Hacker News Reader

Comment by Touche | Hacker News Reader

> The move to "deprecate" HTTP is an explicit attempt to manipulate the rest of the world into making SSL easier and more affordable. It is unfair to evaluate this proposal in isolation without considering the market upheaval that it is very much intended to trigger.

I'd love to believe this but I've never once seen the https-only nazis bring up this issue on their own, or show any concern for the fact that it will limit speech on the web. The y mostly work for companies where getting ssl certs is no big deal, and they put their personal projects on github or heroku anyways.

The backbone of the web was the fact that you could put up a website on your own computer within a matter of minutes. That is now going to be gone and I've never seen the biggest advocates of this change show any concern whatsoever.

View on HN

That's just FUD. Nobody is planning to block plain HTTP requests altogether. You can still put up a website on any computer and serve it over plain HTTP, and it will render correctly on most browsers.

The plan is to disable some of the "more dangerous" features when the page is requested over HTTP, in order to entice webmasters to adopt SSL. The list hasn't even been written yet, but I'm guessing that most of those features will be fancy javascript and third-party plugins like Flash. Which you probably shouldn't rely on being enabled in the first place.

I personally wouldn't mind if every insecure page behaved as if I had NoScript & NoFlash enabled by default.

You may be right about the excessive idealism of so-called HTTPS nazis on some online forums, but I'm pretty sure that the people in charge at Google and Mozilla are more level-headed and realistic.

> the goal of this effort is to send a message to the web developer community that they need to be secure

This is not true. The suggestion is that essentially all new features will require https. You are effectively blocking http if I can't do anything interesting with it.

The proposal says:

> That would allow things like CSS and other rendering features to still be used by insecure websites ... [but] restrict qualitatively new features, such as access to new hardware capabilities ... [like] persistent permissions for camera and microphone access

If accessing my camera over an insecure connection is your definition of doing interesting things, I would be happy to block you.

In fact, I can't think of a single proposed addition to the current web stack that would be safe to use over an insecure connection.

You have every right to express your views using a static document and stylesheet. But anything beyond that tends to involve executing your code on my computer, and nobody has any obligation to let you do that, especially over an insecure connection. Requiring people to make some additional effort before they can access other people's property sounds like a nice balance of rights and obligations to me.

You changed your opinion quickly. Previously you said:

> The plan is to disable some of the "more dangerous" features when the page is requested over HTTP

And now you're saying that every new feature falls into this category.

Listen, I'm all for going all-in on SSL. What I'm not for is doing until SSL is as seamless and inexpensive as HTTP.

What really concerns me is that the https-only nazis do not share this concern. It's never mentioned in their blog posts.

It actually really scares me that something that has been so important for making the web as powerful for the cause of freedom is not even on the radar of the people who are controlling the direction of the web.

No, I didn't change my opinion. I just clarified what I meant by "more dangerous", and IMO everything that involves javascript or access to surveillance hardware (camera, microphone, GPS, etc.) qualifies as dangerous.

My fundamental disagreement with you is that I don't think we can wait until "SSL is as seamless and inexpensive as HTTP". That will never happen unless we can pose a credible threat to the profit margins of web hosts and CAs. And sending a horde of unsatisfied customers in their general direction is one of the most effective ways to pose such a threat.

Its a bit like the ipv6 band wagon 20 years ago I or anyone with a trivial knowledge of the internet/networking, could have pointed out that developing a new standard with NO thought to inter operation would not work.

Also having it developed by 19 university types and one guy from Bell labs was asking for trouble

>And now you're saying that every new feature falls into this category.

Subtle misreading. It's not that new features are in that category by definition, it's that every major feature proposal kijin has seen so far has been of the dangerous sort.

The move to deprecate HTTP is solely inspired by the need to authenticate online communication. It's necessary to protect speech on the web, because it makes it harder to tamper with the content in transit. Your ISP shouldn't be able to inject ads into a web page, a WiFi access point shouldn't be able to change every "do" to "do not", and a passive listener shouldn't be able to collect information about you for his own gain. SSL/TLS is a huge mess and the current CA situation is abysmal, but authentication needs to happen now, or there will be no privacy or freedom on the Internet.

We can't have an intelligent conversation if you're going to suggest that free speech doesn't currently, and hasn't always happened on the web.

There's plenty of privacy and freedom on the internet... otherwise the internet would not have existed this long the way it has. More security is always better but let's please stop with hyperbole.

I'm not convinced that's the backbone of the web at all. Can you back up your assertion with anything beyond emotional pleading?

There were alternatives like AOL and Prodigy and the open web killed them.

Reply on news.ycombinator.com