Hacker News Reader

Comment by stable-point | Hacker News Reader

> If they continue to support this use case, it may be hard to do without introducing bugs - one exposure to a 'real' service which spits out an HSTS header (or the preload list), and the machine loses the ability to conduct Google searches.

Those wishing to spy on their users with nossl could just disable HSTS in the browsers they provide.

View on HN

Google has changed this almost a year ago

> Turn on SafeSearch VIP To force SafeSearch for your network, you’ll need to update your DNS configuration. Set the DNS entry for www.google.com (and any other Google ccTLD country subdomains your users may use) to be a CNAME for forcesafesearch.google.com.

>We will serve SafeSearch Search and Image Search results for requests that we receive on this VIP.

You can enforce safe search over https now https://support.google.com/websearch/answer/186669?hl=en

I used to work at Google, and I confirm the parent is correct. Things work this way so that schools can force safe search, while keeping HTTPS.

However, this means that schools can't see what pupils search for, and that any network operator can force safe search.

Schools almost ubiquitously use SSL -decrypting dpi devices with the device root installed on endpoints, bypassing both HSTS and HPKP.

K12 schools are increasingly embracing BYOD and BYOD devices are sometimes resistant to this kind of meddling (iPads, Chromebooks).

In the US, they still have a legal obligation to censor the Internet or they lose federal funding.

Do you know how much funding is at stake nationwide? (It's E-Rate, as I recall.) How credible is it that an organization or wealthy individual or crowdfunding effort could offer a wholesale alternative? In San Francisco, SFPL chose to give up this funding several years ago in order to decline to install censorware.

Edit: a whole lot of money! https://en.wikipedia.org/wiki/E-Rate#Modernization

Libraries do tend to be bastions of extreme left-wing views on surveillance and censorship, so perhaps on the library side.

School boards, no way. I can't think of an easier way to torpedo a school board career (or indeed a "pillar of the community" parent's status in the neighborhood) than by mentioning that they think children should have easier access to pornography at school.

Call it "Internet Deregulation" and say that you will be able to lower taxes by X percent if you don't have to spend money on expensive internet filter solutions.

Libraries do tend to be bastions of extreme left-wing views on surveillance and censorship

By context I can guess what you mean, but by itself it's a very ambiguous statement :)

Eh, I don't think so. Civil Liberties over Family Values and all that.

Much easier to just load a root CA certificate - this use case is explicitly supported and does not require maintaining a browser fork & compile infrastructure.

But "just" doing either of these things turns out not to be simple for many organizations. It's bad enough needing to update your system image/deployment scripts (if you have any!). You also need to figure out what to do about all the devices you don't own. BYOD is a thing.

Reply on news.ycombinator.com