1,984 karma · joined June 19, 2017
That does not necessarily require TLS to mitigate (although TLS does help, anyways). There are other issues with financial transactions, whether or not TLS is used. (I had idea, and wrote a draft specification of, "computer payment file", to try to improve security of financial transactions and avoid some kinds of dishonesty; it has its own security and does not require TLS (nor does it require any specific protocol), although using TLS with this is still helpful.) (There are potentially other ways to mitigate the problems as well, but this is one way that I think would be helpful.)
It is not a problem if you are only serving static files.
I think it should allow but not require encryption.
> Removing encryption means that you can't reasonably do financial transactions, accounts and access restriction, exchange of private information, etc... You only share what you want to share publicly, with no restrictions. It seriously limits commercial potential which is the point.
Note that the article linked to says "the Gemini protocol is so limited that it’s almost incapable of commercial exploitation", even though Gemini does use TLS. (Also, accounts and access restriction can sometimes be used with noncommercial stuff as well; they are not only commercial.)
> It also helps technically. If you want to make a tiny web server, like on a microcontroller, encryption is the hardest part.
This is one of the reasons I think it should not be required. (Neither the client side nor server side should require it. Both should allow it if they can, but if one or both sides cannot (or does not want to) implement encryption for whatever reason, then it should not be required.)
> Anyone can man-in-the-middle and change the web page, TLS prevents that. But what I think is an even better solution is to do it at the content level: sign the content, like a GPG signature
Using TLS only prevents spies (except Cloudflare) from seeing or altering the data, and does not prevent the server operator from doing so (or from reassigned domain names, if you are using the standard certificate authorities for WWW; especially if you are using cookies for authentication rather than client certificates which would avoid that issue (but the other issues would not entirely be avoided)).
Cryptographic signatures of the files is helpful, especially for static files, and would help even if the files are mirrored, so it does have benefits. However, these are different benefits than those of using TLS.
In other cases, if you already know what the file is and it is not changing, then using a cryptographic hash will help, and a signature might not be needed (although you might have that too); the hash can also be used to identify the file so that you do not necessarily need to access it from one specific server if it is also available elsewhere.
> Well, if want to protect yourself, TLS won't save you, you will be given away by your IP address, they may not see exactly what you are looking at, but the simple fact you are connecting to a server containing sensitive data may be evidence enough.
There is also SNI. Depending on the specific server implementation, using false SNI might or might not work, but even if it does, the server might not provide a certificate with correct data in that case (my document of Scorpion protocol mentions this possibility, and suggestions of what to do about it).
The article is about in JavaScript, although it can apply to other programming languages as well. However, even in JavaScript, you can use \u escapes in place of the non-ASCII characters. (One of my ideas in a programming language design intended to be better instead of C, is that it forces visible ASCII (and a few control characters, with some restrictions on their use), unless you specify by a directive or switch that you want to allow non-ASCII bytes.)
YAML is worse in many ways, though.
XML has no data types but does have data structures.
I prefer to use DER (which also has some problems, but they are much less bad in my opinion).
(Your message is better than the one with a lot of noise, though.)
A warning label like you mention is a possibility if that is considered to be necessary, although I think it might be better to have a file that you can download and read (or request by mail or telephone or fax, if this becomes necessary in some circumstances; do not assume the computer always works and is compatible with your file), instead of a searchable wiki.
The is a setting in Explorer, but it does not affect all file types; some (such as .lnk) are not affected by that setting and hide the extension anyways.
There are still ways to help, such as having a menu bar, and having good documentation. (Documentation is more important, in my opinion; but both are helpful.)
I agree, that the interactivity should be primarily keyboard-driven. However, mouse input is useful for many things as well; if there are many things on the screen, the mouse can be a useful way to select one, even if the keyboard can also be used (if you already know what it is, you can type it in without having to know where on the screen it is; if you do not know what it is, you can see it on the screen and select it by mouse).
> Forcing users to click on graphical elements presents many challenges: what constitutes an "element"; what are its boundaries; when is it active, inactive, disabled, etc.; if it has icons, what do they mean; are interactive elements visually distinguishable from non-interactive elements; and so on.
At least older versions of Windows had a more consistent way of indicating some of these things, although sometimes they did not work very well, often they worked OK. (The conventions for doing so might have been improved, although at least they had some that, at least partially, worked.)
> A good example of bad UI that drives me mad today on Windows 11 is something as simple as resizing windows. ... it's not clear where the "grab" area for resizing a window exists anymore
I had just used ALT+SPACE to do stuff such as resize, move, etc. I have not used Windows 11 so I don't know if it works on Windows 11, but I would hope that it does if Microsoft wants to avoid confusing people. (On other older versions of Windows, even if they moved everything I was able to use it because most of the keyboard commands still work the same as older versions of Windows, so that is helpful (for example, you can still push ALT+TAB to switch between full-screen programs, ALT+F4 to close a full-screen program, etc; I don't know whether or not there is any other way to do such things like that). However, many of the changes will cause confusion despite this, or will cause other problems, that they removed stuff that is useful in favor of less useful or more worthless stuff.)
Although it is bad that it does not display the keyboard shortcuts, you can push ALT and then it will tell you which letter to push next. (I just guessed that pushing ALT might do something (possibly display a menu?), and I was correct (it did not display another menu, but it did help).) This is not quite as good as using the other keys such as CTRL, or numbered function keys, but it is possible.
(I do not use those programs on my own computer, but on some other computers I sometimes have to, and this helps, although not as well as it would to use menus and other stuff instead. However, in some cases I was able to use it because of knowledge of older versions of Microsoft Office; many of the keyboard commands are the same.)
I think the menu bar is much better, and toolbars should not be needed for most things. With the menu bar it will underline the letters to push with ALT and also will tell you what other keys to use (if any) for that command. (One thing that a toolbar is helpful for is to display status of various functions that can change, such as the current font. Due to that, you might still have a toolbar, but you do not need to put everything in the toolbar. Perhaps combine the toolbar with the status bar to make it compact.)
(Something else that would improve these word processing software would be the "reveal codes" like Word Perfect. A good implementation of reveal codes would avoid some of the problems of WYSIWYG. For spreadsheet software, arranging the grid into zones, and assigning properties (including formatting and formulas) to zones, and making references work with zones, etc, would be helpful, but I don't know that any existing software does that.)
In my own software I do try to make the display compact so that there is more room for other stuff, instead of needing to put all of the commands and other stuff taking up too much space in the screen. Good documentation is helpful to make it understandable; this would work much better than trying to design the software to not need documentation, since then the lack of doumentation makes it difficult to understand.
I also wrote a program in PostScript to draw Cistercian numbers (which uses the nonstandard sign for 6):
% Specify a four-digit number as the command-line argument.
/A ARGUMENTS 0 get def
/Digit {
get 48 sub {
{} %0
{24 0 rlineto} %1
{0 -24 rmoveto 24 0 rlineto} %2
{24 -24 rlineto} %3
{0 -24 rmoveto 24 24 rlineto} %4
{24 0 rlineto -24 -24 rlineto} %5
{24 -24 rlineto -24 0 rlineto} %6 (nonstandard)
{24 0 rlineto 0 -24 rlineto} %7
{0 -24 rmoveto 24 0 rlineto 0 24 rlineto} %8
{24 0 rlineto 0 -24 rlineto -24 0 rlineto} %9
} exch get exec stroke
} bind def
4 setlinewidth
6 6 moveto
gsave
36 0 rmoveto
0 72 rlineto
gsave
-1 1 scale
A 2 Digit
grestore
A 3 Digit
grestore
36 72 rmoveto
1 -1 scale
0 72 rlineto
gsave
-1 1 scale
A 0 Digit
grestore
A 1 Digit
showpage quitHowever, spaces, line breaks, tabs, page breaks, etc are not normally tokens (and should not be tokens), but will separate tokens.
However, that is not the only issue with the syntax, although it is a significant one.
Similarly, the user can also set their own fonts for the terminal, just as you can with colours and other functions. (However, some programs will have a reason to configure the fonts and palettes for the specific use, although most won't and even if they do the user might disable those features.)
A program can have an option (possibly by environment variable) to disable colours entirely; this might be necessary even if you can disable colours in the terminal emulator, because a program might want to use such things as reverse video, underlined text, etc to indicate some things when colours are disabled. (Disabled colours can also be useful if you do not have a colour display or if you want to print out a screenshot without a colour printer.)
However, some people do use AI-driven software development, so it is also possible that some changes will be made due to that as well.