4 ms·

Surprised this is downvoted. Chrome forces me to click through a warning to even visit HTTP sites nowadays.

by hamdingers 5mo ago

LtWorf 5mo ago
Yup, very secure. Then every single IT department installs a cert on the machines to MITM everything.
- hamdingers 5mo ago
  I have no idea what you're trying to say, there's no IT department managing my laptop and none of the IT departments I've worked in or with "MITM everything." Do you want to try again?
  - pc86 5mo ago
    On the flip side, every company I've ever worked for has installed trusted company certs on their computers and do MITM everything.
    - Joker_vD 5mo ago
      Yep. You apparently need HTTPS for intranet resources too, or you can't develop/use web-apps in Chrome, and since no self-respecting CA would certify your localhost, internal homegrown CA it is, baby — and given the web runs on the lovely model "any CA can attest any website; okay, maybe CAA is not a bad idea"...
      - NoahZuniga 5mo ago
        Even with CAA records, any CA can still create a cert for any website. So if you're worried about an untrustworthy CA, then this won't help you. It could make it less likely for a CA with buggy code to accidentally issue a cert for your domain.
stronglikedan 5mo ago
It only does that for me if there's an HTTPS option available but it's expired or not configured correctly. Chrome let me right into this site without that warning.
- hamdingers 5mo ago
  Turns out the warning I get is due to the Chrome setting "Always use secure connections" I don't remember turning it on but it's probable that I did, it's not a default yet but will be come October: https://blog.google/security/https-by-defau/ https://blog.google/security/https-by-defau/
dredmorbius 5mo ago
"Please don't complain about tangential annoyances..." <https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html>. A long-standing HN guideline. Regardless of how merited the complaint may be.

Surprised this is downvoted. Chrome forces me to click through a warning to even visit HTTP sites nowadays.

LtWorf 5mo ago

Yup, very secure. Then every single IT department installs a cert on the machines to MITM everything.

hamdingers 5mo ago
I have no idea what you're trying to say, there's no IT department managing my laptop and none of the IT departments I've worked in or with "MITM everything." Do you want to try again?
- pc86 5mo ago
  On the flip side, every company I've ever worked for has installed trusted company certs on their computers and do MITM everything.
  - Joker_vD 5mo ago
    Yep. You apparently need HTTPS for intranet resources too, or you can't develop/use web-apps in Chrome, and since no self-respecting CA would certify your localhost, internal homegrown CA it is, baby — and given the web runs on the lovely model "any CA can attest any website; okay, maybe CAA is not a bad idea"...
    - NoahZuniga 5mo ago
      Even with CAA records, any CA can still create a cert for any website. So if you're worried about an untrustworthy CA, then this won't help you. It could make it less likely for a CA with buggy code to accidentally issue a cert for your domain.

stronglikedan 5mo ago

It only does that for me if there's an HTTPS option available but it's expired or not configured correctly. Chrome let me right into this site without that warning.

hamdingers 5mo ago
Turns out the warning I get is due to the Chrome setting "Always use secure connections" I don't remember turning it on but it's probable that I did, it's not a default yet but will be come October: https://blog.google/security/https-by-defau/ https://blog.google/security/https-by-defau/

dredmorbius 5mo ago

"Please don't complain about tangential annoyances..." <https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html>. A long-standing HN guideline. Regardless of how merited the complaint may be.