4 ms·

That's exactly the problem though. I know it's somehow possible, but the fact that I have to search for what's the internal boolean name for whatever feature I

That's exactly the problem though. I know it's somehow possible, but the fact that I have to search for what's the internal boolean name for whatever feature I want to disable is simply a bad dev UX. If there's a Firefox developer edition (I had no idea), they should enable all "I want to continue anyways" buttons by default. I mean, it's a developer edition!

jeroenhd 3y ago
To be fair, "thisisunsafe" isn't exactly an advocated feature either. I would like a better way to bypass these TLS errors, but hidden booleans and secret phrases aren't that dissimilar.
- BossingAround 3y ago
  The biggest difference is a catch-all phrase vs feature-specific booleans. So rather than have one place for everything, you have multiple of booleans. I agree that if there was at least one boolean to always show the "continue anyways" button, that'd be acceptable to me as well.
elashri 3y ago
> That's exactly the problem though. I know it's somehow possible, but the fact that I have to search for what's the internal boolean name for whatever feature I want to disable is simply a bad dev UX. I think as a developer, searching for things are just part of the job, so if you have a niche need to debug or work with sites with invalid certs/configs, then it is not that hard to look on how to allow that. Firefox's docs are one of the best docs you can read to be fair. > If there's a Firefox developer edition (I had no idea), they should enable all "I want to continue anyways" buttons by default. I mean, it's a developer edition! To be honest, I use developer edition as my main browser and my profile is optimized and highly customized, so I don't remember is that was the default, or I changed it at some time (I keep it true). But for vanilla Firefox which most of the users or potential users are not developers, I think this is reasonable default.
sp332 3y ago
Compared to typing a nonstandard string in a nonstandard place? Going to about:config where all the deep settings are and searching for "ocsp" is downright obvious.
- BossingAround 3y ago
  Not really... I don't even remember `about:config`. I know of its existence, but is it `config`, `:config`, or `about`, or ...? So what I do is, I google, right? First page that comes up references how to fix the problem on both Firefox and Chromium-based browsers. So on Firefox, I have to type the config page, then search for ocsp, then disable it. Then, I can finally access the webpage, but of course, I should remember to re-enable it after I'm done on the misconfigured server. On Chrome, I can fire up an incognito window, type a magic keyword, do what I need, close the incognito window and go back to default. Honestly, the latter is a vastly better experience in my world (I do backend/integration dev, mostly Python nowadays, probably a FE engineer will not care either way).
  - elashri 3y ago
    > On Chrome, I can fire up an incognito window, type a magic keyword, do what I need, close the incognito window and go back to default. You can do the same on Firefox (at least developer edition). I thought that you want to do that without going to incognito mode.
- toast0 3y ago
  How is searching for oscp obvious when the problem was HSTS?
  - sp332 3y ago
    I was just copying what someone else said in this thread. It might actually be network.stricttransportsecurity.preloadlist but I have not tried it.
    - zamadatix 3y ago
godelski 3y ago
> That's exactly the problem though. Is it? The default options are for default users. Default users are dumb. It sounds like you have a non-standard case and the capacity to know the difference between misconfiguration and actual threats. It also makes sense that you are able to turn off certain features for default users when you want to do non-standard (default) tasks.

jeroenhd 3y ago

To be fair, "thisisunsafe" isn't exactly an advocated feature either. I would like a better way to bypass these TLS errors, but hidden booleans and secret phrases aren't that dissimilar.

BossingAround 3y ago
The biggest difference is a catch-all phrase vs feature-specific booleans. So rather than have one place for everything, you have multiple of booleans. I agree that if there was at least one boolean to always show the "continue anyways" button, that'd be acceptable to me as well.

elashri 3y ago

> That's exactly the problem though. I know it's somehow possible, but the fact that I have to search for what's the internal boolean name for whatever feature I want to disable is simply a bad dev UX. I think as a developer, searching for things are just part of the job, so if you have a niche need to debug or work with sites with invalid certs/configs, then it is not that hard to look on how to allow that. Firefox's docs are one of the best docs you can read to be fair. > If there's a Firefox developer edition (I had no idea), they should enable all "I want to continue anyways" buttons by default. I mean, it's a developer edition! To be honest, I use developer edition as my main browser and my profile is optimized and highly customized, so I don't remember is that was the default, or I changed it at some time (I keep it true). But for vanilla Firefox which most of the users or potential users are not developers, I think this is reasonable default.

sp332 3y ago

Compared to typing a nonstandard string in a nonstandard place? Going to about:config where all the deep settings are and searching for "ocsp" is downright obvious.

BossingAround 3y ago
Not really... I don't even remember `about:config`. I know of its existence, but is it `config`, `:config`, or `about`, or ...? So what I do is, I google, right? First page that comes up references how to fix the problem on both Firefox and Chromium-based browsers. So on Firefox, I have to type the config page, then search for ocsp, then disable it. Then, I can finally access the webpage, but of course, I should remember to re-enable it after I'm done on the misconfigured server. On Chrome, I can fire up an incognito window, type a magic keyword, do what I need, close the incognito window and go back to default. Honestly, the latter is a vastly better experience in my world (I do backend/integration dev, mostly Python nowadays, probably a FE engineer will not care either way).
- elashri 3y ago
  > On Chrome, I can fire up an incognito window, type a magic keyword, do what I need, close the incognito window and go back to default. You can do the same on Firefox (at least developer edition). I thought that you want to do that without going to incognito mode.
toast0 3y ago
How is searching for oscp obvious when the problem was HSTS?
- sp332 3y ago
  I was just copying what someone else said in this thread. It might actually be network.stricttransportsecurity.preloadlist but I have not tried it.
  - zamadatix 3y ago

godelski 3y ago

> That's exactly the problem though. Is it? The default options are for default users. Default users are dumb. It sounds like you have a non-standard case and the capacity to know the difference between misconfiguration and actual threats. It also makes sense that you are able to turn off certain features for default users when you want to do non-standard (default) tasks.