3 ms·
Like I said in the other [1] thread on this topic, I hope that this drives home the need to be using HTTPS everywhere we can be. It would make this kind of wide
by jonawesomegreen 12y ago
Like I said in the other [1] thread on this topic, I hope that this drives home the need to be using HTTPS everywhere we can be. It would make this kind of wide scale man-in-the-middle attack much harder to pull off and easier for users to detect. If only getting a certificate was an easier (less costly) process.
[1] - https://news.ycombinator.com/item?id=9353785 https://news.ycombinator.com/item?id=9353785
- forgottenpass 12y agoI hope this drives home the need to stop including 3rd party javascript on websites. It makes visitors' browsers load and run code of variable trustworthiness. The browser sandbox is entirely ill-equipped to keep users safe and secure online or prevent their computers from being leveraged for malicious ends. The sandbox allows everything but the most indefensible exploitative actions. HTTPS is great and all, and does change the threat model but the Chinese government controls root certificates your browser trusts. And they weren't worried about getting detected funneling traffic to github.
- Karunamon 12y agoMentioned this yesterday, but Mozilla's got a free CA project that's supposed to be up in a few months. Hopefully we'll see some of the entrenched players burn^H^H^H^H get real competition now! https://letsencrypt.org https://letsencrypt.org