Hacker News Reader

Comment by strictnein | Hacker News Reader

> ...it requires HTTPS to connect to all .dev websites. This protects people who visit your site against ad malware and tracking injection by internet service providers

The latter is true (it protects against injection), but I'm not sure how the former is. How would it protect against ad malware?

View on HN

My assumption from that sentence is that both "ad malware" and "ad tracking" are injected by some ISPs somewhere between the client and the server. By forcing HTTPS, you'd prevent some amount of this by ensuring the data in transit from client-to-server-to-client is encrypted (and thus mostly tamper-proof) using the .dev domain's public cert.

Also commonly injected by malicious or compromised WiFi routers.

It protects against ad malware injection by ISPs. It certainly doesn't protect users from the other end of the TLS socket.

Maybe they mean both the ad malware and tracking are injected by your ISP?

I think you are reading it wrong. It's not “(ad malware) and (tracking injection by ISPs)” but “(ad malware and tracking) injection by ISPs”.

But nobody with any respect for themselves has an un-ISP doing borderline illegal shit like that.

It hardly seems like a worthwhile problem to solve at gTLD-scale.

> But nobody with any respect for themselves has an un-ISP doing borderline illegal shit like that.

advertising and malware (both ad-related and not) injection by ISPs is a well documented global issue.

And not just ISPs. Governments, state-sponsored attackers, garden variety scammers, malware, compromised WiFi routers, etc.

If so, that’s a local problem and you fix it with regulation, not technology.

> If so, that’s a local problem

It's a well-documented global problem.

> and you fix it with regulation,

Governments are often not opposed, and sometimes active encouragers or procurers of the ISP injection.

Also, the HTTPS requirement for .dev domains is regulation, even if it isn't government regulation.

Burglary is illegal but you still lock your front door.

Defrauding someone electronically is illegal but you still encrypt your data in transit.

Reply on news.ycombinator.com