Hacker News Reader

Comment by Piskvorrr | Hacker News Reader

Wonderful, let's just autokill all abandoned software out of laziness. I can think of multiple programs that I use which haven't been updated in years, sometimes because there is nobody to develop them (project was cancelled/company ceased to exist/sole developer got fed up and quit/whatever). What are my options? Get a crappier but new alternative, or nothing - just because someone thinks "old == bad" (Meanwhile, new and drool-proof programs tend to exhibit the same bugs of old, despite having been sprinkled with magic memory-safe dust and blessed by current signature)

View on HN

My browser refuses to connect to a large number of websites, because they're still following the SSL best practices from last week. Apparently this is the reality we've decided to live in.

Firefox and Chrome give me that warning page, but I just click on "Advanced" and it will let me continue to the website. At least for me, it's just a huge warning to be careful but I still have ultimate control.

Watch Google decide that the advanced option is a security problem, and remove it, and Mozilla gladly playing along because "security" and "users are dumb".

The "owner" is no longer in control, and has not been ever since the web became "app-ified".

Browsers already do this with HSTS.

https://tools.ietf.org/html/rfc6797#section-12.1

It's not that 'users are dumb' it's that the only way to keep users and lazy IT staff from telling people to just click through the warnings is to make it difficult to do so. How else can you fight the 'click through until it works because I have work to do' mentality?

Browsers could have bright red flashing lights telling users that they're currently being phished and users would still enter their credentials because doing nothing isn't seen as a meaningful alternative action.

But there's no UI difference between "you're currently being phished", and "there's been a proof-of-concept white paper, that shows a nation-state level actor could theoretically decrypt this communication by spending a few hundred million".

Reply on news.ycombinator.com