Hacker News Reader

Comment by 0x0 | Hacker News Reader

Disabling SHA1 for only a subset of Firefox 51 users after release sounds like it'll cause a lot of confusion. "Is my computer hacked?" "It works for me!" etc etc

View on HN

Almost all changes are effectively "staged" like this whether intentionally or not, because people upgrade at different times, and some fail to get updates completely. Making it easy to figure out depends more on writing clear error messages and documentation than on making everyone's configuration change at the same time.

Another good reason to not do the nonstop upgrades that FF keeps coming up with. I'm hanging in the upper 40's until this shakes out.

I understand SHA1 is an issue, but I'm also confused by some things. Happy to have web pages be encrypted to keep my personal information from being captured. Not really sure why we are encrypting video streams from Youtube. Is a cat video something that we need to make more secure?

And I agree with the comment that the problems are now coming back to the plethora of CA's that have popped up in the last few years.

> Is a cat video something that we need to make more secure?

If the video you're watching is political in nature and you live in under an oppressive regime, absolutely. Youtube's not just cat videos.

YouTube should sort all of its videos into two groups, one group worthy of being secured and one group not. /s

Probably should be on v45 rather than the upper v4*s if you're not doing upgrades, since it's the extended support release and will receive security fixes. Although opting to not take updates because Firefox is taking a harder security stance going forward seems a bit self-destructive...

Video decoder bugs are not unheard of - unless you want to leave open the possibility for someone to inject content of their choosing into code running on your computer, you lock it down.

> Not really sure why we are encrypting video streams from Youtube. Is a cat video something that we need to make more secure?

You think the Internet is still a toy?

You probably want to follow ESR [0] then. A new version is released for every seventh Firefox version, IIRC, and those are supported (i.e. receive security fixes) for a year.

[0]: https://www.mozilla.org/en-US/firefox/organizations/faq/

Good to know, thanks for the link

> Not really sure why we are encrypting video streams from Youtube. Is a cat video something that we need to make more secure?

Yes, for several reasons. Multiple ISPs have purposefully messed with YouTube and other video traffic, and YouTube reported that after they switched to HTTPS, many of their video reliability issues simply went away.

Also see https://en.wikipedia.org/wiki/Great_Cannon ; it's not safe to load any content over insecure HTTP.

> Is a cat video something that we need to make more secure?

This is about solidarity by increasing the background noise. If only those people who really need it would use encrytion, they were easy to detect and to suppress.

So, please show solidarity with the weak people in our and other societies by encrypting as much non-sensitive stuff as possible.

Thanks for the thought out reply, that makes the most sense.

> Is a cat video something that we need to make more secure?

If I'm hosting a cat video on my website, I don't want my visitors' slimy ISPs adding Javascript-injected ads to my page and my visitors thinking it was me.

But more importantly: There's something very wrong with declaring that certain kinds of content should be relegated to a second-tier, less-secure technical stack based on a judgment that their content doesn't deserve security.

People have answered already but I want to summarize two key facts:

- Browsers are huge attack targets and if you don't update you will be vulnerable to many more vulnerabilities.

- TLS not only provides confidentiality but also integrity. This prevents others from injecting content into the sites you visit, even if you don't care if they know the content.

Mozilla used to have a page that said something along the lines of "Your version of Firefox is out of date. Please update to stay safe and secure. If you don't want to update we recommend that you use the most recent version of another browser to avoid security issues." I can't find this page anymore, and I might have dreamed it but the message is good either way.

Also if you want Firefox to get off of your lawn and stop changing so often you can try the ESR release which has feature releases far less often while still receiving security fixes.

Reply on news.ycombinator.com