Chrome disables support for mandatory features of HTTPS | Hacker News Reader

Chrome disables support for mandatory features of HTTPS

rkeene.org

27 pointsrkeene29 comments

Open articleView on HN

It seems like a stretch to call a feature "mandatory" which was described by a RFC as "deprecated" 17 years ago.

RFCs are not a death pact. Standards can change, especially where security is concerned.

this. The author sounds like a your usual snarky old burnt out IT dinosaur.

"Ughhhh, something changed again! Why does tech always do this?!"

I'm not. I do a lot of interesting work, much of which does not rely upon any standards because it changes so much.

Standards CAN change. This standard DIDN'T change. The Chromium developers referenced this particular RFC (RFC 2818) in reference to a bug as to why this mandatory feature (per the RFC) was disabled, when the document they referenced doesn't agree with their conclusion.

The snark levels are off the charts though :)

If you think that's snarky, see my (unanswered) question to the developers here: https://bugs.chromium.org/p/chromium/issues/detail?id=308330...

I'm pretty sure the answer is "Yes".

It's clearly and explicitly mandatory, "MUST" means something quite specific.

Now, perhaps one can argue that there is a good reason to behave this way anyway, but it's clearly violating the spec.

The feature of CAs generating certificates that way is deprecated says RFC 2818 in a non-normative way (since it's outside the scope of RFC 2818).

The feature of supporting it is mandatory says RFC 2818 in a normative way.

It is mandatory if we are to agree on HTTPS being defined by RFC 2818, which the Chromium developers themselves referenced.

"While operators should not create certificates this way because it is deprecated, HTTPS clients MUST support this or they are not compliant with RFC 2818. That is, creating certificates this way is deprecated -- HTTPS clients MUST still support it."

Yeah, but google says no.

Reply on news.ycombinator.com