Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Camera and microphone require HTTPS in Firefox 68

blog.mozilla.org

Post reply on HN
Print view View original

191–200 of 215 posts

Re: Camera and microphone require HTTPS in Firefox 68

#191

Post by oefrha »

shkkmo wrote: post #152
mort96 wrote: post #118

Earlier quoted context omitted.

> This is clearly more complicated than ideal, but it should work. Exactly. Imagine you're someone who just wants to play around with cool web technologies. Maybe you're fairly new to web dev; maybe you're fairly new to the world of programming in general and you're using the web to learn it, which has historically been one of the huge strengths of the web. You suddenly encounter a brick wall, where you figure out th…

> Imagine you're someone who just wants to play around with cool web technologies. Maybe you're fairly new to web dev; Then... you can do it on localhost. I can't really image the new web dev that is using separate computer on their local network as a dev server but can't figure out how to get a Let's Encrypt cert to use.

False. Usually it’s just as easy if not easier to configure your dev server to listen on 0.0.0.0 instead of 127.0.0.1, and these days most sites are mobile first, so it’s very natural to develop on your computer and test on a phone in the same LAN. Figuring out accessing your computer via 192.168.0.x is way easier than figuring out how to issue a LE cert (the easy part) and use it on your dev server (the hard part).

Before you mention mobile device simulation in desktop browsers, I’ll point out that mobile browsers often have quirks that are not present in desktop browser simulations. For instance, mobile Safari is subtly different from desktop Safari responsive design mode in many ways, and the only way that I know to actually simulate mobile Safari is with full-blown Simulator.app.

Re: Camera and microphone require HTTPS in Firefox 68

#192

Post by acdha »

xg15 wrote: post #164
acdha wrote: post #131

Earlier quoted context omitted.

This feels pessimistic to me: most people didn’t learn the web that way, instead using shared servers — and there were plenty of similar complaints that it was too hard to learn Unix/Windows admin stuff, too. Today, you can use glitch, github pages, jsbin & a million friends, zeit, etc. or the same cheap Dreamhost account people used $20 years ago and start practicing with HTTPS and many other amenities at minimal co…

I find "it's ok if the platform becomes worse because there are so many third-party services you can use" not a compelling argument. (Not to mention, you need to get to know the services in the first place, while a browser is directly accessible to you)

How did the platform become worse when this is a new capability which didn’t used to be part of the platform? Similarly, while it’s true that you need to know services exist, that’s never been easier just as the documentation, available guides, and especially the developer tools have never been better for someone learning.

I’m not entirely in love with the needs driving this decision but I think it’s reasonable to make security and privacy decisions which benefit a billion people at the expense of making certain tasks slightly harder for a much smaller group.

Re: Camera and microphone require HTTPS in Firefox 68

#194

Post by k_bx »

baq wrote: post #178
k_bx wrote: post #176

Earlier quoted context omitted.

Is generating localhost certs and then accepting them in your browser once is that hard? openssl genrsa -out key.pem 2048 openssl req -new -key key.pem -out certificate.csr openssl x509 -req -in certificate.csr -signkey key.pem -out certificate.pem

if all development servers for all frameworks just did that on first run of a project it'd be so much easier.

I just stopped using languages that require a "framework" or "development server" with monster json/yaml configurations to run a web server. In Haskell, a change from http to https is switching from warp.run to warp-tls.runTLS function (with certificate paths set).

Re: Camera and microphone require HTTPS in Firefox 68

#195

Post by admax88q »

nothrabannosir wrote: post #168
admax88q wrote: post #139

Earlier quoted context omitted.

It's not a question of establishing an absolute scale of trust. It's about admitting that you consider npm packages to be insecure, but you run them in production anyways. Imagine you believed that steel had a 10% chance of spontaneous combustion, regardless of whether its true or not, if you believe that and you still built a bridge out of it, that's malpractice.

Point being where is the line? How high are the stakes (bridge: say 20 human lives at any time, very important). How dangerous is it really? (10% chance of fire per year: extremely high). Then you combine those two and see if they match. Everything has a limit. Otherwise why do you trust your compiler, your computer, your eyes, your sanity? Be careful with a word like malpractice, and analogies that suggest blithe en…

You continue to miss the point. Its not a question of _why_ I trust my compiler or my computer. If you trust npm packages and ship them then that's not malpractice.

Its about admitting you _don't_ trust npm packages, but you go ahead and use them anyways. That is malpractice, because you admit you know better but take action anyways.

"I know this procedure may do more harm than good, but I will perform it anyways because I'm too lazy to find an alternative"

That is textbook malpractice.

Re: Camera and microphone require HTTPS in Firefox 68

#196

Post by d33 »

anilakar wrote: post #193

Does anyone still remember the times when MSIE actually warned you if you were POSTing anything over an unencrypted connection?

Yes and it basically showed how it doesn't work. Applications were designed around the assumption that the user would click through the warnings. It looks like Firefox and Chromium are doing far better by restricting features to SSL, though I would be happier if they were also trying to push something more resistant to nation-state abuse...

Re: Camera and microphone require HTTPS in Firefox 68

#197

Post by heavenlyblue »

SlowRobotAhead wrote: post #147
heavenlyblue wrote: post #54

Earlier quoted context omitted.

Apple could simply make the camera take 1 second to activate.

Slow spool up embedded devices... we’re moving backwards :)

If Google Calendar thinks it’s OK to set a 500ms animation on opacity for event edit dialog - then it doesn’t seem like a 1 sec spooling for a webcam is too much :)

Re: Camera and microphone require HTTPS in Firefox 68

#198

Post by nothrabannosir »

admax88q wrote: post #195
nothrabannosir wrote: post #168

Earlier quoted context omitted.

Point being where is the line? How high are the stakes (bridge: say 20 human lives at any time, very important). How dangerous is it really? (10% chance of fire per year: extremely high). Then you combine those two and see if they match. Everything has a limit. Otherwise why do you trust your compiler, your computer, your eyes, your sanity? Be careful with a word like malpractice, and analogies that suggest blithe en…

You continue to miss the point. Its not a question of _why_ I trust my compiler or my computer. If you trust npm packages and ship them then that's not malpractice. Its about admitting you _don't_ trust npm packages, but you go ahead and use them anyways. That is malpractice, because you admit you know better but take action anyways. "I know this procedure may do more harm than good, but I will perform it anyways bec…

Trust? I don’t even trust my eyes.. :)

Though yes, if laziness is what makes it malpractice, then I’m the Jack Kevorkian of IT. I plead guilty.

Re: Camera and microphone require HTTPS in Firefox 68

#199

Post by packet_nerd »

asdfasgasdgasdg wrote: post #115
outworlder wrote: post #101

Earlier quoted context omitted.

Why would this be of little risk? The good thing about software is that it is automatable. That's also the bad thing. Create a malware (which due to some big company fuckups can be even embedded in a webpage these days). Capture frames indiscriminately. Add some image recognition algorithms (from OCR to machine learning, depending on what you want to do) to flag interesting hits. Voila. Massive dragnet. Applications…

I'm not saying I can't picture it. Just saying it doesn't seem likely to happen on a large scale basis.

I get what your saying, that the personal risk is low, especially compared with say driving or heart disease. Heck, I'm a middle aged heavy guy and couldn't care less who sees my nudes.

But, I believe we (as technologists) have a responsibility to use and push for strong security practices. I don't want my kids to grow up in a world where creeps blackmailing them through their webcams is a possibility, or where a rogue politician has all the tools of absolute authoritarianism already set up and waiting for him.

A camera cover is a huge win. It's super easy and cheap (a piece of plastic), it's easy to understand (entirely mechanical), it works 100% when used, and it's failure modes are obvious. Not all security controls are cheap, easy, and 100% effective, but this one is. And if you don't bother to use it in your bedroom, then that's fine, but every webcam should have one.

Re: Camera and microphone require HTTPS in Firefox 68

#200

Post by aaronharnly »

varenc wrote: post #23
petters wrote: post #2

It will still work on localhost, which is nice. It would be nice if it also worked on local IPs, like 192.168. . . Those do not work on Chrome, I think, which make mobile testing a bit more cumbersome.

For local development, Chrome has a flag that lets you force specific origins to be treated as secure: chrome://flags/#unsafely-treat-insecure-origin-as-secure I don't think Firefox has anything equivalent though? This bug on the topic is unassigned: https://bugzilla.mozilla.org/show_bug.cgi?id=1410365

Interesting! Though I find that behaves rather strangely – seems to clear itself on every launch.
Post reply on HN