Hacker News Reader

Comment by scarface74 | Hacker News Reader

Supporting https is only an infinitesimal part of what makes downloading apps on the internet like playing Russian Roulette. It still doesn't prevent unsuspecting users from downloading malware, adware, ransomware, and apps that siphon user data. It also doesn't prevent users of sites depending on third party ad networks from being a victim of the same vulnerabilities they are now.

View on HN

Later google will launch .ampp for apps that are certified to only have Google and their thousands of partners sharing your PII 'securely'.

That honestly doesn't even sound like a joke. I'd believe it if you said that's a quote from the article.

I really like the .app idea, it will save me some time.

echo ".app" >> lists/google/domains

/usr/local/xxxxxxxxx/ufdbConvertDB.sh

service ufdbguardd reload

Problem solved. It is just a matter of fashion, black or white dress? Last few years, black fits better.

...and I'm not sure Google has claimed any different. Just that HSTS enforced on the TLD level is more secure than otherwise, which it is.

Because telling my grandma ".app urls are safer because Google" is like saying "here's a loaded handgun, but the safety is on, go nuts!"

actually that's a bad example because even then my grandma knows to be careful. but she's tech illiterate enough that if she hears something is "safer" she will put blind faith in it.

This isn't an issue for me and you, the readers of HN, this is an issue for Jane Doe, who already has low standards, and is now going to lower those standards even further for a set of websites.

Jane Doe is not reading the Google Blog. The article is directed at developers.

When grandparents start seeing .app urls, they are going to be naturally wary. And they might even avoid clicking them. Then someone is going to ask about them to someone who is only partially tech savvy.

And that someone will tell them that those are safer URLs. And that gets misinterpreted and soon you have people saying they are special approved by google URLs that are guaranteed to be safe.

Regardless of who the article is for, tech illiterate people are going to ask "what is this new URL thing, and should I trust it?"

I don't see what's so difficult about explaining this to your grandpa:

"What's .app?"

"it's like .com or .org, don't worry about it"

That is exactly what I would do. The issue arises when some semi-technical person reads this blog and their response is:

"it's like .com or .org, but it has some stuff in there to make it more secure, and it's managed by Google"

I'm also not the only person my grandparents get to ask about things.

I'm not saying this is all a bad thing. Just that we should be aware that giving things a little security can make people more careless.

Agreed. The title made it sound like every application hosted from .app would be somehow vetted. Which would be... unconventional, but pretty interesting. Instead it's just another random foothold Google's found in its crusade against HTTP.

Not that I think HTTPS-everywhere is bad, I just think there are better ways to spend one's effort now that we have HTTPS-nearly-everywhere.

Reply on news.ycombinator.com