3 ms·
1) Expensive for no good reason for 80% of sites out there 2) We agree it is useful in some case. That what makes it hard to go against, because it seems a reas
by ldng 12y ago
1) Expensive for no good reason for 80% of sites out there
2) We agree it is useful in some case. That what makes it hard to go against, because it seems a reasonable objective. The problem is where do you put the limit. I don't "fullscreen" my bank account. To me, forbidding fullscreen on HTTP is quite over the top but fits Google agenda of HTTPSing All The Things.
- icebraining 12y agoI don't "fullscreen" my bank account. They don't want to prevent you from fullscreening on HTTP. They want to prevent websites from fullscreening your browser on their own accord using the Fullscreen API, which is quite different. HTTPS might be expensive for 80% of the sites, but 80% of sites don't use the Fullscreen API anyway. Frankly, I think people here should read and understand more carefully what the Chrome team is actually saying before accusing them of nefarious intent (it's fine to accuse them after carefully understanding, of course).
- ldng 12y agoGoogle elsewhere, another time, kind of said that they'll be pushing for HTTPS "all-the-thing". It is their agenda. An agenda I do not juge nefarious, just one I disagree with. That said, I've gone back reread the mail and you're right, I probably jumped the gun a bit here. I did understood "migrate these features to secure-only" as disabling those features on non-HTTPS at mid/long term. I think HTTPS "all-the-thing" trend is not necessarily a good thing. It is not _always_ needed, it can had complexity, it has a cost a it leads to an over simplification of security in general. It is a trend that annoys me a bit and I sometimes overreact about it. Note that I distinguish HTTPS "all-the-thing" from HTTPS "when and where it is needed" for security concerns.