4 ms·

It absolutely feels like all the major web browsers have given up on being the User Agent, and instead act as the web developer's agent. I feel like I'm constan

It absolutely feels like all the major web browsers have given up on being the User Agent, and instead act as the web developer's agent. I feel like I'm constantly fighting my web browser to do what I want rather than what the website wants. Case in point which I'm fighting with at this very minute: HTTP. I want to access a site over HTTP, not HTTPS. I know it supports HTTP. I have used HTTP in the past. But my browser insists that I want HTTPS instead, despite my manually typing http:// http:// HSTS is an abomination, directly ignoring the user's command to do what the site wants instead. As if I'm some kind of bystander of my computer, instead of the user.

throwaway519 2y ago
There should definitely be a more convenient way to 'forget this site'. In Firefox it's hidden in right clicking on the site entry in History. For Chromium it seems to be a 7 step process unless invoking developer tools as History doesn't present a 1-click way to remove a whole site. Edit: And for mobile even more obscure.
FBT 2y ago
In a negotiation, the goal is to reach an accommodation suitable for both parties. If the web developer doesn't want to set up his server on port 80 to serve HTTP, that's his business. Your user agent is still working for you, when it negotiates with the server what protocols it will accept. (It also negotiates a content type for the response; and if all the server has is static HTML, it's not your user agent's fault if what you get is HTML, even if you really wanted some other format. Take it up with the web developer, if you want the data in some other format. The browser is just doing its best for you.) Your argument makes sense in one narrow circumstance which is not the typical HSTS setup: if the server is serving the site with plain HTTP on port 80 (and not just a redirect to the HTTPS version of the page), and also has a HTTPS version with HSTS headers. (So that the first time you visit the HTTPS version, your browser will insist on taking you to that version every time.)
_blk 2y ago
Don't forget what search engine is default, what sponsored stories are shown, turn those off, it's suggested stories next. Oh your bookmarks, why not share those with us, browser experiments, ... Thought that's enoigh? No, let's disable APIs that ad blockers use and replace them using BS excuses. Don't get me wrong, the companies developing the browsers spend money that they have to make somehow on the other end but at least there used to be usable community driven browsers..
- webspinner 2y ago
  Oh yeah, Google is really bothering me right now with that crap! I run adblock for an accessibility reason, not just for an I hate ads reason. Stop trying to ban me from the entire internet, and especially YOutube!
josephg 2y ago
Out of curiosity, why do you want unencrypted HTTP when HTTPS is available?
- 400thecat 2y ago
  why do you want to save a file unencrypted on your filesystem, when encryption is available?
  - soulofmischief 2y ago
    You generally shouldn't. But data at rest is different from data in transit in that you are vulnerable to a MITM with data in transit. Who cares if you're saving an encrypted file or not, if you can't trust that it's the same file that you intended to access.
  - frizlab 2y ago
    Saving unencrypted data at rest is not possible anymore on macOS. Even though it may appear as unencrypted, it is always encrypted.
  - archerx 2y ago
    Because I still want access to my files if there is a catastrophic system failure?
- chacham15 2y ago
  honestly, i run into the same issue. my use case is mostly for older wifi capture portals which just dont work against https since they obviously cant mitm the user. my other use case is for development work when I want to capture the traffic with wireshark without setting up https stripping via pinned certificate myself.
- ryandrake 2y ago
  With all respect: because I want to, and I expect my computer to do what I command it to do, not second-guess me. I understand the use cases for HTTPS vs. HTTP, and in some cases I deliberately want HTTP. It is not my browser's job to wag its finger at me and "correct" me. I'm really tired of using a computer and feeling like a passenger rather than the driver.
autoexec 2y ago
> Case in point which I'm fighting with at this very minute: HTTP. I want to access a site over HTTP, not HTTPS. I think there's a fix for this in firefox and its forks, browser.fixup.fallback-to-https or dom.security.https_first maybe... at least they used to allow you to disable that sort of thing.
mjevans 2y ago
Browsers need to be more eager to offer workarounds for things like... that dang snake oil TLS cert on the ISP's router setup in a weird way but in the 'reserved' private use address ranges. NOT automatically, but with an accommodation that asks the user if they're _expecting_ to talk to a device such as a "Modem" or "ISP Router" when making that request, and offer to do what's necessary to connect.
bynxbynx 2y ago
While I find this mildly annoying at times, it's a good reminder that I can just hardcode the port if I want HTTP

throwaway519 2y ago

There should definitely be a more convenient way to 'forget this site'. In Firefox it's hidden in right clicking on the site entry in History. For Chromium it seems to be a 7 step process unless invoking developer tools as History doesn't present a 1-click way to remove a whole site. Edit: And for mobile even more obscure.

FBT 2y ago

In a negotiation, the goal is to reach an accommodation suitable for both parties. If the web developer doesn't want to set up his server on port 80 to serve HTTP, that's his business. Your user agent is still working for you, when it negotiates with the server what protocols it will accept. (It also negotiates a content type for the response; and if all the server has is static HTML, it's not your user agent's fault if what you get is HTML, even if you really wanted some other format. Take it up with the web developer, if you want the data in some other format. The browser is just doing its best for you.) Your argument makes sense in one narrow circumstance which is not the typical HSTS setup: if the server is serving the site with plain HTTP on port 80 (and not just a redirect to the HTTPS version of the page), and also has a HTTPS version with HSTS headers. (So that the first time you visit the HTTPS version, your browser will insist on taking you to that version every time.)

_blk 2y ago

Don't forget what search engine is default, what sponsored stories are shown, turn those off, it's suggested stories next. Oh your bookmarks, why not share those with us, browser experiments, ... Thought that's enoigh? No, let's disable APIs that ad blockers use and replace them using BS excuses. Don't get me wrong, the companies developing the browsers spend money that they have to make somehow on the other end but at least there used to be usable community driven browsers..

webspinner 2y ago
Oh yeah, Google is really bothering me right now with that crap! I run adblock for an accessibility reason, not just for an I hate ads reason. Stop trying to ban me from the entire internet, and especially YOutube!

josephg 2y ago

Out of curiosity, why do you want unencrypted HTTP when HTTPS is available?

400thecat 2y ago
why do you want to save a file unencrypted on your filesystem, when encryption is available?
- soulofmischief 2y ago
  You generally shouldn't. But data at rest is different from data in transit in that you are vulnerable to a MITM with data in transit. Who cares if you're saving an encrypted file or not, if you can't trust that it's the same file that you intended to access.
- frizlab 2y ago
  Saving unencrypted data at rest is not possible anymore on macOS. Even though it may appear as unencrypted, it is always encrypted.
- archerx 2y ago
  Because I still want access to my files if there is a catastrophic system failure?
chacham15 2y ago
honestly, i run into the same issue. my use case is mostly for older wifi capture portals which just dont work against https since they obviously cant mitm the user. my other use case is for development work when I want to capture the traffic with wireshark without setting up https stripping via pinned certificate myself.
ryandrake 2y ago
With all respect: because I want to, and I expect my computer to do what I command it to do, not second-guess me. I understand the use cases for HTTPS vs. HTTP, and in some cases I deliberately want HTTP. It is not my browser's job to wag its finger at me and "correct" me. I'm really tired of using a computer and feeling like a passenger rather than the driver.

autoexec 2y ago

> Case in point which I'm fighting with at this very minute: HTTP. I want to access a site over HTTP, not HTTPS. I think there's a fix for this in firefox and its forks, browser.fixup.fallback-to-https or dom.security.https_first maybe... at least they used to allow you to disable that sort of thing.

mjevans 2y ago

Browsers need to be more eager to offer workarounds for things like... that dang snake oil TLS cert on the ISP's router setup in a weird way but in the 'reserved' private use address ranges. NOT automatically, but with an accommodation that asks the user if they're _expecting_ to talk to a device such as a "Modem" or "ISP Router" when making that request, and offer to do what's necessary to connect.

bynxbynx 2y ago

While I find this mildly annoying at times, it's a good reminder that I can just hardcode the port if I want HTTP