3 ms·

Compared to typing a nonstandard string in a nonstandard place? Going to about:config where all the deep settings are and searching for "ocsp" is downright obvi

by sp332 3y ago

Compared to typing a nonstandard string in a nonstandard place? Going to about:config where all the deep settings are and searching for "ocsp" is downright obvious.

BossingAround 3y ago
Not really... I don't even remember `about:config`. I know of its existence, but is it `config`, `:config`, or `about`, or ...? So what I do is, I google, right? First page that comes up references how to fix the problem on both Firefox and Chromium-based browsers. So on Firefox, I have to type the config page, then search for ocsp, then disable it. Then, I can finally access the webpage, but of course, I should remember to re-enable it after I'm done on the misconfigured server. On Chrome, I can fire up an incognito window, type a magic keyword, do what I need, close the incognito window and go back to default. Honestly, the latter is a vastly better experience in my world (I do backend/integration dev, mostly Python nowadays, probably a FE engineer will not care either way).
- elashri 3y ago
  > On Chrome, I can fire up an incognito window, type a magic keyword, do what I need, close the incognito window and go back to default. You can do the same on Firefox (at least developer edition). I thought that you want to do that without going to incognito mode.
toast0 3y ago
How is searching for oscp obvious when the problem was HSTS?
- sp332 3y ago
  I was just copying what someone else said in this thread. It might actually be network.stricttransportsecurity.preloadlist but I have not tried it.
  - zamadatix 3y ago
    It might be this, it might be that, it might be all sorts of things. The point is you have to know what it is for each scenario, then you have to know where to go change it, then you have to know what the variable name is. Or you can know "thisisunsafe" which, while not being something you'll find using the settings for your saturday reading material, is something easily found and universally applicable to all situations without simultaneously turning every other connection you make into a security risk. It's a great hidden feature just like Firefox has shift+right click/double right click opening the native context. No amount of "well you can just put this in the console in these cases or this in the console in those cases" makes these kinds of features any less useful.

by sp332 3y ago

Compared to typing a nonstandard string in a nonstandard place? Going to about:config where all the deep settings are and searching for "ocsp" is downright obvious.

BossingAround 3y ago

Not really... I don't even remember `about:config`. I know of its existence, but is it `config`, `:config`, or `about`, or ...? So what I do is, I google, right? First page that comes up references how to fix the problem on both Firefox and Chromium-based browsers. So on Firefox, I have to type the config page, then search for ocsp, then disable it. Then, I can finally access the webpage, but of course, I should remember to re-enable it after I'm done on the misconfigured server. On Chrome, I can fire up an incognito window, type a magic keyword, do what I need, close the incognito window and go back to default. Honestly, the latter is a vastly better experience in my world (I do backend/integration dev, mostly Python nowadays, probably a FE engineer will not care either way).

elashri 3y ago
> On Chrome, I can fire up an incognito window, type a magic keyword, do what I need, close the incognito window and go back to default. You can do the same on Firefox (at least developer edition). I thought that you want to do that without going to incognito mode.

toast0 3y ago

How is searching for oscp obvious when the problem was HSTS?

sp332 3y ago
I was just copying what someone else said in this thread. It might actually be network.stricttransportsecurity.preloadlist but I have not tried it.
- zamadatix 3y ago
  It might be this, it might be that, it might be all sorts of things. The point is you have to know what it is for each scenario, then you have to know where to go change it, then you have to know what the variable name is. Or you can know "thisisunsafe" which, while not being something you'll find using the settings for your saturday reading material, is something easily found and universally applicable to all situations without simultaneously turning every other connection you make into a security risk. It's a great hidden feature just like Firefox has shift+right click/double right click opening the native context. No amount of "well you can just put this in the console in these cases or this in the console in those cases" makes these kinds of features any less useful.