Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Google overreaching by forcing me to use TLS?

security.stackexchange.com

Post reply on HN
Print view View original

31–37 of 37 posts

Re: Is Google overreaching by forcing me to use TLS?

#31

Post by dragonwriter »

backwoodshacker wrote: post #24
skywhopper wrote: post #6

I suppose it's nice to have the rationale written out somewhere, but does anyone anywhere actually balk at being required to use HTTPS?

I realise I'm going to be in the 0.1% minority on this, but yep, I do. Three reasons. First, I've been enough places where Internet connectivity is so poor that HTTPS effectively breaks the connection. I used to stay half the week somewhere where the only connectivity was a dire, over-saturated 3G link. I couldn't browse HTTPS sites unless I was very lucky. Second, I'm uneasy with the implication that "HTTPS=secure",…

> Third and related, the corollary of "HTTPS=secure" is that "sites that only use HTTP = insecure". This is leading to a requirement that any guy who builds a website with login functionality needs to implement HTTPS, and that saddens me.

HTTPS may not be secure, but HTTP (over the public internet, at least) is definitely insecure. If you have login functionality that matters, rather than serving as a very basic deterrent to accidentally getting somewhere you shouldn't be, yes, you need to use HTTPS.

Re: Is Google overreaching by forcing me to use TLS?

#32

Post by beached_whale »

dublinben wrote: post #7
finch_ wrote: post #5

I agree with the overall point of the responses that Google isn't in fact evil to be doing this, but I want to disagree somewhat with one point - the idea that Google doesn't have any obligation to respect users wishes just because its a free service that no one is forcing you to use. The problem with this is that Google's very existence makes it harder for similar services to exist. There are a few reasons for this,…

The argument has been made that Google's free products and services are anticompetitive dumping which makes it harder for a competing service to survive.

The same argument has been made against OSS. Google's products are free like broadcast TV. They are selling access to you via their services to marketers.

Re: Is Google overreaching by forcing me to use TLS?

#33

Post by sitkack »

backwoodshacker wrote: post #24
skywhopper wrote: post #6

I suppose it's nice to have the rationale written out somewhere, but does anyone anywhere actually balk at being required to use HTTPS?

I realise I'm going to be in the 0.1% minority on this, but yep, I do. Three reasons. First, I've been enough places where Internet connectivity is so poor that HTTPS effectively breaks the connection. I used to stay half the week somewhere where the only connectivity was a dire, over-saturated 3G link. I couldn't browse HTTPS sites unless I was very lucky. Second, I'm uneasy with the implication that "HTTPS=secure",…

If this is your situation, you have other technical problems that, yes 99.99% of the people do not have. Something like a UDP proxy with FEC and proxy side stripping of cruft and external requests. Downgrading from https -> http is only solving a portion of your problem.

Re: Is Google overreaching by forcing me to use TLS?

#34

Post by dm2 »

noblethrasher wrote: post #18
ephemeralgomi wrote: post #16

Earlier quoted context omitted.

My main objection to it is that since the OP is almost certainly going to accept their own answer before other people can post, there may be other, better answers that arrive late and don't get as much attention.

The moderation system largely mitigates that problem. Also, the SO/SE people have long maintained that Google is their homepage, and from this view it's easy to see why they would encourage people to answer their own questions: so that SO gets the googlejuice instead of some blog. On the other hand, to the degree that we believe that individual blogs are good, we absolutely should worry about auto-answering.

"Google is their homepage"

That's an interesting concept that I'd never even considered. I then realized that I couldn't even remember what the stackoverflow homepage looked like, yet I utilize that website daily.

It doesn't seem to be harming the stackoverflow and associated sites, so I guess it's not a bad thing.

Re: Is Google overreaching by forcing me to use TLS?

#35

Post by hga »

finch_ wrote: post #5

I agree with the overall point of the responses that Google isn't in fact evil to be doing this, but I want to disagree somewhat with one point - the idea that Google doesn't have any obligation to respect users wishes just because its a free service that no one is forcing you to use. The problem with this is that Google's very existence makes it harder for similar services to exist. There are a few reasons for this,…

"Its kind of like the argument for the minimum wage - conservatives would say its not needed because you can just choose not to work for a company that isn't offering enough money, but sometimes you don't really have an alternative."

Not a good analogy, because the full "conservative" (and libertarian) argument is that if you find yourself in such a situation, minimum wage laws produce a discontinuity in the labor market: if the current value of your labor is less than the minimum wage, you won't get a job at all.

Associate with this is the idea that it's better to have a job, any job ... the fate of the long term unemployed we're seeing right now as they lose general job skills is telling.

Completely related, if you're just starting out, and the value of your labor is not yet at the minimum wage, you never get into the job market in the first place. You never learn those implicit general jobs skills and discipline, like showing up to work on time. (OK, you just might find a place in the underground economy, but forcing people into that is very, very bad.)

It's the successful pulling up the ladder behind them ... something people like us rarely see (well, until we're 35-40 and unemployable for standard salaried programming positions). And therefore utterly evil.

Any way to bring this back to the general conversation?

First, the government does not have its thumbs on the scales: you will not go to jail for just trying to compete with Google,

And is it really that impossible to compete with Google in plenty of big places? Companies like Fastmail suggest it isn't (speaking from personal experience). That Duck Duck Go can even get some mind share is suggestive. What about Apple's mapping stuff?

There's also regression to the mean, which I sure see Google doing. I use them only for search and maps (punted Docs when they started going Google+ account name etc. crazy), and their search is steadily becoming less useful/harder to get what I want. I am a ringer in that I've been doing full text search stuff since the very early 90s, but....

So I suggest not making an entirely static analysis of this. Google today: hard to impossible ... to almost trivially easy (https://news.ycombinator.com/item?id=7467165). Google tomorrow? Probably better chances. Google in the next decade ... well, the way to bet is that at some point we'll be picking over its bones. Within my expected lifespan, at least.

Re: Is Google overreaching by forcing me to use TLS?

#36

Post by dredmorbius »

hga wrote: post #35
finch_ wrote: post #5

I agree with the overall point of the responses that Google isn't in fact evil to be doing this, but I want to disagree somewhat with one point - the idea that Google doesn't have any obligation to respect users wishes just because its a free service that no one is forcing you to use. The problem with this is that Google's very existence makes it harder for similar services to exist. There are a few reasons for this,…

" Its kind of like the argument for the minimum wage - conservatives would say its not needed because you can just choose not to work for a company that isn't offering enough money, but sometimes you don't really have an alternative. " Not a good analogy, because the full "conservative" (and libertarian) argument is that if you find yourself in such a situation, minimum wage laws produce a discontinuity in the labor…

And the conservative/libertarian argument fails, as Adam Smith notes in Wealth of Nations, because:

• The fully-realized cost of labor is that which allows it to survive and support its family, and educate its progeny. A business which cannot afford to pay a living wage is effectively demanding a societal subsidy. While there are circumstances in which that social welfare might be reasonably extended, it seems to me that it's a decision which should be made deliberately, and that companies which show recurring high levels of profit while being unwilling to pay a living wage are prima facie proof of a market failure.

• The inherent negotiating advantage of employers means that it will virtually always prevail in wage negotiations with labor.

• There's a common misperception that people are paid what they're worth to a company. This isn't the case. Rather: in a well-functioning and competitive market, your wage will always be less than you're worth. Much as a manufacturer's printer PPM rating is best interpreted as "performance never to be exceeded", your true worth to a company always sets an absolute ceiling on what your pay will be. Exceptions exist where markets are not well-functioning: e.g., in the case of excecutive pay, where there's a strong level of capture between execs and payment committees, and in which pay serves not only a compensation but a market signalling role as to the health and robustness of the firm (it's effectively a social signaling Veblen good).

For all of these reasons, defining a minimum wage at roughly the level of a living wage is strongly congruent with Adam Smith's principles. See Chapter X, Book I, Wealth of Nations.

Re: Is Google overreaching by forcing me to use TLS?

#37

Post by schrodinger »

pbreit wrote: post #26
schrodinger wrote: post #15

Earlier quoted context omitted.

You're encouraged to do that. I wonder why it seems to upset so many people? (I'm honestly curious, I'm not trying to be snarky)

Because the most obvious usage of such a feature is self-promotion.

Eh, it's win win though. Why shouldn't someone who shares some useful info get some self promotion out of it?
Post reply on HN