Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removing Old Versions of TLS

blog.mozilla.org

Post reply on HN
Print view View original

81–90 of 94 posts

Re: Removing Old Versions of TLS

#81

Post by TheCoelacanth »

amoshi wrote: post #7
JoshTriplett wrote: post #4

Most of the pushback here isn't going to be on the web. It's going to be in corporate systems and proxies that haven't upgraded, and reject anything they don't understand. For instance, some corporate proxies will parse TLS and drop connections they don't understand. Theoretically, they do this to combat things like Heartbleed; in practice, they do it because the same tools will (with the flip of a switch) do termina…

There are still some essential government, military and corporate websites relying on these protocols that will not be updated any time soon - it should always be possible for a user to override this block. I really dislike this "browser smarter than the user" design.

If you can afford to spend $1 trillion on a fighter plane that is marginally better than the previous ones that you already had, you can afford to spend $100k on basic network security.

Re: Removing Old Versions of TLS

#83

Post by gdfasfklshg4 »

Klathmon wrote: post #75
gdfasfklshg4 wrote: post #73

Earlier quoted context omitted.

Why do need the user's current timezone? You say calender events. Do you really want to mess with their calender based on the latest timezone their computer reported? What if they access your site whilst on a weekend trip? Do you really want to then shift all their appointments for the next week around? I've seen people miss out on jobs because overeager software changed the interview event's timezone... As a general…

And this again is the core of the issue. In the instance I'm talking about, the app was about reminders for taking medications. Having those go off at 3am local time because you flew to Hawaii for a week doesn't do you any good. Not to mention that the app tracked and helped tune dosages and timing, and needed information like when you woke up, time of day for you, the kind if medication, and a lot more. Again, you a…

Hm this does actually sound like a usecase for using timezone info.

However. I don't think that content blockers are third parties. They are part of the user agent. The choice to use a blacklist is up to the user. It is not a third party breaking your app. It is the user themselves.

Re: Removing Old Versions of TLS

#84

Post by gorhill »

Klathmon wrote: post #58
r3bl wrote: post #55

Earlier quoted context omitted.

I find it ridiculous that an adblocker blocks access to even first party analytics. /piwik.php is found on EasyPrivacy list, which is one of the default uBlock Origin filter lists. I really didn't expect my adblocker to do that when I installed it.

I'm always surprised people are willing to give random developers that much control over their browser when installing extensions like that. I've had so many things break because someone somewhere didn't think a request was valid enough and blocked it and it was put into a common blocklist. WebRTC, several fonts, first party analytics, even whole services like Google shopping were blocked entirely because "they are a…

> I'm always surprised people are willing to give random developers that much control over their browser

I will say this is why people install content blockers, to avoid giving control to random developers behind countless websites, which have shown that there is no limit in the amount of data they will try to gather without a hint of informed consent.

On the other hand, content blockers are opt-in and people are free to install or not after reading the description/documentation and further researching them.

Re: Removing Old Versions of TLS

#85

Post by Klathmon »

gdfasfklshg4 wrote: post #83
Klathmon wrote: post #75

Earlier quoted context omitted.

And this again is the core of the issue. In the instance I'm talking about, the app was about reminders for taking medications. Having those go off at 3am local time because you flew to Hawaii for a week doesn't do you any good. Not to mention that the app tracked and helped tune dosages and timing, and needed information like when you woke up, time of day for you, the kind if medication, and a lot more. Again, you a…

Hm this does actually sound like a usecase for using timezone info. However. I don't think that content blockers are third parties. They are part of the user agent. The choice to use a blacklist is up to the user. It is not a third party breaking your app. It is the user themselves.

But it's the user using a tool to do one thing (block ads) which someone has taken to an extreme (block all requests which could potentially be used for tracking, and treats different players differently depending on sentiment in a lot of cases).

To use a more controversial phrase, the "blocklist" groups are now a cartel which gets to decide which apps work and which don't, and you have no way of appealing or even reasoning with them in a lot of cases. They get to decide that the Amazon cookie is okay, but a Google font is not, that login-with-facebook isn't allowed, but login-with-twitter is okay. That my app which uses timezone information was crossing a line, but my competitor wasn't.

I'm more than happy to help work with those who want to protect their privacy. I genuinely agree with a lot of viewpoints and I work to protect my own privacy as well, but at some point things go too far and I feel a lot of these tools are throwing the baby out with the bathwater here, and are even causing a false sense of security as people think they are protected from everything when really they are hurting the good actors the worst while the bad actors continue to operate just fine.

Re: Removing Old Versions of TLS

#86

Post by sdeziel »

petecooper wrote: post #8

If you want Nginx to use TLS v1.2, this is what you need: ssl_protocols TLSv1.2; …and if you compile a recent Nginx from source and bake in OpenSSL 1.1.1 while you do that, you can have TLS v1.3 with a TLS v1.2 fallback, too: ssl_protocols TLSv1.3 TLSv1.2; See also: https://caniuse.com/#feat=tls1-2 https://caniuse.com/#feat=tls1-3

https://caniuse.com itself only supports TLS 1.0. They know about it https://github.com/Fyrd/caniuse/issues/4198

Re: Removing Old Versions of TLS

#87

Post by CorpusCalcium »

jeroenhd wrote: post #70
CorpusCalcium wrote: post #38

Earlier quoted context omitted.

Assuming that device is actually worth accessing, then you could still keep and use an old version of a browser for that purpose. Newer browser versions should be pushing the web forward where possible.

I agree with you in the case of old encryption methods (plain DES, RC4, NULL cipher) but not all protocol problems are because of the lack of a recent encryption algorithm. There's heaps of old modems that use a weak DH key and will never see a firmware update. You're left with either accessing the device insecurely over HTTP, hoping your ISP will send you a new one (good luck with that) or paying for your own modem…

Those modems should no longer be being used, period. If someone cannot afford a replacement and has an incompetent ISP incapable of providing them with a subsidized replacement, then that is a separate problem that needs addressing as soon as possible.

Perpetuating it won't do, and if in doing so we're perpetuating a larger impending security issue, then we need to resolve it stat, not defer everything because there is heaps of old hardware lying around.

That may be easy to say and harder to resolve, but there comes a time when problems need to be resolved. Maybe that won't be 2020, if the desired timeline proves unrealistic, but two years is plenty of time to move on it. It generally takes far longer to deprecate and remove protocols from the web than it does to get a replacement modem.

Re: Removing Old Versions of TLS

#88

Post by mcny »

gorhill wrote: post #84
Klathmon wrote: post #58

Earlier quoted context omitted.

I'm always surprised people are willing to give random developers that much control over their browser when installing extensions like that. I've had so many things break because someone somewhere didn't think a request was valid enough and blocked it and it was put into a common blocklist. WebRTC, several fonts, first party analytics, even whole services like Google shopping were blocked entirely because "they are a…

> I'm always surprised people are willing to give random developers that much control over their browser I will say this is why people install content blockers, to avoid giving control to random developers behind countless websites, which have shown that there is no limit in the amount of data they will try to gather without a hint of informed consent. On the other hand, content blockers are opt-in and people are fre…

This discussion got bigger than I expected. I just want to take a moment to thank you not just for your hard work but the trust you have brought in uBlock Origin. From the bottom of my heart, thank you.

Re: Removing Old Versions of TLS

#89

Post by FridgeSeal »

Klathmon wrote: post #85
gdfasfklshg4 wrote: post #83

Earlier quoted context omitted.

Hm this does actually sound like a usecase for using timezone info. However. I don't think that content blockers are third parties. They are part of the user agent. The choice to use a blacklist is up to the user. It is not a third party breaking your app. It is the user themselves.

But it's the user using a tool to do one thing (block ads) which someone has taken to an extreme (block all requests which could potentially be used for tracking, and treats different players differently depending on sentiment in a lot of cases). To use a more controversial phrase, the "blocklist" groups are now a cartel which gets to decide which apps work and which don't, and you have no way of appealing or even re…

> To use a more controversial phrase, the "blocklist" groups are now a cartel which gets to decide which apps work and which don't, and you have no way of appealing or even reasoning with them

As I’m one of these people who aggressively controls what I let my web browser load maybe I can answer some of your questions.

Facebook, Twitter, Google Analytics and tag manager are blocked outright, all the time.

If your site needs several different CDN’s to load it’s assets, for seemingly no reason then I generally leave; unless I need something from that particular page, in which case I give it about 2 or 3 goes of playing “which CDN serves the information I actually care about?”.

Any domain you use that isn’t obviously yours or a CDN or obviously related to what’s on the page (web stores get to load shoplift for example) is blocked because assume it’s just another advertising/analytics company.

Sites that load the DOM and contents into memory, but display a blank page until I unblock a bunch of JS are my pet peeve, and I make a note to never return to them.

> I feel a lot of these tools are throwing the baby out with the bathwater here

The carté Blanche approache is used because it’s faster and easier for me to find the minimal set of domains and resources to load than it is to get every website out there to not stuff their site full of trackers and unnecessary JS.

Re: Removing Old Versions of TLS

#90

Post by Klathmon »

gorhill wrote: post #84
Klathmon wrote: post #58

Earlier quoted context omitted.

I'm always surprised people are willing to give random developers that much control over their browser when installing extensions like that. I've had so many things break because someone somewhere didn't think a request was valid enough and blocked it and it was put into a common blocklist. WebRTC, several fonts, first party analytics, even whole services like Google shopping were blocked entirely because "they are a…

> I'm always surprised people are willing to give random developers that much control over their browser I will say this is why people install content blockers, to avoid giving control to random developers behind countless websites, which have shown that there is no limit in the amount of data they will try to gather without a hint of informed consent. On the other hand, content blockers are opt-in and people are fre…

I get that, and I fully support that choice, and I agree with that feeling.

But it's the lack of choice in terms of what is blocked, and the limited ability to understand that it's the content blocker that is potentially breaking the application which is what i'm lamenting here.

I can't overstate how much I want to respect the user if they don't want some aspects, or some features, or anything which they just don't like, or which they feel can impact their privacy. (I'll argue with you about the ethics of blocking ads but still using a service, but that's another point entirely!)

My issue is that there is a group of people that are deciding what things are allowed and which aren't, and they are going to necessarily have to make tradeoffs (I don't think that all of amazon.com should be blocked because they can track your purchase history by virtue of handling your purchase!). But for the most part the trade offs made are opaque to the user and site owner, and the UX is lacking in showing the user that the content blocker can be the cause of the problem, not to mention that by default these lists are very powerful tools able to pretty quickly harm good actors (and this isn't something i'm single-ing out content blockers for, antivirus vendors, ISPs (AKA net neutrality), and even social networks all have this issue to some extent).

There might not be a good answer, and I sure as hell don't pretend to have it, but I'm just wishing for a way that users can make informed decisions on what they want to block, rather than have someone decide for them. Without some kind of give and take here, the arms race is just going to continue, and as it escalates, good actors (of which I'd like to think i'm one of) will get increasingly pushed away as they are blocked just the same as bad actors, leaving them with the options of "play dirty and survive" or "die peacefully".

I'm sad to say that I ended up taking a page out of the "play dirty" book and got a new domain name for the app in question to get around the content blockers, but I'd do it again in a heartbeat since I'm not abusing that information or power, but I'm blocked as if I am. And while I feel dirty that I'm forcing my wants onto others, the ratio of "unwilling participants" to "those who actually wanted to use my app, but not one it's core features" is so unbalanced that I ended up ignoring the latter to save the former. And while I wish I could respect the wants of the latter group, if I engage there the former will have the content blocked for them as well again, and I'll be right back to square 1.

Post reply on HN