Due to the features of public-key cryptography, we could let Google mirror all the small parties and still be sure that the information comes from them and is up to date. I don't see this as a valid argument.
89 karma · joined April 7, 2013
Also Linux is still an option. It could be configured for all the needs (contrast, font size, clean UI, autologin, ...) and has some additional administrative features like automatically upgrades in the background (including Flash, if Ubuntu is still providing that meta package) and every configuration could is also openly reflected in the file system which might help doing remote support and backups. Also it might prevent the usual Windows/Mac malware downloads.
How is that relevant? I would also say the targeted plattforms (which browser, OS) are the most important point.
StartSSL wants $200 for two years, additional ones cost $50 then. Haven't seen anything cheaper.
Your logic is wrong here. It is totally unimportant which CA you use, as long as any commonly trusted CA just checks the domain ownership using a mail address. A man-in-the-middle could simply replace your cert with that one and the user gets no warning.
> Stick with either EV Green/blue bars are a remarkable feature the user sees and might give trust. Those one are already available for $200 for 2 years. But I'm not sure if a user would realize that a MITM attack has removed the color. He wouldn't get a warning as long as any valid cert is still used. See my response above.
> or a high-assurance only If you need assurance, then yes. But a normal user doesn't care of that. And you should then also check the exact terms and conditions as well as other assurance services.
It is even totally unimportant if your provider is "insecure". If any of the commonly trusted CAs is hacked it affects the security of your service as well as if it's the CA you use.
Therefore I would go with StartSSL (https://www.startssl.com/). They are trusted on all important plattforms, are free for one subdomain per domain and very cheap otherwise. You only pay the verification of your identity, unlimited domains, wildcard etc. then. I haven't seen any cheaper one. You might get some competitive prices if you combine the use of single subdomain ones through SNI, but I wouldn't prefer that over a inexpensive wildcard one.
What is the worst that can happen? If the revocation servers go down, the browser just shows a small warning symbol, but everything still works. If your CA gets hacked and untrusted in common browser, you have to buy a cert somewhere else ... this is the risk of every CA and a new cert is just minutes away ...
There is no way to determine who is more secure against hacks etc. If they are trusted where you need them, they are all equal.
Processing those orders doesn't seems that fair to me. Same rare people get 90% (!) off, all others don't. And FCFS isn't a cool, really fair principle. It is often used, because it is easy to implement and doesn't require more information than just time.
Also I expect the rate of people who ordered just because it is cheap and have no real appropriation is pretty high on that discount. Not talking about people who just wanna resell it on eBay.
What else could they have done?
* Make a general discount (e.g. 10-30%) for all potential
shoppers for the next weeks.
* Spend the lost money for development
* Hire more people
* Donate it to charity
* Make a challenge in any fair way. Again, time and
reaction is a pretty unfair criterion.
* Sponsorship
* ...
Also not sure if this is real marketing. Are their clients really that community based and speaking about such thing? Aren't more just angry because they hadn't the chance to use the opportunity?
Facebook comment (from source): "Well that's absurdly consumer friendly"
TL;DR: If you give some customers 90% discount for no reason, it means unfair prices for all others. Is that really consumer friendly?
It isn't that bad and at least here smooth and only if the page is visible. But may have bad effects on mobile/retina/...
any messaging app included by default in Android will have users migrating in droves
Yeah, that's why Google+ replaced Facebook and everyone is using Google Talk. Nearly every browser comes with Google as search engine or homepage and it didn't worked.
You are right, a permanent connection isn't that great on mobile phones, but as a custom XMPP service you could just use push technology like every other app, too. That's what e.g. Google and Facebook are doing.
Beejive and IM+, two common mobile IM apps with XMPP support, are doing this, too. The only downside is, that since they don't want to store you credentials, you have to run the app to reconnect to your XMPP server and delegate that connection to their push servers. This is just a bit annoying when either jabber.org or their servers have connection errors.
It's a shame that these are making money from that basic consumer security. Especially since SSL is neither expensive nor need a lot of performance.
`//fonts.googleapis.com/css` becomes `file://fonts.googleapis.com/css` → doesn't work
Additionally, JavaScript files might not load or work due to browsers' (security) limitations. Not sure about the exact details here.
Regex in CSS can be used to guess page content. Also CSS can load SVG which may include JavaScript.
In that example you can read the source before, the chances of an evil change just when loading it with your terminal is quite limited, MITM doesn't work that well on SSL, too.