CSS Paint API: New possibilities in Chrome 65

Quit bloating the web...

Also I am sick the HTTPs everywhere movement. What if I for what ever reason don't want to use HTTPs.

We have so few browsers, that basically what they do is the defacto standard.

if you went to the trouble of setting up a certificate and enabled HTTPS for somethings, why not just enable it across the board for the entire site? i think in 2018 a non-HTTPs site is just lazy. personal opinion, but it is 2018 after all. i understand large sites, blah blah blah, but any new site seems like a no-brainer to me.

Or maybe Google and Mozilla actually want to make the web more secure? Not everything has to be a conspiracy.

Try to implement the rendering engine of a web-browser. The standards keep growing. A much simpler model could have been drafted for web content. Instead we keep hacking onto HTML adding things like CSS, JS. Then we keep adding on to those add-ons. Clearly, people are building things that are not documents. So why do we keep adding hacks to this document model?

Further, when you you Google, Mozzila, ect... saying you can't you use a feature without HTTPs the effectively make HTTPs part the standard even though it's not written in the standard.

For instance let say I wanted to run HTTP 2.0 web server. The HTTP 2.0 standard does not require encryption. However, because none of the browsers vendors support HTTP 2.0 without TLS. I must setup TLS to make my server accessible. It's not part of the standard, but the big browser providers effectively make it part of the standard. I don't have a problem with crypto. I just hate the browsers forcing it to be basically part of the standards. When it should be optional.

I would hardly call it secure. There have been too many failures with certificate authorities. The whole system is dependent on that weak point.

Also do you keep track of the certificates issued to every website you visit? Then if you visit the website notice the certificate has changed. Do you check if it's a legitmate change ect.. If you don't keep track of certificates how do you even know you are not being MITM. You trust the certificate authority to handle that. However, certificate authorities clearly have signed or given out bad certificates.

Further, it only takes one bad certificate authority to compromise the entire system.

If the browsers really cared they would make sure that all login mechanism use something like J-PAKE or a private Key. That way if certificate authority was compromised the attacker would also have to know either your password or private key.

Further, not everything requires an encrypted session. It just adds overhead for no good reason. If you worried about MITM injecting a zero day. It would help if the web standards did not keep getting more and more complicated increasing the attack surface. All you need there is just a simple signed hash of the page. Some things might not even need that.

--EDIT-- I went on a bit of ramble there. If we want to be Mr. Conspiracy. I would say google likes adding more and more features because it makes it harder for competing browsers to exist. Not only that let's consider HTTP 2.0. The standard does require TLS, but Firefox and Google will not talk to HTTP 2.0 web-server without TLS. The large market share of Chrome for instance makes you unable to decide to run a plain text HTTP 2.0 web-server even though TLS is optional according to the standard. Even though Chrome is not the standard as specified by the standard document. I am forced to comply with how chrome and firefox are doing things. The effectively can make their own standards since there are so few browsers. The would be my Mr. Conspiracy reason why google would want to require TLS. Becuase let's face building a secure Crypto stack the meets all the requirements for TLS is not easy. So that just increases the barrier to entry.