4 ms·

This is not true. The suggestion is that essentially all new features will require https. You are effectively blocking http if I can't do anything interesting w

by Touche 12y ago

This is not true. The suggestion is that essentially all new features will require https. You are effectively blocking http if I can't do anything interesting with it.

kijin 12y ago
The proposal says: > That would allow things like CSS and other rendering features to still be used by insecure websites ... [but] restrict qualitatively new features, such as access to new hardware capabilities ... [like] persistent permissions for camera and microphone access If accessing my camera over an insecure connection is your definition of doing interesting things, I would be happy to block you. In fact, I can't think of a single proposed addition to the current web stack that would be safe to use over an insecure connection. You have every right to express your views using a static document and stylesheet. But anything beyond that tends to involve executing your code on my computer, and nobody has any obligation to let you do that, especially over an insecure connection. Requiring people to make some additional effort before they can access other people's property sounds like a nice balance of rights and obligations to me.
- Touche 12y ago
  You changed your opinion quickly. Previously you said: > The plan is to disable some of the "more dangerous" features when the page is requested over HTTP And now you're saying that every new feature falls into this category. Listen, I'm all for going all-in on SSL. What I'm not for is doing until SSL is as seamless and inexpensive as HTTP. What really concerns me is that the https-only nazis do not share this concern. It's never mentioned in their blog posts. It actually really scares me that something that has been so important for making the web as powerful for the cause of freedom is not even on the radar of the people who are controlling the direction of the web.
  - kijin 12y ago
    No, I didn't change my opinion. I just clarified what I meant by "more dangerous", and IMO everything that involves javascript or access to surveillance hardware (camera, microphone, GPS, etc.) qualifies as dangerous. My fundamental disagreement with you is that I don't think we can wait until "SSL is as seamless and inexpensive as HTTP". That will never happen unless we can pose a credible threat to the profit margins of web hosts and CAs. And sending a horde of unsatisfied customers in their general direction is one of the most effective ways to pose such a threat.
  - mauricemir 12y ago
    Its a bit like the ipv6 band wagon 20 years ago I or anyone with a trivial knowledge of the internet/networking, could have pointed out that developing a new standard with NO thought to inter operation would not work. Also having it developed by 19 university types and one guy from Bell labs was asking for trouble
  - Dylan16807 12y ago
    >And now you're saying that every new feature falls into this category. Subtle misreading. It's not that new features are in that category by definition, it's that every major feature proposal kijin has seen so far has been of the dangerous sort.

by Touche 12y ago

This is not true. The suggestion is that essentially all new features will require https. You are effectively blocking http if I can't do anything interesting with it.

kijin 12y ago

The proposal says: > That would allow things like CSS and other rendering features to still be used by insecure websites ... [but] restrict qualitatively new features, such as access to new hardware capabilities ... [like] persistent permissions for camera and microphone access If accessing my camera over an insecure connection is your definition of doing interesting things, I would be happy to block you. In fact, I can't think of a single proposed addition to the current web stack that would be safe to use over an insecure connection. You have every right to express your views using a static document and stylesheet. But anything beyond that tends to involve executing your code on my computer, and nobody has any obligation to let you do that, especially over an insecure connection. Requiring people to make some additional effort before they can access other people's property sounds like a nice balance of rights and obligations to me.

Touche 12y ago
You changed your opinion quickly. Previously you said: > The plan is to disable some of the "more dangerous" features when the page is requested over HTTP And now you're saying that every new feature falls into this category. Listen, I'm all for going all-in on SSL. What I'm not for is doing until SSL is as seamless and inexpensive as HTTP. What really concerns me is that the https-only nazis do not share this concern. It's never mentioned in their blog posts. It actually really scares me that something that has been so important for making the web as powerful for the cause of freedom is not even on the radar of the people who are controlling the direction of the web.
- kijin 12y ago
  No, I didn't change my opinion. I just clarified what I meant by "more dangerous", and IMO everything that involves javascript or access to surveillance hardware (camera, microphone, GPS, etc.) qualifies as dangerous. My fundamental disagreement with you is that I don't think we can wait until "SSL is as seamless and inexpensive as HTTP". That will never happen unless we can pose a credible threat to the profit margins of web hosts and CAs. And sending a horde of unsatisfied customers in their general direction is one of the most effective ways to pose such a threat.
- mauricemir 12y ago
  Its a bit like the ipv6 band wagon 20 years ago I or anyone with a trivial knowledge of the internet/networking, could have pointed out that developing a new standard with NO thought to inter operation would not work. Also having it developed by 19 university types and one guy from Bell labs was asking for trouble
- Dylan16807 12y ago
  >And now you're saying that every new feature falls into this category. Subtle misreading. It's not that new features are in that category by definition, it's that every major feature proposal kijin has seen so far has been of the dangerous sort.