UX. If there's a Firefox developer edition (I had no idea), they should enable all "I want to continue anyways" buttons by default. I mean, it's a developer edition!
- jeroenhd 3y ago
  To be fair, "thisisunsafe" isn't exactly an advocated feature either. I would like a better way to bypass these TLS errors, but hidden booleans and secret phrases aren't that dissimilar.
  - BossingAround 3y ago
    The biggest difference is a catch-all phrase vs feature-specific booleans. So rather than have one place for everything, you have multiple of booleans. I agree that if there was at least one boolean to always show the "continue anyways" button, that'd be acceptable to me as well.
- elashri 3y ago
  > That's exactly the problem though. I know it's somehow possible, but the fact that I have to search for what's the internal boolean name for whatever feature I want to disable is simply a bad dev UX. I think as a developer, searching for things are just part of the job, so if you have a niche need to debug or work with sites with invalid certs/configs, then it is not that hard to look on how to allow that. Firefox's docs are one of the best docs you can read to be fair. > If there's a Firefox developer edition (I had no idea), they should enable all "I want to continue anyways" buttons by default. I mean, it's a developer edition! To be honest, I use developer edition as my main browser and my profile is optimized and highly customized, so I don't remember is that was the default, or I changed it at some time (I keep it true). But for vanilla Firefox which most of the users or potential users are not developers, I think this is reasonable default.
- sp332 3y ago
  Compared to typing a nonstandard string in a nonstandard place? Going to about:config where all the deep settings are and searching for "ocsp" is downright obvious.
  - BossingAround 3y ago
    Not really... I don't even remember `about:config`. I know of its existence, but is it `config`, `:config`, or `about`, or ...? So what I do is, I google, right? First page that comes up references how to fix the problem on both Firefox and Chromium-based browsers. So on Firefox, I have to type the config page, then search for ocsp, then disable it. Then, I can finally access the webpage, but of course, I should remember to re-enable it after I'm done on the misconfigured server. On Chrome, I can fire up an incognito window, type a magic keyword, do what I need, close the incognito window and go back to default. Honestly, the latter is a vastly better experience in my world (I do backend/integration dev, mostly Python nowadays, probably a FE engineer will not care either way).
    - elashri 3y ago
      > On Chrome, I can fire up an incognito window, type a magic keyword, do what I need, close the incognito window and go back to default. You can do the same on Firefox (at least developer edition). I thought that you want to do that without going to incognito mode.
  - toast0 3y ago
    How is searching for oscp obvious when the problem was HSTS?
    - sp332 3y ago
      I was just copying what someone else said in this thread. It might actually be network.stricttransportsecurity.preloadlist but I have not tried it.
      - zamadatix 3y ago
- godelski 3y ago
  > That's exactly the problem though. Is it? The default options are for default users. Default users are dumb. It sounds like you have a non-standard case and the capacity to know the difference between misconfiguration and actual threats. It also makes sense that you are able to turn off certain features for default users when you want to do non-standard (default) tasks.

swozey 3y ago

Browsers need some advanced/i'm-a-dev mode. I'm getting sick of things (TLS details, urls, unsafe) getting hidden away/removed. edit: Well comment below me just mentioned a Firefox developer version, wasn't aware of that.

Night_Thastus 3y ago

This drives me up a wall. I know the site. I trust the site. Yes, they screwed up something with their configuration or it's just ancient. I STILL WANT TO GO THERE!

ThatMedicIsASpy 3y ago

And I refuse use chrome because I use full-screen-api.ignore-widgets which makes videos full screen to the browser size.