Hacker News Reader

Comment by PaulDavisThe1st | Hacker News Reader

Just yesterday HN had a link to an article on plaintext HTTP for the modern era. I'm not condoning illegal/dubious attempts to silence dissent, but loss of an SSL cert doesn't really suppress anyone's ability to communicate.

Tell me I'm wrong.

View on HN

You're wrong to the degree SSL becomes a requirement burned into browsers, which seems highly likely and is partially true already for certain domains. Unless you're going to argue that being forced onto the non-web is not suppressing your ability to communicate, but if so that's a tough argument to dig into here.

edit: I should add here the thought exercise is that you are participating in speech that is legal and ethical but are overruled by SSL cert providers and are unable to get a root signed cert from anyone (or whatever other means of preventing SSL.) In that case, even if you are not hard blocked, having your speech be passed around the internet in cleartext also seems like it affects your ability to communicate in a negative way.

as noted by others, you do not need an SSL cert to be on the web. You need an SSL cert to use https, which is something entirely different.

1) Browsers no longer let you (easily/ 2-click) override some ssl errors, and the overwhelming trend has been to start treating a lack of https similar to an ssl error, as far as ui goes.

2) Is this practically any different than saying newsgroups, or even bbs(?), still exist, so those avenues for free speech are viable remedies for being otherwise suppressed.

To your first point: Firefox still lets you easily override a ssl error with 2 clicks. Go to the site, click "Advanced" and then click "Accept the risk and continue". Using the most up to date version of firefox on MacOS, Linux and Windows.

I'm pretty sure that even FF won't let you easily override an error on a site with HSTS that presents an invalid certificate.

Only for certain types of ssl errors. The advanced button has been removed from some of the error pages.

*Although it's mostly been chrome. I did at least see it on Firefox while att tried to MitM errors during a recent outage.

I believe the recent att router bit-flipping issue resulted in the same.

1. seems unlikely. I don't think there's any mainstream browser that presents http://myrandomsite.whatever/ as an SSL error, in the same way as, say https://google.com/ having an invalid certificate, nor is there ever likely to be.

Reply on news.ycombinator.com