Blink - Intent to deprecate: Insecure usage of powerful features
groups.google.com
Blink - Intent to deprecate: Insecure usage of powerful features
1–10 of 96 posts
Re: Blink - Intent to deprecate: Insecure usage of powerful features
#2Once Let's Ecrypt [0] launches, I suppose most web developers won't have any more excuses not to use HTTPS. It'll be free, pretty easy and quick time wise, plus it'll give you an SEO boost.
Browser vendors are certainly doing the right thing by making http be marked as non-secure, and not implementing unencrypted http/2 and not allowing non-HTTPS access to powerful api are completely reasonable steps to take.
Re: Blink - Intent to deprecate: Insecure usage of powerful features
#3Basically they are destroying the simplicity of the internet in order to push their own agenda. I'd get annoyed about it, but it's not going to be long before it all collapses under it's own weight and something new and lightweight turns up to take over from what http used to be good for.
Re: Blink - Intent to deprecate: Insecure usage of powerful features
#4I wonder how many "internet of things" things will stop working due to these changes.
Re: Blink - Intent to deprecate: Insecure usage of powerful features
#5I wonder how many "internet of things" things will stop working due to these changes.
Aren't IOT typically servers not clients?
I can't imagine their pages require access to powerful APIs.
Re: Blink - Intent to deprecate: Insecure usage of powerful features
#6Basically they are destroying the simplicity of the internet in order to push their own agenda. I'd get annoyed about it, but it's not going to be long before it all collapses under it's own weight and something new and lightweight turns up to take over from what http used to be good for.
Did you even look at the kinds of attacks that motivate these restrictions before concluding that there was a nefarious agenda at work?
I took a look at a Fullscreen API attack ( http://feross.org/html5-fullscreen-api-attack/ ) and found it pretty creepy even though I knew exactly what to expect and what to look for. Tighter controls over that sort of thing seem like a great idea to me.
Re: Blink - Intent to deprecate: Insecure usage of powerful features
#7Basically they are destroying the simplicity of the internet in order to push their own agenda. I'd get annoyed about it, but it's not going to be long before it all collapses under it's own weight and something new and lightweight turns up to take over from what http used to be good for.
I don't understand your criticism. They are requiring HTTPS to use complex/advanced features. You're still free to serve your handwritten HTML 4.0 over unencrypted HTTP 1.1.
What simplicity is being destroyed here? If anything, they're making it more costly to make complex websites.
Re: Blink - Intent to deprecate: Insecure usage of powerful features
#8Once Let's Ecrypt [0] launches, I suppose most web developers won't have any more excuses not to use HTTPS. It'll be free, pretty easy and quick time wise, plus it'll give you an SEO boost. Browser vendors are certainly doing the right thing by making http be marked as non-secure, and not implementing unencrypted http/2 and not allowing non-HTTPS access to powerful api are completely reasonable steps to take. [0] htt…
If everybody gets an SEO boost, there is no boost. :)
Re: Blink - Intent to deprecate: Insecure usage of powerful features
#9Though only tangentially related I do wish EME had been properly shot in the head.
It's just another Flash that hides behind being "html5" (as if they makes it all ok). At the end of the day it's proprietary code executing on my machine that I have little or no control over. It's not just a security risk, it's also a stability concern and generally a terrible idea.
Copyright enforcement should be left to law, content companies shouldn't be trying their hand at it. Who knows, maybe if their content didn't come wrapped in utter crap people might actually part with money for it.
Re: Blink - Intent to deprecate: Insecure usage of powerful features
#10Bizarre. HTTPS isn't a guarantee that a site is not malicious. Its not like I could go to a CA and ask them who they signed that cert for and take on any kind of legal responsiveness. Such is the state of the CA system that they will give a cert to anyone with access to a domains MX and some bitcoins.
Instead of this, maybe require there's a user mouse event on the call stack for things like fullscreen.