Hacker News Reader

Comment by pietroglyph | Hacker News Reader

It's interesting that Firefox preserves the "Continue" button for affected sites, while Chrome does not. I get that we want to keep broken sites relatively accessible for a while, but I worry that we could also be teaching people to ignore warnings like these. I wonder if the continue button dissapears with HSTS…

View on HN

Probably because Mozilla subscribes to the ethos that a user should get the final say in what computation gets done on their computer, and not some third party. I would be sad if they ever took the "continue" option away.

This is consistent with their position on drm in browsers.

Firefox Nightly has the continue button regardless, but if the site has HSTS, it will tell you so, and will not allow you to add an exception; continue only shows the cause of the problem, in this case, that the certificate came from an untrusted source. This is in line with the "no user recourse" section of the HSTS RFC.

Users should get the final say always. This was normal behavior before windows 8. Now windows users are guests in their operating system, and the attitude can be seen in other software as well, not only from Microsoft.

Firefox is an awesome browser and is the most pro choice browser on the market, with options for privacy plugins, search engines, cookie choices, tracking protection, etc.

sounds like you've never needed to diagnose a broken cert before..

all of this nannying for the common good and breaking functionality is not always a good thing. provide sensible defaults and give the user control to override it as they see fit (like the continue button)

I agree with you, but the continue button does seem too easy. I'd make this an about:config type setting.

Well, to get to the continue button you have to click once, then after you click continue you have a new dialog asking if you're sure you want to trust the certificate and whether you want to trust just for the session or permanently. It's not idiot-proof, but then nothing in software ever is.

Personal responsibility? I have on occasion ordered things from websites who did not have their security in order. My conscious and informed decision. Although I did not order with a creditcard ofcourse.

Then what did you order with? Credit cards provide buyer protection against fraud unlike debit cards.

Bitcoin? Visa gift cards? Temporary Visa cards from places like entropay?

iDeal. Sending money from my bank account to the account of the webshop.

It does. I’ve found the inconsistency somewhat odd.

Reply on news.ycombinator.com