Earlier quoted context omitted.
This is exactly the https mode.
The difference is what happens if you type http manually.
Or click on an http:// link
Firefox 83 introduces HTTPS-Only Mode
431–440 of 525 posts
Re: Firefox 83 introduces HTTPS-Only Mode
#432Not every web service is easy to set up with HTTPS as a simple Let's Encrypt service. Take a game. It dynamically balances between servers rented and destroyed on the fly. It needs a wildcard DNS certificate. Then all the sub-servers need to have that wildcard certificate. In conclusion, deprecating HTTP makes it harder for people to get started on the web. How are you going to get certificates for IP address' contro…
>It needs a wildcard DNS certificate. Then all the sub-servers need to have that wildcard certificate. Just give each server a separate domain and certificate as you create them. The matchmaking algorithm returns a url pointing to the server. >How are you going to get certificates for IP address' control dashboard, after all? By clicking the damn button?
> Just give each server a separate domain and certificate as you create them. The matchmaking algorithm returns a url pointing to the server.
Do you mean a separate subdomain? (A separate domain would be very expensive.) I would need to figure out how to generate and provision certificates, in that case.
Re: Firefox 83 introduces HTTPS-Only Mode
#433Earlier quoted context omitted.
Cool, that makes you one of the people that's going to keep DoH turned off. What's the problem?
The internet of crap will also use DoH and bypass my network settings. Also, it is only a matter of time before ads (and websites) start using it to bypass browser DNS: https://github.com/byu-imaal/dohjs
Your concern about smart devices using DoH can be trivially avoided by not buying smart devices that use DoH, or even connect to the internet. Make sure that whatever you buy works with a local server such as Home Assistant and is actually under your own control. A system like this will be more reliable and customizable too.
Re: Firefox 83 introduces HTTPS-Only Mode
#434Where you see security, I see control. A way to commoditize the launch of ideas and information. Maybe 30 years from now, they will not prohibit any type of communication that is not properly licensed and standardized. As they do with commercial imports and exports. In Brazil today when you buy a product from another state of the federation, the tax goes partly to the origin of the product shipped and partly to the d…
How does that commoditize the launch of ideas and information?
When enabled, it forces a domain to be signed by a CA to be displayed. Effectively giving the CA a veto over the content.
Re: Firefox 83 introduces HTTPS-Only Mode
#435Earlier quoted context omitted.
How does that commoditize the launch of ideas and information?
When enabled, it forces a domain to be signed by a CA to be displayed. Effectively giving the CA a veto over the content.
I guess, but only in the way your power provider has veto over the content. The CA doesn't care about the content, only about you proving that you own the domain.
Re: Firefox 83 introduces HTTPS-Only Mode
#436Earlier quoted context omitted.
If you follow the DNS specs this will not a problem. If you use *.local for local domain names DoH will never be triggered From Mozilla documentation. "localhost" and names in the ".local" TLD will never be resolved via DOH. [1] Lan based services are pretty common use case. Mozilla is hardly going to release this feature without considering this. The Cloudflare / Archive.is point is esoteric debate and not a common…
> If you follow the DNS specs this will not a problem. If you use *.local for local domain names DoH will never be triggered I don't think PFsense + Unbound supports appending .local to every hostname automatically, so I'd have to change every last one of my hostnames to whatever.local and that seems like a real pain. (Surely most people are not using whatever.local in their /etc/hostname, right?) > The Cloudflare /…
Yes it does, you set it in System > General Setup: https://docs.netgate.com/pfsense/en/latest/config/general.ht...
Then it will automatically register them in DNS with that name: https://docs.netgate.com/pfsense/en/latest/services/dns/reso...
> The domain name from System > General Setup is used as the domain name on the hosts.
Then in the DHCP configuration, you set the domain name as well (defaults to using the general setting): https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv...
> Specifies the domain name passed to the client to form its fully qualified hostname. If the Domain Name is left blank, then the domain name of the firewall it sent to the client.
The client will automatically try adding the domain when looking up hostnames. Normally on Linux the FQDN is not specified in /etc/hostname but only in /etc/hosts.
Re: Firefox 83 introduces HTTPS-Only Mode
#437Earlier quoted context omitted.
I don't understand your problem. Nginx should proxy all connections including websocket ones. Just don't expose your application server and use nginx as a reverse proxy.
I don't understand my problem either - if I did it wouldn't be a problem! I'm not here fishing for tech support, but this is a real thing I'm encountering and I don't know that expressing disbelief feels productive? The point I'm trying to express is that giving a cert to your webserver is often only the first step in a relatively complicated process of securing all you assets. I wish browser makers would ask about b…
It could be because Host header supplied by nginx to your appserver by default will be something like 127.0.0.1 instead of yourwebsite.com.
Re: Firefox 83 introduces HTTPS-Only Mode
#438Earlier quoted context omitted.
When enabled, it forces a domain to be signed by a CA to be displayed. Effectively giving the CA a veto over the content.
I guess, but only in the way your power provider has veto over the content. The CA doesn't care about the content, only about you proving that you own the domain.
Like CAs, the power company can be controlled by the government.
Let's say governments ban youtube-dl. The prosecution gets a court order to order CAs to not renew youtube-dl.org. If they're using a Let's Encrypt style 30 day certificate, youtube-dl has 30 days to comply or be soft-banned from the internet.
Re: Firefox 83 introduces HTTPS-Only Mode
#439Earlier quoted context omitted.
I guess, but only in the way your power provider has veto over the content. The CA doesn't care about the content, only about you proving that you own the domain.
Like CAs, the power company can be controlled by the government. Let's say governments ban youtube-dl. The prosecution gets a court order to order CAs to not renew youtube-dl.org. If they're using a Let's Encrypt style 30 day certificate, youtube-dl has 30 days to comply or be soft-banned from the internet.
Why go to the CA when they can just order the domain itself to be shut down? If there's a court order against you, your site being HTTP won't save you.
Re: Firefox 83 introduces HTTPS-Only Mode
#440Earlier quoted context omitted.
Voting should be mandatory but the first listed option for every office should be "I approve of no candidate and think none of them should win" (the disaffected vote), and the second listed option should be "I approve of every candidate and don't care who wins" (the apathetic vote). With our current system it's impossible to tease out how many voters are disaffected vs apathetic vs simply disenfranchised (in the abov…
Technically those options are trivial with a non-defective system like approval voting, but assuming you're stuck with first-past-the-post, that's pretty much correct.
Not quite, even with normal approval voting there's no way to distinguish between voters who want to say "all these options are undesirable and everything is broken" and those who want to say "life is good, I'm cool with whoever" and those whose votes get lost or obstructed. The reason why the notion of a "protest vote" is so pointless under our current system is specifically due to the indistinguishability of the first from the latter ("people didn't stay home because they didn't like the candidates, they stayed home because they're so content!"). Additionally without mandatory voting it's difficult to determine where and how voter disenfranchisement is happening, but at the same time it would be unethical to force someone to cast a vote without giving them the option to voice discontent with the options.