Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removing Old Versions of TLS

blog.mozilla.org

Post reply on HN
Print view View original

71–80 of 94 posts

Re: Removing Old Versions of TLS

#71

Post by Klathmon »

pjc50 wrote: post #67
Klathmon wrote: post #58

Earlier quoted context omitted.

I'm always surprised people are willing to give random developers that much control over their browser when installing extensions like that. I've had so many things break because someone somewhere didn't think a request was valid enough and blocked it and it was put into a common blocklist. WebRTC, several fonts, first party analytics, even whole services like Google shopping were blocked entirely because "they are a…

If you take all those pieces of information together you're very close to uniquely identifying the user, in a way which could be correlated with similar analytics from other websites if and when your analytics data is leaked or sold. Sometimes people really mean it when they say they don't want to be tracked: they want to leave no footprint at all. Sometimes people just want the website to load as fast as possible by…

>But don't forget the good old HTTP access logs, which give you all this information anyway without having to load extra scripts.

But that's my point, whole domains have been added to EasyList under these rules that break the entire application because the person who added it assumed it was tracking related and not part of the application. People see xhr requests which save the current timezone so the server can update calendar notifications at the right time as "tracking" and break the application entirely because of it. They see a request they don't understand and block it because "it includes the useragent".

Take Google shopping for instance, an entire service shut off because "it's tracking", while Amazon or eBay or any other online shopping service isn't blocked.

If you really want that blocked, I'm more than happy to not serve you! I don't want to track you if you feel that using your timezone is over the line! But when your feelings toward that are pushed to who knows how many computers and now my site is broken for a large number of users, who are now contacting me to fix it, it becomes a problem.

To use an analogy, I don't have any issue with people that are allergic to peanuts. I don't want to try and force feed you peanuts, I want to make sure everyone knows I serve peanuts, and I want to give you the option of not eating at my establishment if you are allergic or simply don't like peanuts.

But if you start removing my establishment from maps, and start putting road blocks in front of my building preventing others from getting in, now it's overstepped a boundary.

I don't pretend to have a good answer, this isn't an easy problem to solve, but giving a handful of devs a "break this website for all adblocker users" button seems like a lot of power, and it especially hurts those who are trying to accommodate you.

If I didn't care, I'd just work around it, use server logs and send them to 3rd parties, lie and actively route around your attempts to block. And I'd not only make more money, but have to deal with less issues from users...

My hope is that the devs that believe these things can give more options to the user to decide for themselves and make informed decisions about the tradeoffs, rather than saying "this is bad, I blocked it for you".

Re: Removing Old Versions of TLS

#72

Post by jeroenhd »

JoshTriplett wrote: post #4

Most of the pushback here isn't going to be on the web. It's going to be in corporate systems and proxies that haven't upgraded, and reject anything they don't understand. For instance, some corporate proxies will parse TLS and drop connections they don't understand. Theoretically, they do this to combat things like Heartbleed; in practice, they do it because the same tools will (with the flip of a switch) do termina…

Honestly, I don't know why corporate systems just plain reject standard HTTP(S) traffic and require browsers to configure a corporate proxy which signs connections with their own internal certificate authority. Transparent MitM is such a hassle and in a corporate environment you should control the client devices anyway. As an added bonus you can choose which protocols you will or will not support on the external side, protecting your ancient Windows XP boxes from SSL2 downgrades and allowing them to contact modern websites their SSL libraries might not support.

Re: Removing Old Versions of TLS

#73

Post by gdfasfklshg4 »

Klathmon wrote: post #71
pjc50 wrote: post #67

Earlier quoted context omitted.

If you take all those pieces of information together you're very close to uniquely identifying the user, in a way which could be correlated with similar analytics from other websites if and when your analytics data is leaked or sold. Sometimes people really mean it when they say they don't want to be tracked: they want to leave no footprint at all. Sometimes people just want the website to load as fast as possible by…

>But don't forget the good old HTTP access logs, which give you all this information anyway without having to load extra scripts. But that's my point, whole domains have been added to EasyList under these rules that break the entire application because the person who added it assumed it was tracking related and not part of the application. People see xhr requests which save the current timezone so the server can upda…

Why do need the user's current timezone? You say calender events. Do you really want to mess with their calender based on the latest timezone their computer reported? What if they access your site whilst on a weekend trip? Do you really want to then shift all their appointments for the next week around? I've seen people miss out on jobs because overeager software changed the interview event's timezone... As a general practice don't fiddle with peoples' data without them knowing.

Re: Removing Old Versions of TLS

#74

Post by Thiez »

joosters wrote: post #56
r3bl wrote: post #55

Earlier quoted context omitted.

I find it ridiculous that an adblocker blocks access to even first party analytics. /piwik.php is found on EasyPrivacy list, which is one of the default uBlock Origin filter lists. I really didn't expect my adblocker to do that when I installed it.

I find it ridiculous that first party analytics requires extra requests at all - there's enough log information from my actual page requests, you don't need to make extra ones. If your logging is so inefficient, it should be blocked.

It can make sense if they would like to know things such as how long the page load took. That is not something you can measure by only looking at the request logs, especially if the page uses a lot of javascript.

Re: Removing Old Versions of TLS

#75

Post by Klathmon »

gdfasfklshg4 wrote: post #73
Klathmon wrote: post #71

Earlier quoted context omitted.

>But don't forget the good old HTTP access logs, which give you all this information anyway without having to load extra scripts. But that's my point, whole domains have been added to EasyList under these rules that break the entire application because the person who added it assumed it was tracking related and not part of the application. People see xhr requests which save the current timezone so the server can upda…

Why do need the user's current timezone? You say calender events. Do you really want to mess with their calender based on the latest timezone their computer reported? What if they access your site whilst on a weekend trip? Do you really want to then shift all their appointments for the next week around? I've seen people miss out on jobs because overeager software changed the interview event's timezone... As a general…

And this again is the core of the issue.

In the instance I'm talking about, the app was about reminders for taking medications. Having those go off at 3am local time because you flew to Hawaii for a week doesn't do you any good. Not to mention that the app tracked and helped tune dosages and timing, and needed information like when you woke up, time of day for you, the kind if medication, and a lot more.

Again, you are free to not give it, but that was a core point of the application, and trying to disable or break the application in the name of privacy is like cementing your door shut to prevent breakins.

Users aren't "tricked" into having timezone information used to track them, they aren't frusturated with the timezone tracking feature, and the app was paid and had a privacy policy in place that prevented me from selling or using any of the information for advertising. And if users become frusturated with the feature, I can as the developer fix it for them. You cannot, and blocking requests that you don't understand in an app you don't use is exactly what caused all the headache in the first place. And when I went to try and get it unlocked I was met with similar hostility, and told in so many words "too bad".

You don't always know better than the user, and you don't always know better than the developer.

In the end, I switched domains, and since then have managed to fly under the adblocker radar. I'm no longer involved with it, so I don't know if they managed another solution without me.

Re: Removing Old Versions of TLS

#76

Post by pjc50 »

Klathmon wrote: post #71
pjc50 wrote: post #67

Earlier quoted context omitted.

If you take all those pieces of information together you're very close to uniquely identifying the user, in a way which could be correlated with similar analytics from other websites if and when your analytics data is leaked or sold. Sometimes people really mean it when they say they don't want to be tracked: they want to leave no footprint at all. Sometimes people just want the website to load as fast as possible by…

>But don't forget the good old HTTP access logs, which give you all this information anyway without having to load extra scripts. But that's my point, whole domains have been added to EasyList under these rules that break the entire application because the person who added it assumed it was tracking related and not part of the application. People see xhr requests which save the current timezone so the server can upda…

Fundamentally it's a bit of a prisoner's dilemma situation, but with three actors. The relationship between website developers and adblock developers is necessarily adversarial - adblockers only exist because users disagree with the developers how the website should appear.

> start putting road blocks in front of my building preventing others from getting in

It's more like you've erected a billboard, and the Campaign Against Ugly Billboards have given some people AR glasses which edit out the billboard .. and a bit more of your storefront. It's not really in the same category as fraudulent Yelp reviews.

> If you really want that blocked, I'm more than happy to not serve you!

I think you'd be better off just accepting this. The user and their user-agent has a "right" to display a website how they want, including in ways that the developer didn't think of - and including ways that are broken. The user can break your site if they want. I appreciate that this causes problems when they've not realised that it's their choices that break it, or put in annoying requests ("why doesn't this site work in Lynx"). But fundamentally they're customers, customers are always annoying. Given your context of a paid app it sounds like it's worth asking them to disable the adblocker pre-emptively, but presumably you've tried that already and they haven't.

> Take Google shopping for instance, an entire service shut off because "it's tracking", while Amazon or eBay or any other online shopping service isn't blocked

ublock Origin blocks bits of Amazon within the website - the internal sponsored advertising. I only noticed when some of it flashed up and then vanished.

Re: Removing Old Versions of TLS

#77

Post by mathw »

Ajedi32 wrote: post #41
kccqzy wrote: post #36

Apple is doing the same: https://webkit.org/blog/8462/deprecation-of-legacy-tls-1-0-a...

And Chrome: https://security.googleblog.com/2018/10/modernizing-transpor... And Edge: https://blogs.windows.com/msedgedev/2018/10/15/modernizing-t... Seems like this was coordinated.

Chrome's seems to be the only announcement that doesn't mention it's coordinated with the other major browser vendors.

Dominant position talking :(

Re: Removing Old Versions of TLS

#78

Post by Klathmon »

pjc50 wrote: post #76
Klathmon wrote: post #71

Earlier quoted context omitted.

>But don't forget the good old HTTP access logs, which give you all this information anyway without having to load extra scripts. But that's my point, whole domains have been added to EasyList under these rules that break the entire application because the person who added it assumed it was tracking related and not part of the application. People see xhr requests which save the current timezone so the server can upda…

Fundamentally it's a bit of a prisoner's dilemma situation, but with three actors. The relationship between website developers and adblock developers is necessarily adversarial - adblockers only exist because users disagree with the developers how the website should appear. > start putting road blocks in front of my building preventing others from getting in It's more like you've erected a billboard, and the Campaign…

>It's more like you've erected a billboard, and the Campaign Against Ugly Billboards have given some people AR glasses which edit out the billboard .. and a bit more of your storefront. It's not really in the same category as fraudulent Yelp reviews.

But your analogy misses a key aspect which is that the adblocker breaks the app entirely. It's not like just hiding my storefront, it's preventing users from entering the store at all unless they completely disable the device. Often those same users don't realize that these blocklist update silently in the background and it's their adblocker that is breaking the application that they have been using every day for years.

> I think you'd be better off just accepting this.

I think I worded that poorly. I do accept this. If you don't want to use an aspect, or want to render something your own way, I'm happy to let you! But I'm not happy when you start imposing those restrictions on others who don't know it's happening and don't know why core aspects of the app aren't working.

Informed decisions are good, blanket disabling or breaking applications because a developer "knows better" isn't.

Useragent issues I can work around, bugs can be fixed, and those who don't want that part of the app to work are happy. But I can't work around an adblocker blocking things for users that don't want then blocked. If I work around it I'm then "tracking" those who are attempting to block it (and IMO should be called out for it), and if I do nothing I lose users and paying customers who will move to competitors which for some reason are not blocked. (And I don't blame them, my app doesn't work, so why would you stick with it?)

> ublock Origin blocks bits of Amazon within the website

But back a year or so ago, it blocked the entire google.com/shopping URL, and the shopping.google.com subdomain (I haven't checked if it still does).

The entire service blocked because someone somewhere decided it wasn't worth it, but Amazon and eBay and AliExpress all only have some elements blocked because it's somehow different.

And while you can go in and re-enable those parts, it takes a long time and a good amount of technical know how of things like globbing and regex to whitelist it correctly. And then must be repeated on every device you use.

Re: Removing Old Versions of TLS

#79

Post by jake_the_third »

dagenix wrote: post #44
jake_the_third wrote: post #42

Earlier quoted context omitted.

That's why it should be disabled by default but also be overridable. Those users would have to mess with browser flags to re-enable older versions. And if a user is willing to mess with advanced browser settings without understanding them, there are far worse security settings to mess with than outdated tls protocols. Users MUST have ultimate control over software and not the other way around; even if it such control…

> Software deliberately designed to go against the wishes of its users is defective, malicious, or both. I think its quite a stretch to say that Mozilla choosing not to support a technology makes their product "defective" or "malicious". They get to choose what they support. They beauty of open source software, is that if someone disagrees with that decision, they are free to support it themselves. That is unlikely t…

I understand the point you're making, but I still stand by my opinion. Software that goes out of its way to subvert the wishes of the user is defective, malicious, or both.

Re: Removing Old Versions of TLS

#80

Post by bradleyjg »

pjc50 wrote: post #76
Klathmon wrote: post #71

Earlier quoted context omitted.

>But don't forget the good old HTTP access logs, which give you all this information anyway without having to load extra scripts. But that's my point, whole domains have been added to EasyList under these rules that break the entire application because the person who added it assumed it was tracking related and not part of the application. People see xhr requests which save the current timezone so the server can upda…

Fundamentally it's a bit of a prisoner's dilemma situation, but with three actors. The relationship between website developers and adblock developers is necessarily adversarial - adblockers only exist because users disagree with the developers how the website should appear. > start putting road blocks in front of my building preventing others from getting in It's more like you've erected a billboard, and the Campaign…

“I think you'd be better off just accepting this. The user and their user-agent has a "right" to display a website how they want, including in ways that the developer didn't think of - and including ways that are broken. The user can break your site if they want. I appreciate that this causes problems when they've not realised that it's their choices that break it, or put in annoying requests ("why doesn't this site work in Lynx"). But fundamentally they're customers, customers are always annoying.”

It’s something at least akin to unethical to deliberately break something I’ve built and then come complain to me that it’s broken.

And sure, they might be would-be customers, but not all would-be customers are worth serving.

Just as customers have the right to buy from whoever they like so to do seller have the right to sell to whoever they like (barring certain narrow exceptions like racial discrimination.)

It’s always the negative value customers that throw the biggest tantrums when they are told a business would rather not serve them. Or in the case of ad block users, not even customers just people that want something for nothing.

Post reply on HN