101–110 of 463 posts
Earlier quoted context omitted.
Default value matters ... it's a bit like opt-in vs opt-out
What's the point in having the protocol spelled out when you have the lock icon anyways? I don't think this would be a useful default.
Earlier quoted context omitted.
"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails." MITM is still an issue. At some point I hope browsers can switch to "you have to type http:// if you want HTTP", and this is a step in that direction. (Disclosure: I work for Google, speaking only for myself)
That is a stupid idea, forcing https on people’s throats is a stupid idea generally speaking but it wouldn’t have been that bad if it hadn’t been forced on many people by what is basically a monopoly by this point.
It's totally obvious to me that, once HTTPS is mandatory, the next step will be that Let's Encrypt will stop supporting websites that disobey their "content policy" or whatever. It will follow the usual course. First outright illegal things. Then today's "deadly sins" like racism. Then unpopular politicians. And then, whatever they want.
You are literally making a random organization into the censor of the web.
Earlier quoted context omitted.
I've found http://neverssl.com very helpful for captive portals. It does what you'd expect - hosts a HTTP-only page that allows captive portals to work correctly. Since it's only ever HTTP, it sidesteps the certificate errors or HTTP downgrades that normal sites are hit with during captive portal interception. I am curious what happens to captive portals as HTTPS adoption rises. Some OS's (Android, OSX) already detec…
Thanks for this. I never can remember URLs like this but I always remember chicken.com. It's sad day to see it go away.
It's a light funny page i've found about 10+ years ago but it's HTTP and helpfull for captive portals.
Earlier quoted context omitted.
One thing that was quite annoying to me is the URL changing under my cursor on double-click if the protocol is hidden. However, I can see that editing the URL is a niche use case. Fair enough.
I hate that editing URLs is practically impossible in Chrome on iOS (not sure about Android or other iOS browsers). There seems to be no equivalent of arrow keys to navigate around inside the address bar. If I screeenmash enough I think I can sometimes get it to go to the very start or end of the URL, but anything in between is hopeless. (Posting this partially in hopes that someone tells me how to do it to prove me…
Earlier quoted context omitted.
One thing that was quite annoying to me is the URL changing under my cursor on double-click if the protocol is hidden. However, I can see that editing the URL is a niche use case. Fair enough.
I hate that editing URLs is practically impossible in Chrome on iOS (not sure about Android or other iOS browsers). There seems to be no equivalent of arrow keys to navigate around inside the address bar. If I screeenmash enough I think I can sometimes get it to go to the very start or end of the URL, but anything in between is hopeless. (Posting this partially in hopes that someone tells me how to do it to prove me…
I use the Microsoft Swiftkey keyboard on Android, and there's a setting which makes holding the space button activate gestures for up/down/left/right. (i.e. hold space and move small amounts left/right.)
If you have enough screen space, I think you can add real arrow keys.
But I'm not sure you can change the keyboard on iOS.
Earlier quoted context omitted.
I can tell you from personal experience that they are in the process of going out of business. Traditional shared hosts got their lunch eaten starting almost a decade ago with a combination of site builders like Weebly on the user friendly side and AWS on the technical side. In 2013 most of my social group was friends I made in the shared hosting industry. Now I don't know a single person still working for any MSP as…
And for technical users who find AWS/GCP/Azure and friends too expensive for whatever reason, there's enough small bargain basement VPS providers around that still beat the prices of the shared hosting providers while providing way more flexibility. I run my personal blog using a mom-and-pop KVM VPS provider that costs $2 per month, and I get full control over whatever stack I want to run. Shared hosting is awful, I…
Actually, I've come to respect it as an offering because I don't need to patch security vulnerabilities.
I don't need to do backup, etc.
If/when I do eventually migrate to a VPS I'll be responsible for a LOT more.
I'm tempted to move to a PaaS or go serverless, but cost management with serverless is more complicated.
My dreamhost setup has been going fine for almost a decade by now. With minimal maintenance from me.
Earlier quoted context omitted.
I can tell you from personal experience that they are in the process of going out of business. Traditional shared hosts got their lunch eaten starting almost a decade ago with a combination of site builders like Weebly on the user friendly side and AWS on the technical side. In 2013 most of my social group was friends I made in the shared hosting industry. Now I don't know a single person still working for any MSP as…
And for technical users who find AWS/GCP/Azure and friends too expensive for whatever reason, there's enough small bargain basement VPS providers around that still beat the prices of the shared hosting providers while providing way more flexibility. I run my personal blog using a mom-and-pop KVM VPS provider that costs $2 per month, and I get full control over whatever stack I want to run. Shared hosting is awful, I…
Earlier quoted context omitted.
>HTTPS adoption is now very high[1] I posted this in a separate comment and I will post it again. https://certbot.eff.org/hosting_providers HTTPS adoption is hard enough that the wast majority of shared hosting providers haven't automated cert provisioning and are delegating this process to their users. The push towards forced HTTPS has significant costs, which most people in this filter bubble don't want to honestly…
Over 2/3rd of that list was last audited in 2019. A lot can change in 2 years.
Earlier quoted context omitted.
"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails." MITM is still an issue. At some point I hope browsers can switch to "you have to type http:// if you want HTTP", and this is a step in that direction. (Disclosure: I work for Google, speaking only for myself)
That is a stupid idea, forcing https on people’s throats is a stupid idea generally speaking but it wouldn’t have been that bad if it hadn’t been forced on many people by what is basically a monopoly by this point.
... and HTTPS on the public internet is a best practice. Your ISP should have no business sniffing your web traffic.
Earlier quoted context omitted.
No browser does what you are saying Safari has been doing this for at least two years. And I don't get what hardware age has got to do with anything? Not every browser gets upgraded to the latest HTTPS. There are millions of televisions, game consoles, older computers, and other devices that can only browse HTTP, or older versions of HTTPS. They will not be upgraded by their manufacturers. I don't think making those…
I just tried many http websites on Safari and am still not sure what you are talking about. They all work perfectly fine, without any warnings. > Not every browser gets upgraded to the latest HTTPS The solution to that isn't to compromise on security and privacy but rather make these devices upgradable/moddable.
Then I will thank Apple for changing things and making them less scary already.
The fact is that this is exactly how Safari used to handle things. I know because I got many angry screenshots from C-level people in my company when some of our web sites started showing up that way due to a misconfiguration by the IT department.
Here is a picture of a similar warning. This is for an SSL error, but the ones Safari used to display for HTTP were nearly identical:
https://www.digicert.com/dc/blog/safari-11-introduces-improv...