Hacker News Reader

Comment by gear54rus | Hacker News Reader

People who cheer for tons of stupid fucking HTTP warnings all over the place really bug me to be honest. Anyone who uses the web needs to be taught the difference between a secure and insecure connection and told where to look for signs (this assumes we burn stupid shit browsers that look to mangle URL bar by removing data from it).

The grandma will not make better decision if you put in another dumb warning like this one https://i.imgur.com/rxmyWtF.png to waste more and more of my time when I enter my password on the same website over and over. I KNOW IT'S INSECURE, JUST STFU already.

I'm at the point where I will look to build my browsers from source after removing that shit (along with removing inability to add certificate exceptions for certain situations). Good thing they're open source.

View on HN

I don't get how so many people miss the point here, but alas.

It's actually not so complicated: obviously, there's nothing actionable for the user to do here. The message is for the user, but only indirectly: it's there to push developers into better practices. Your boss may not care about encryption or privacy, but definitely will care about hundreds of phone calls asking why they are warned that the form is insecure when they try to login.

With plenty of obscure pages accepting everything from passwords to credit card numbers on plain HTTP pages, this is important. There may not be someone browsing the page knowledgeable enough to catch this, but if any end user can know what they're doing is wrong, then it's much more likely it will be discovered.

While mostly not actionable directly for users, one thing a user can, and probably should, do is close the page, if they can.

It's actually not so complicated: obviously, there's nothing actionable for the user to do here. The message is for the user, but only indirectly: it's there to push developers into better practices

So it's the online equivalent of plastering Warning: Contains chemicals known to the state of California to cause cancer all over everything from gas pumps to gerbils.

Yeah. Real useful.

Except it works. If it makes you mad, imagine how many other people it makes angry. And aside from recompiling your browser, all you can do is fix the problem and make the browsers happy.

Except it works.

No, it doesn't, unless your goal is to condition users to ignore yet another warning.

There are downsides to doing that, believe it or not.

Frankly, if they could just drop plain HTTP support altogether, I'd prefer that. This is more of a friendly compromise.

This is more of a friendly compromise.

"Nice open Internet you've got there, no gatekeepers. Be a shame if something were to happen to it."

There were never no gate keepers.

This is the issue with all systems that use human-friendly naming because someone is in the authority to do the name resolution. This battle was lost when DNS came along.

Not everybody wants to use public keys to refer to everything - even if it is via QR codes.

It makes me want to start serving my sites over Gopher exclusively.

If 99.9% of companies could remove those carcinogenic chemicals without reducing the value of the products, I would support that warning too.

Even if cancer rates were more or less completely uncorrelated to the presence and/or usage of those products? Congratulations, you've raised the social noise floor for no good reason.

> this assumes we burn stupid shit browsers that look to mangle URL bar by removing data from it

That's just about every browser now. I think that full URLs are only available in Firefox, and only if you set `browser.urlbar.trimURLs` to `false` in about:config. Hiding URL information is a very bad trend.

You can show full urls in Safari if you want.

also Opera.

Safari is the worst by default. I don't have any Apple devices, but when I look at screenshots of Safari's URLs, they are not full URLs. Also, it looks like you can't show the full URLs on iPads or iPhones. (You can on Firefox for Android.)

Not a full URL: example.com

Not the full URL: http://example.com (the page will load after completing the URL with a trailing slash)

This is the full URL for the homepage of example.com: http://example.com/

As it is demonstrated now, the indicators work to show the http part of the URL in a way that relates some of its subtext much better to average users. Now, if it were to stay that way, I would be fine with it. But if past performance is any indicator here, this will be just the first step on that silly warnings spiral. If browser vendors aren't careful, they'll flood users with too many warnings, which makes them ignore them entirely.

>If browser vendors aren't careful

But they are being careful. This rollout has been taking place slowly over the last two years, and continues to do so.

Changes are incremental to give developers a chance to adapt, and to prevent users from getting used to warnings.

HTTP/2 requires https. New APIs have started requiring https. And only forms with passwords or CC inputs will trigger security warnings. These are incremental steps.

I don't know why people think browser vendors haven't considered this stuff before.

Eventually vendors will start deprecating existing APIs to continue the migration towards requiring https. That will put more heat on developers, but only after they've ignored warnings for literal years.

But even the change announced today is only a UI update to the omnibar. It's hardly earth shattering.

Browser vendors are clearly not careful enough. Requiring SSL brings with it a kind of baggage that is ill-suited for tons of use cases. Do not simply assume that all developers ignored these signs out of laziness. They might instead be unable to comply in a useful fashion.

HTTP worked unchanged for close to 3 decades. People started to rely on that. Now they are trying apply crowbars to force that out. This is myopic.

Reply on news.ycombinator.com