3 ms·

> The move to "deprecate" HTTP is an explicit attempt to manipulate the rest of the world into making SSL easier and more affordable. It is unfair to evaluate t

by Touche 12y ago

> The move to "deprecate" HTTP is an explicit attempt to manipulate the rest of the world into making SSL easier and more affordable. It is unfair to evaluate this proposal in isolation without considering the market upheaval that it is very much intended to trigger. I'd love to believe this but I've never once seen the https-only nazis bring up this issue on their own, or show any concern for the fact that it will limit speech on the web. The y mostly work for companies where getting ssl certs is no big deal, and they put their personal projects on github or heroku anyways. The backbone of the web was the fact that you could put up a website on your own computer within a matter of minutes. That is now going to be gone and I've never seen the biggest advocates of this change show any concern whatsoever.

oldmanjay 12y ago
I'm not convinced that's the backbone of the web at all. Can you back up your assertion with anything beyond emotional pleading?
- Touche 12y ago
  There were alternatives like AOL and Prodigy and the open web killed them.
wampus 12y ago
The move to deprecate HTTP is solely inspired by the need to authenticate online communication. It's necessary to protect speech on the web, because it makes it harder to tamper with the content in transit. Your ISP shouldn't be able to inject ads into a web page, a WiFi access point shouldn't be able to change every "do" to "do not", and a passive listener shouldn't be able to collect information about you for his own gain. SSL/TLS is a huge mess and the current CA situation is abysmal, but authentication needs to happen now, or there will be no privacy or freedom on the Internet.
- Touche 12y ago
  We can't have an intelligent conversation if you're going to suggest that free speech doesn't currently, and hasn't always happened on the web.
  - deleted 12y ago
    [deleted]
- manigandham 12y ago
  There's plenty of privacy and freedom on the internet... otherwise the internet would not have existed this long the way it has. More security is always better but let's please stop with hyperbole.
kijin 12y ago
That's just FUD. Nobody is planning to block plain HTTP requests altogether. You can still put up a website on any computer and serve it over plain HTTP, and it will render correctly on most browsers. The plan is to disable some of the "more dangerous" features when the page is requested over HTTP, in order to entice webmasters to adopt SSL. The list hasn't even been written yet, but I'm guessing that most of those features will be fancy javascript and third-party plugins like Flash. Which you probably shouldn't rely on being enabled in the first place. I personally wouldn't mind if every insecure page behaved as if I had NoScript & NoFlash enabled by default. You may be right about the excessive idealism of so-called HTTPS nazis on some online forums, but I'm pretty sure that the people in charge at Google and Mozilla are more level-headed and realistic. > the goal of this effort is to send a message to the web developer community that they need to be secure
- Touche 12y ago
  This is not true. The suggestion is that essentially all new features will require https. You are effectively blocking http if I can't do anything interesting with it.
  - kijin 12y ago
    The proposal says: > That would allow things like CSS and other rendering features to still be used by insecure websites ... [but] restrict qualitatively new features, such as access to new hardware capabilities ... [like] persistent permissions for camera and microphone access If accessing my camera over an insecure connection is your definition of doing interesting things, I would be happy to block you. In fact, I can't think of a single proposed addition to the current web stack that would be safe to use over an insecure connection. You have every right to express your views using a static document and stylesheet. But anything beyond that tends to involve executing your code on my computer, and nobody has any obligation to let you do that, especially over an insecure connection. Requiring people to make some additional effort before they can access other people's property sounds like a nice balance of rights and obligations to me.
    - 12y ago

by Touche 12y ago

oldmanjay 12y ago

I'm not convinced that's the backbone of the web at all. Can you back up your assertion with anything beyond emotional pleading?

Touche 12y ago
There were alternatives like AOL and Prodigy and the open web killed them.

wampus 12y ago

The move to deprecate HTTP is solely inspired by the need to authenticate online communication. It's necessary to protect speech on the web, because it makes it harder to tamper with the content in transit. Your ISP shouldn't be able to inject ads into a web page, a WiFi access point shouldn't be able to change every "do" to "do not", and a passive listener shouldn't be able to collect information about you for his own gain. SSL/TLS is a huge mess and the current CA situation is abysmal, but authentication needs to happen now, or there will be no privacy or freedom on the Internet.

Touche 12y ago
We can't have an intelligent conversation if you're going to suggest that free speech doesn't currently, and hasn't always happened on the web.
- deleted 12y ago
  [deleted]
manigandham 12y ago
There's plenty of privacy and freedom on the internet... otherwise the internet would not have existed this long the way it has. More security is always better but let's please stop with hyperbole.

kijin 12y ago

That's just FUD. Nobody is planning to block plain HTTP requests altogether. You can still put up a website on any computer and serve it over plain HTTP, and it will render correctly on most browsers. The plan is to disable some of the "more dangerous" features when the page is requested over HTTP, in order to entice webmasters to adopt SSL. The list hasn't even been written yet, but I'm guessing that most of those features will be fancy javascript and third-party plugins like Flash. Which you probably shouldn't rely on being enabled in the first place. I personally wouldn't mind if every insecure page behaved as if I had NoScript & NoFlash enabled by default. You may be right about the excessive idealism of so-called HTTPS nazis on some online forums, but I'm pretty sure that the people in charge at Google and Mozilla are more level-headed and realistic. > the goal of this effort is to send a message to the web developer community that they need to be secure

Touche 12y ago
This is not true. The suggestion is that essentially all new features will require https. You are effectively blocking http if I can't do anything interesting with it.
- kijin 12y ago
  The proposal says: > That would allow things like CSS and other rendering features to still be used by insecure websites ... [but] restrict qualitatively new features, such as access to new hardware capabilities ... [like] persistent permissions for camera and microphone access If accessing my camera over an insecure connection is your definition of doing interesting things, I would be happy to block you. In fact, I can't think of a single proposed addition to the current web stack that would be safe to use over an insecure connection. You have every right to express your views using a static document and stylesheet. But anything beyond that tends to involve executing your code on my computer, and nobody has any obligation to let you do that, especially over an insecure connection. Requiring people to make some additional effort before they can access other people's property sounds like a nice balance of rights and obligations to me.
  - 12y ago