Slashdot Mirror
Is Google's Promotion of HTTPS Misguided? (this.how)
Long-time software guru Dave Winer is criticizing Google's plans to deprecate HTTP (by, for example, penalizing sites that use HTTP instead of HTTPS in search results and flagging them as "insecure" in Chrome). Winer writes:
A lot of the web consists of archives. Files put in places that no one maintains. They just work. There's no one there to do the work that Google wants all sites to do. And some people have large numbers of domains and sub-domains hosted on all kinds of software Google never thought about. Places where the work required to convert wouldn't be justified by the possible benefit. The reason there's so much diversity is that the web is an open thing, it was never owned....
If Google succeeds, it will make a lot of the web's history inaccessible. People put stuff on the web precisely so it would be preserved over time. That's why it's important that no one has the power to change what the web is. It's like a massive book burning, at a much bigger scale than ever done before.
"Many of these sites don't collect user data or provide user interaction," adds Slashdot reader saccade.com, "so the 'risks' of not using HTTPS are irrelevant." And Winer summarizes his position in three points.
If Google succeeds, it will make a lot of the web's history inaccessible. People put stuff on the web precisely so it would be preserved over time. That's why it's important that no one has the power to change what the web is. It's like a massive book burning, at a much bigger scale than ever done before.
"Many of these sites don't collect user data or provide user interaction," adds Slashdot reader saccade.com, "so the 'risks' of not using HTTPS are irrelevant." And Winer summarizes his position in three points.
- The web is an open platform, not a corporate platform.
- It is defined by its stability. 25-plus years and it's still going strong.
- Google is a guest on the web, as we all are. Guests don't make the rules.
"The web is a social agreement not to break things," Winer writes. "It's served us for 25 years. I don't want to give it up because a bunch of nerds at Google think they know best."
... HTTPS does not prevent malware.
It securly transmits the malware.
You can walk into libraries all over the world, pull a book off the shelf, and read it. Nobody maintains it; it just sits there. Some things work that way.
Google wants content transferred 'securely' because they have their agents spread widely (googleanalytics, etc.) and don't want middlemen competing with them. They have control of the scripts, why should any other entity?
Except that the rules for HTTPS have changed at least 3 or 4 times, and recently. First keys weren't long enough. Then SSL wasn't good enough. Then TLS 1.0 is broken.
Managing ssl.conf across a few dozen servers has taken a fair amount of man hours at my organization in the last couple years-- and we have configuration management tools.
And all of this is to protect the transmission of unrestricted, publicly accessible information.
Do we really need https to display wikipedia? To see today's headlines on CNN? To read slashdot? Does the wayback machine of publicly viewable web pages need to be encrypted during transmission?
A large percentage of the web doesn't need to be encrypted during transmission.
And you missed the point. It's not that chrome won't load HTTP sites-- it's that you won't be able to find them on google search. Instead you'll get redirected to 30 different versions of the same site promising a weird trick to fix your problem, all behind paywalls.
It's a nice way to divide the internet into "have" and "have nots". If you can't afford a real, signed certificate, you can't get your message out-- because no one will ever find it (Yes, letsencrypt exists, but it requires a certain level of expertise the average blogger just doesn't have).
Why do I need to use HTTPS on a website I create that is totally public, offers not login/forums, and takes no payments. Maybe a site dedicated to building Control Line airplanes?
Two reasons: So that the ISP can't modify the page in transit to include advertisements or other unwanted elements, which Comcast has been caught doing. Also so that the ISP can't use the URL paths that their subscribers visit to build interest profiles on their subscribers. With HTTPS, the man in the middle sees only the hostname (e.g. "tech.slashdot.org", not the path ("/comments.pl?sid=12295934&cid=56872990").
This use case seems to be often ignored by the "HTTPS Everywhere" folks, yet we all constantly have to deal with it. While HTTPS probably is a good thing for all of these devices, someone needs to seriously take a step back, and actually give two shits about the certificate management problem presented here, before forging ahead and making our lives more difficult.
You can walk into libraries all over the world, pull a book off the shelf, and read it. Nobody maintains it; it just sits there. Some things work that way.
Just think of the lost opportunities!!
Why, with just 2 months and $200,000 we could start modernizing these "books" so that they use a proper 1px razor-thin font, a 20% contrast ratio, and nice 30% transparent pages. Another 4 months and $400k and we can upgrade them to require batteries and use AI to replace all those long paragraphs with summaries. And lastly, in just 1 year and a million dollars, we can add encryption, fingerprint readers, dynamic advertising, and pay-per-chapter so that only people with an active subscription or make use of the freemium model can read them!
Books-as-a-Service with nice modern UX, targeted advertising based on book genre, and microtransactions. Let's get started! Now, who will fund us?
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)