3 ms·

> if browsers did not support plaintext HTTP at all, and only CA-verified TLS That's a very big "if", and it reeks of FUD. Show me a browser that has any plan

by kijin 11y ago

> if browsers did not support plaintext HTTP at all, and only CA-verified TLS That's a very big "if", and it reeks of FUD. Show me a browser that has any plan to drop support for plaintext HTTP any time in the foreseeable future. Firefox ain't one of them. Last time I checked, their plan was to reserve some of the more dangerous features (such as access to the camera) for secure websites. Hardly a plan to drop support for plaintext HTTP. If you still aren't convinced that the current controversy is just a bunch of FUD, I'll bet $100 that 10 years from now, I'll still be able to post public information (say, the full text of RFC 2616) on a plain HTTP site and have you access it with a mainstream browser.

iopq 11y ago
Firefox is moving in that direction. Maybe by 2020 you'll have to click a lot of prompts to see an "insecure" site.
- kijin 11y ago
  Classic slippery slope argument. When abortion was legalized, some people argued that we'd be murdering children soon. Has that happened? If something is moving in the right direction, but if you're worried that it will go too far, the solution is to get involved and stop it at the right time, not to spread FUD about the hypothetical doom of the world.
  - scrollaway 11y ago
    > When abortion was legalized, some people argued that we'd be murdering children soon. Has that happened? We're too busy marrying them, thanks to our other slippery slopes. (sad to see you downvoted. It is a slippery slope argument.)
  - josteink 11y ago
    > Firefox ain't one of them. Last time I checked, their plan was to reserve some of the more dangerous features (such as access to the camera) for secure websites. Hardly a plan to drop support for plaintext HTTP. So basically, by your own admission, you say that websites with a near-future version of Firefox will only be able to offer a "full" web-experience if they are offered via HTTPS. HTTP-based websites will be reserved for an inferior web. > Classic slippery slope argument. But somehow saying that this is moving in a HTTPS-only direction is a slippery slope argument? How long until Javacript is only allowed via HTTPS? How long until video and media-APIs will only work with a "secure" DRMed connection, signed by the MPAA? Taking HTTPS everywhere and removing support for HTTP is the slippery slope and we're already walking it. Every feature of every part of the HTML spec has to be supported for every transport. End of discussion. HTTPS everywhere is a misguided effort. Trying to artificially limit HTTP to further your cause is just GOT-level political bullshit. Stop playing dishonestly. If HTTPS everywhere can't win through on its own merits, you should let it die.
    - scrollaway 11y ago
      > How long until video and media-APIs will only worked with a "secure" DRMed connection, signed by the MPAA? The slope is so slippery I think I might actually fall off my chair. I don't think you know what the fallacy actually is. There's no arguing against facts - moving to promote HTTPS and make some features HTTPS-only does go in that direction. But that doesn't mean things will continue going in that direction. If I keep driving north I'm sure I'll fall off a cliff eventually. The magic happens because the road isn't straight.
    - kijin 11y ago
      > Every feature of every part of the HTML spec has to be supported for every transport. End of discussion. Where does that feeling of entitlement come from? What makes you think you have the right to access my camera or microphone via your web page, or even execute arbitrary JS on my computer in the first place? Websites have no right to do such things. They are privileges that I grant on a case-by-case basis via my user-agent and various plugins. You don't even have any guarantee that your DOM and CSS will render as you intended, because I block all sorts of things and sometimes even tweak the styles to make the content more readable. My computer, my rules. So I see no problem with restricting websites to a known-to-be-safe subset of features by default, until and unless a website can demonstrate that they take my privacy and security seriously. Privileges must be earned, not taken for granted, and ruthlessly revoked at the first sign of misuse. The HTML spec describes the maximum privileges that a website can hope to have, not the minimum that it can expect to have. If your website doesn't need any special privileges, feel free to use whatever transport you want.
weinzierl 11y ago
A very big "if" indeed, but not a completely unrealistic assumption in my opinion. It will not happen at once but gradually. Neither Firefox nor Chrome intend to support plain HTTP/2 without encryption. Google already favors pages with TLS, my bet is they will also favor HTTP/2 sometime soon. Like you said: Browser will "reserve some of the more dangerous features (such as access to the camera) for secure websites.". They might even show a red bar for HTTP instead of a green one for HTTPS. > ... that 10 years from now, I'll still be able to post public > information (say, the full text of RFC 2616) on a plain HTTP site > and have you access it with a mainstream browser. I'm sure you are right. We will be able to use HTTP in 10 years much in the sense that we are still able to use RSS today. I don't know whether to laugh or cry about this but it is what I see coming.

by kijin 11y ago

iopq 11y ago

Firefox is moving in that direction. Maybe by 2020 you'll have to click a lot of prompts to see an "insecure" site.

kijin 11y ago
Classic slippery slope argument. When abortion was legalized, some people argued that we'd be murdering children soon. Has that happened? If something is moving in the right direction, but if you're worried that it will go too far, the solution is to get involved and stop it at the right time, not to spread FUD about the hypothetical doom of the world.
- scrollaway 11y ago
  > When abortion was legalized, some people argued that we'd be murdering children soon. Has that happened? We're too busy marrying them, thanks to our other slippery slopes. (sad to see you downvoted. It is a slippery slope argument.)
- josteink 11y ago
  > Firefox ain't one of them. Last time I checked, their plan was to reserve some of the more dangerous features (such as access to the camera) for secure websites. Hardly a plan to drop support for plaintext HTTP. So basically, by your own admission, you say that websites with a near-future version of Firefox will only be able to offer a "full" web-experience if they are offered via HTTPS. HTTP-based websites will be reserved for an inferior web. > Classic slippery slope argument. But somehow saying that this is moving in a HTTPS-only direction is a slippery slope argument? How long until Javacript is only allowed via HTTPS? How long until video and media-APIs will only work with a "secure" DRMed connection, signed by the MPAA? Taking HTTPS everywhere and removing support for HTTP is the slippery slope and we're already walking it. Every feature of every part of the HTML spec has to be supported for every transport. End of discussion. HTTPS everywhere is a misguided effort. Trying to artificially limit HTTP to further your cause is just GOT-level political bullshit. Stop playing dishonestly. If HTTPS everywhere can't win through on its own merits, you should let it die.
  - scrollaway 11y ago
    > How long until video and media-APIs will only worked with a "secure" DRMed connection, signed by the MPAA? The slope is so slippery I think I might actually fall off my chair. I don't think you know what the fallacy actually is. There's no arguing against facts - moving to promote HTTPS and make some features HTTPS-only does go in that direction. But that doesn't mean things will continue going in that direction. If I keep driving north I'm sure I'll fall off a cliff eventually. The magic happens because the road isn't straight.
  - kijin 11y ago
    > Every feature of every part of the HTML spec has to be supported for every transport. End of discussion. Where does that feeling of entitlement come from? What makes you think you have the right to access my camera or microphone via your web page, or even execute arbitrary JS on my computer in the first place? Websites have no right to do such things. They are privileges that I grant on a case-by-case basis via my user-agent and various plugins. You don't even have any guarantee that your DOM and CSS will render as you intended, because I block all sorts of things and sometimes even tweak the styles to make the content more readable. My computer, my rules. So I see no problem with restricting websites to a known-to-be-safe subset of features by default, until and unless a website can demonstrate that they take my privacy and security seriously. Privileges must be earned, not taken for granted, and ruthlessly revoked at the first sign of misuse. The HTML spec describes the maximum privileges that a website can hope to have, not the minimum that it can expect to have. If your website doesn't need any special privileges, feel free to use whatever transport you want.

weinzierl 11y ago

A very big "if" indeed, but not a completely unrealistic assumption in my opinion. It will not happen at once but gradually. Neither Firefox nor Chrome intend to support plain HTTP/2 without encryption. Google already favors pages with TLS, my bet is they will also favor HTTP/2 sometime soon. Like you said: Browser will "reserve some of the more dangerous features (such as access to the camera) for secure websites.". They might even show a red bar for HTTP instead of a green one for HTTPS. > ... that 10 years from now, I'll still be able to post public > information (say, the full text of RFC 2616) on a plain HTTP site > and have you access it with a mainstream browser. I'm sure you are right. We will be able to use HTTP in 10 years much in the sense that we are still able to use RSS today. I don't know whether to laugh or cry about this but it is what I see coming.