Hacker News Reader

You have javascript disabled. I do not. I happen to use plenty of sites that require javascript, with HN being one of them. Most of the users out there do not have javascript disabled either. How do you account for their security?

> and I'm sure if your car's GPS indicated locations with high crime rates as "not safe" and prevented you from going there, there would be much outrage.

This is just a warning though, no one is preventing you from "going there", it's merely a warning that it might not be safe. Your analogy is more similar to "there's a slow down on that road, let me navigate you somewhere else, but feel free to go there if you want". You have exactly the same amount of freedom.

How exactly is using HTTPS "gain control over the masses"? Google does not control the HTTPS infrastructure.

It's not like those sites are gone either. There's always archive.org.

the gps could also be just a warning. same effect

also we know how these things go. first a warning, then a ban, then extinction from history

Let's not start the whole slippery slope logic, please.

didn't that happen with whatever technology google deemed unfit for the batteries of their phones, like Flash for example?`

Flash was a proprietary non-mobile-friendly technology from the start until its demise at the hands of its creators. No heavy-handed dictatorship, just bad products dying, and products that unfortunately depended on them died along with them.

http://blogs.adobe.com/flashplayer/2012/06/flash-player-and-...

> I happen to use plenty of sites that require javascript, with HN being one of them.

HN works just fine without Javascript. The only thing that doesn't work is collapsing comment threads.

And I consider that one of the greatest things to happen to HN.

It's a bit nice, but not nice enough to convince me to enable Javascript.

> HN works just fine without Javascript.

Confirmed by me[0] using HN throw Links2, screenshot[1] attached ;-)

> The only thing that doesn't work is collapsing comment threads.

Voting on comments also not work without JavaScript on HN, but in same time voting on threads work without JS.

[0] https://news.ycombinator.com/item?id=16191843

[1] http://www.hnng.moe/f/ZZJ

Hacker News's search feature requires javascript.

The irony of (mis)quoting "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety" in the same breath as saying "And I have JS off by default" is definitely worth pointing out here

How is preventing sites to run arbitrary code on your machine giving up essential liberty?

Indeed. I, the user, get to choose whether to allow JS or not.

Now consider that things like Meltdown and Spectre have JavaScript PoCs

If this was instead 'Chrome 68 will mark all JS-using sites as "not secure"', I wouldn't want that warning either, but then I'd be in agreement with the majority...

I am free to run it to get it's benefits and it's downsides, limiting me for the sake of security isn't okay.

Right back at you. How is buying an iPhone over an Android giving up essential liberty? I always have the right to sell it, go to the store, and buy a device that lets me do whatever I want.

Except browsers today are continuously developed, often with larger strategies in mind. Google has stated very openly that their ideal state is a world where there is no insecure HTTP at all and they intend to move everything as close as possible to that state. To reach this, the browser behavior is slowly tightened over a long number of releases.

So a better analogy would be a carmaker announcing that they don't want people to drive to unsafe areas. They'll monitor people's driving behavior via telemetry and OTA-update the car's software accordingly to nudge people's behavior closer to that goal.

So the warning would probably be the first step. Driving to unsafe areas will still be technically possible but it will become progressively more cumbersome until you just give up.

I think that imposing decisions on others for their own good is a dangerous path to take. You stop considering them as adults capable of taking rational decisions but as children that need ot be shown the light, by employing authority and force if necessary. The enlightened technological elite thinks that HTTPS is better so they have decided to impose that decision on everyone else.

It should always be a choice. If something is insecure, show a warning, in big red bold letters if you have to, but allow the freedom of choice to the end-user. But here, what do we have ? Many newer Javascript, HTML or HTTP features are restricted to HTTPS. Even things like Brotli stream compression which bear no security implications. This is done only to coerce people to use HTTPS.

I think your last statement highlights the real issue here. Everyone is afraid of malicious javascript. I don't know why they're conflating that with http injection.

The most straightforward thing to do would be to disable javascript on non https sites by default or warn if a nonhttps site has javascript. Most of the old sites we want to keep around don't have javascript in them (or much javascript in them).

Ideally people should only be enabling javascript on sites they trust (and are running https for "real" "trust") but having a trusted whitelist for enabling javascript brings back your big brother arguments.

It's not just javascript though, we've seen ISP (or other malicious actors in the network) inject ads, of even place the entire HTML content of the site into an iframe.

Bingo. This is why it matters to Google. Ad injection could impact their bottom line.

This is a malware injection problem and it should be possible for google to create signatures of JavaScript from different websites and have chrome verify it and block it.

Penalizing all http users is heavy handed and google should not go down that path.

Nobody is giving up freedom for security; you can still visit HTTP sites if you want to, its just going to be treated as unsafe by default.

As other commenter noted, Comcast has been observed to inject content to its customers; would you rather that on HTTP or that you run HTTPS?

When a highway is plagued by bandits, the govt must go after the bandits and put them away, not close the highway or turn into a cramped tunnel made of armoured steel with only one narrow lane.

That's a very narrow view of the options available for law enforcement. Sometimes "going after all the bad guys" is a terrible strategy.

So which central govt should we trust to "put the bandits away" on the internet?

I'm saying that instead of doing away with plain-text protocols, maybe national govts can each regulate their ISPs to stop injecting content into the bits they transmit? That would go a long way towards increase of privacy. As for bad state (sponsored) actors, I doubt https can really stop them doing what they want, especially not the big ones.

> maybe national govts can each regulate their ISPs to stop injecting content into the bits they transmit?

Good one. Next you'll be telling me that those very same companies don't spend billions on getting the laws written the way they want.

Sure you could try the top down approach where everyone has the best intentions but that's not going to happen, in the meantime I'm installing bulletproof windows in my car.

Some Javascript, HTML or HTTP features are available on HTTPS only. Even things like Brotli stream compression which have no security implications. So some liberty is definitely taken from users who wish to use insecure connections for whatever reason.

> I think it can be summed up in one old but very relevant-in-our-times quote: "Those who give up freedom for security deserve neither."

Now if you could explain to me how using secure connections and showing a correct warning for insecure connections is restricting your freedom that'd be interesting.

My ISP offers security certificates for $145 more than I currently pay per year. The result is that I'll have to pay up, or face a drop off in traffic for my sites from people who will be too scared to view them because of this new browser-based warning... My sites are all public information, no secure data is displayed on them, and there are no user accounts beyond those of my team's editing accounts. It would be sort of overkill to require HTTPS on them.

Cloud hosting is much more expensive than my current hosting plan. It seems like this is also highly convenient for ISPs that http will be phased out because either way, ISPs make a lot more money out of web site business by the newly required standard.

This is the future we knew was coming, where it becomes so expensive for individuals to do the same as companies do. It's how Radio, TV, and many other things were taken away over the years, it simply became too much of a legal hurdle and way too expensive to run until large companies became the only channel owners.

It's just history repeating itself, but now to shut out individual web site and application makers who don't have resources to compete with big business. :\

My hosting service makes no money from me installing Let's Encrypt on my sites. Is that available on your hosting provider?

The quote is:

“Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety”

And it was about taxes.