Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Firefox is moving in that direction. Maybe by 2020 you'll have to click a lot of prompts to see an "insecure" site.


Classic slippery slope argument.

When abortion was legalized, some people argued that we'd be murdering children soon. Has that happened?

If something is moving in the right direction, but if you're worried that it will go too far, the solution is to get involved and stop it at the right time, not to spread FUD about the hypothetical doom of the world.


> Firefox ain't one of them. Last time I checked, their plan was to reserve some of the more dangerous features (such as access to the camera) for secure websites. Hardly a plan to drop support for plaintext HTTP.

So basically, by your own admission, you say that websites with a near-future version of Firefox will only be able to offer a "full" web-experience if they are offered via HTTPS.

HTTP-based websites will be reserved for an inferior web.

> Classic slippery slope argument.

But somehow saying that this is moving in a HTTPS-only direction is a slippery slope argument? How long until Javacript is only allowed via HTTPS? How long until video and media-APIs will only work with a "secure" DRMed connection, signed by the MPAA?

Taking HTTPS everywhere and removing support for HTTP is the slippery slope and we're already walking it.

Every feature of every part of the HTML spec has to be supported for every transport. End of discussion.

HTTPS everywhere is a misguided effort. Trying to artificially limit HTTP to further your cause is just GOT-level political bullshit. Stop playing dishonestly. If HTTPS everywhere can't win through on its own merits, you should let it die.


> How long until video and media-APIs will only worked with a "secure" DRMed connection, signed by the MPAA?

The slope is so slippery I think I might actually fall off my chair. I don't think you know what the fallacy actually is.

There's no arguing against facts - moving to promote HTTPS and make some features HTTPS-only does go in that direction. But that doesn't mean things will continue going in that direction.

If I keep driving north I'm sure I'll fall off a cliff eventually. The magic happens because the road isn't straight.


> Every feature of every part of the HTML spec has to be supported for every transport. End of discussion.

Where does that feeling of entitlement come from? What makes you think you have the right to access my camera or microphone via your web page, or even execute arbitrary JS on my computer in the first place? Websites have no right to do such things. They are privileges that I grant on a case-by-case basis via my user-agent and various plugins. You don't even have any guarantee that your DOM and CSS will render as you intended, because I block all sorts of things and sometimes even tweak the styles to make the content more readable. My computer, my rules.

So I see no problem with restricting websites to a known-to-be-safe subset of features by default, until and unless a website can demonstrate that they take my privacy and security seriously. Privileges must be earned, not taken for granted, and ruthlessly revoked at the first sign of misuse.

The HTML spec describes the maximum privileges that a website can hope to have, not the minimum that it can expect to have. If your website doesn't need any special privileges, feel free to use whatever transport you want.


> When abortion was legalized, some people argued that we'd be murdering children soon. Has that happened?

We're too busy marrying them, thanks to our other slippery slopes.

(sad to see you downvoted. It is a slippery slope argument.)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: