Wissenschaftler in den USA haben eine mögliche neue Ursache für das Insektensterben ausgemacht: Der CO2-Ausstoß der Menschheit führt dazu, dass Pflanzen weniger für Insekten wichtige Nährstoffe enthalten. nd-aktuell.de/artikel/1191146.…
Profitez des vidéos et de la musique que vous aimez, mettez en ligne des contenus originaux, et partagez-les avec vos amis, vos proches et le monde entier.
side note (and maybe I gave flu and it’s making me more stupid) but what are the arguments for having SSL on brochureware websites that don’t collect private information?
because we used to live in a world where ISPs, open wifi networks (cafes, etc) could intercept your HTTP responses and inject javascript/HTML into your browser to force you to see ads and/or attack you
Thanks everyone for your comments on this. I like this excerpt from doesmysiteneedhttps.com:
"this discussion isn't about PKI. It's the best system we've got for right now. Deal with it and secure your site. Use CAA records to restrict which CAs can issue certificates for your site, then cross your fingers and hope transparency and oversight works (it does, so far)".
Do you all feel that there is enough integrity in browser trusted root certificate stores to still provide robust defence against the content / malware injection threat?
Also - have these kinds of injection attacks ceased now, and is SSL the reason for this?
> Do you all feel that there is enough integrity in browser trusted root certificate stores to still provide robust defence against the content / malware injection threat?
It's the best we can do with what we've got to work with. All we can hope is that the bad actors get caught from the Certificate Transparency Logs and are swiftly removed from all root certificate stores as their punishment.
Thanks again to everyone who contributed to this thread. So this is what I'm hearing:
HTTPS still matters, even for static or non-interactive sites: • Mitigates content injection: Many ISPs and network operators have historically injected ads, tracking scripts, or even malware into unencrypted traffic. HTTPS prevents this by ensuring the integrity of the response between server and browser. • Defends against surveillance and manipulation: Examples of DNS hijacking, Gmail session spoofing, and targeted malware campaigns (e.g. FinFly), all made possible through unencrypted channels. HTTPS helps block these classes of attacks. • Removes network-level ambiguity: On public or hostile networks (e.g. hotel WiFi), HTTPS is the only realistic protection against on-path attackers modifying or observing content in transit. • Accessible and frictionless today: With Let’s Encrypt etc deployment is largely automated and cost-free for most use cases. • Normalizes secure transport: Widespread adoption means sensitive or at-risk traffic doesn’t stand out. Universal encryption helps everyone by minimizing soft targets.
On the other hand:
The CA model is a systemic weakness: Certificate Authorities remain a centralized point of failure. Trust is implicit and broad, and mechanisms like Certificate Transparency offer only partial mitigation. • Operational complexity remains an issue: Some tooling (e.g. Certbot) is complex and prescriptive, and certain practices (like root-required processes) can introduce risk or confusion for small deployments. • HTTPS doesn’t secure everything: It encrypts transport, but does not protect against compromised endpoints, malicious JavaScript, or bad site logic. • Trust shifts to browser vendors: Efforts like DNS-over-HTTPS, cert pinning, and HSTS move the locus of trust from networks to browsers — trading one set of risks for another.
Yes to basically all of this, but I would suggest that trust in browsers over networks is demonstrably better, where those browsers' source code is available. With networks there are as many chances for something to be wrong as there are networks, and each network's problems are only visible and addressable by a small group. For browsers, anyone who can see the source can evaluate it, giving a much wider opportunity to spot misconfiguration and error, and it only needs correction in one place for everyone to receive the benefit.
@charlvdwalt the content of the website doesn’t matter because the content is whatever an attacker wants it to be if you aren’t using SSL. Your brochureware is now malware.
@charlvdwalt SSL is super important and all, but that statement is awfully FUD-y. The odds of somebody actually doing that are vanishingly small, but you make it sound like their site can be replaced by anyone any time
regimes have used it as an attack vector, and so did several democracies too. ISPs have used it to inject ads. Encryption isn't only about privacy, it's critical to ensure that the contents of a message you received haven't been tampered with.
@gabrielesvelto @iagox86 @charlvdwalt The regimes most of us need to worry about all have their own CA or several they can get to do their bidding with some kind of "national security letter".
@iagox86 @charlvdwalt No, it was actually a really big issue which is why Google incentivized it. ISPs were injecting ads into random webpages, law enforcement and intelligence agencies made frequent use of it, and it was also a massive privacy risk. Almost every service provider has deep packet inspection and can/will monitor everything you do.
- adds dependency on CA - requires one more thing to work, ie be kept updated, to request new certs regularly - locks out old devices that don't support the crypto-flavor-of-the-month - the above adds friction, which makes Cloudflare et al more attractive to not have to bother, leading to increased mono culture
Encryption by default has removed a whole category of not just attacks, but scummy business practices. A little inconvenience to administrators is not even worth talking about.
Your comment reads exactly like a politician arguing for stripping worker protections or safety regulations because they inconvenience employers.
It’s tone deaf, deliberately ignorant, and dismissive of people who get to not be taken advantage of easily due to these measures.
In practice I've had more problems with broken https cert setups blocking me from pages that I've tried to access that I've had with ISP-injected ads. But I don't live in the US where that is/was legal, so YMMV I suppose.
And the fact that Letsencrypt and Cloudflare are used by such a large percentages of websites is a huge problem, IMHO. We need fewer single-points-of-failure, not more.
@mikaeleiman @slotos I would argue you see less of the latter issue because enough sites use SSL that it's not worth the effort for the ISP to set up an advertisement injection. Prevention tends to reduce the chances of a problem occuring.
@todb @iagox86 @charlvdwalt @pluralistic I remember phone interviewing with some company that was doing injections as part of "web acceleration". I did not follow up once i learned that aspect.
Also that was after working at AOL and learning their image compression was actually not bad... as long as you didn't dial all the settings down to their lowest values (as they did). So would have been sometime after 2004
@nuintari @todb @iagox86 @charlvdwalt @pluralistic Frontier (formerly Verizon's west coast network) rewrote Google search results via DNS hijacking to add referral codes to Amazon, etc, and may or may not have added their own ads. Pre SSL, of course. I had a reproducible test case that ran via cron at home so we could see when they turned it off and on.
The irony that this page isn't HTTPS and I can't change it to HTTPS, and searches from the main website drop it down to HTTP as well isn't lost on me...
(I can only guess they have a different host for their older articles that doesn't support SSL).
@azonenberg @nuintari @todb @iagox86 @charlvdwalt @pluralistic another example I can think of is that as recently as the late 10s, there was still the issue of cell vendors inserting mobile subscribers’ MSISDNs (or similar tracking ref) using HTTP transproxies for all non-HTTPS traffic - I recall this with at least one of the big US networks, and Vodacom in ZA also did something like it. probably many others worldwide if you dig around
@azonenberg @nuintari @todb @iagox86 @charlvdwalt @pluralistic it was a very big thing on public WiFi hotspots. It would break a lot of websites cos the advertising code would just jam new HTML elements in, shitty JavaScript, conflicting versions with what the page authors used... It was a nightmare
Il Samsung Galaxy Z Flip FE potrebbe montare il chip Exynos 2400. Un benchmark svela dettagli sul SoC e la strategia per un pieghevole più accessibile.
The Romanian fascist candidate shared a post on his blog, where he addresses those who will not vote for him directly. He tells them that he will "deal with each one of them", individually, after he becomes president.
Robert Kiyosaki, author of Rich Dad Poor Dad, has renewed his warning against fiat currency, urging Americans to move away from what he calls “fake money” and instead invest in Bitcoin (CRYPTO:BTC), gold, and silver.
“Welcome to the era of ‘hostage politics’, where Labour is apparently your only hope.”
“There is contempt here. Instead of changes to the tax system, and a commitment to thinking differently about an economic paradigm that has reached an undeniable dead end, Labour looks at the rising wave of populist politics and decides to tell voters that populism is the problem, not the world that created it.”
First it was the Conservatives and now Reform. The only thing the government has to offer is that it’s the least worst option, says Guardian columnist Nesrine Malik
[repost Legalna Aborcja] Nie mamy wątpliwości, że napis na tym transparencie to prawda. @abotakprzychodnia powstała właśnie po to by pomagać - bez względu na powód, bez oceniania - po to by każda osoba, która potrzebuje aborcji otrzymała wsparcie.
Powstała w tym miejscu, pod Sejmem, bo politycy i polityczki od lat udawali, że aborcji nie ma zakłamując rzeczywistość. Antyaborcyjne prawo jakie mamy w Polsce skonstruowane jest tak, by osoby, które aborcje robią zostawały z tym doświadczeniem same, wpędzane w poczucie wstydu, winy i strachu.
Ponad 130 osób dziennie robi aborcje tylko ze wsparciem #aborcjabezgranic, a 250-300 to liczba aborcji robionych w Polsce każdego dnia. 1 na 3 kobiety w Polsce ma doświadczenie aborcji. (CBOS, Doświadczenia aborcyjne Polek)
Prawo antyaborcyjne po wyborach z 2023 roku miało się zmienić, a jest coraz gorzej. Organizacje, które każdego dnia zapewniają dostęp do aborcji (wyręczając w tym państwo) nie otrzymują żadnego wsparcia od rządu. Stosunek osób u władzy do aborcji widać wyraźnie po tym co od dwóch miesięcy dzieje się pod @abotakprzychodnia - politycy i polityczki znów myślą, że jeśli odwrócą głowę to aborcja zniknie.
A aborcja jest. Nie wystarczy zamknąć oczu, by przestała być potrzebna, odwrócić głowy, by kobiety przestały ją robić. Aborcja jest, bo jest potrzebna kobietom, aby czuły się bezpieczne, aby mogły decydować o swoim życiu i o życiu swojej rodziny. Aborcja to doświadczenie wielu z nas, slogan wyborczy.
@abotakprzychodnia @aborcyjnydream dziękujemy, że jesteście! Trudniej nam jest pomoc Wam na miejscu, na Wiejskiej, ale wspieramy każdego dnia!
Im bardziej oni próbują zakazać aborcji, tym bardziej my wystawiamy ją do słońca. Dlatego idziemy o krok dalej i OTWIERAMY PIERWSZY W POLSCE STACJONARNY LOKAL! Zostań jego ambasadorką!
Myanmar's shadow government said an airstrike by the ruling junta had killed at least 17 students and injured 20 others at a school in an opposition-controlled area on Monday, despite a ceasefire being in place after a devastating earthquake.
The image shows a top-down view of a kitchen scene with various items arranged on a dark gray surface. In the center, there is a metal strainer with a white cloth placed over it, positioned on a glass bowl. A clear plastic bottle with a red ring near the neck is pouring a liquid onto the cloth. To the left, there is a halved lemon and a whole lemon, along with a small bowl of white granulated sugar. To the right, there are metal measuring spoons, a small bowl of white powder, and two corks. The background includes a white and black checkered cloth. The scene suggests a process involving straining a liquid, possibly related to making lemonade or another citrus-based beverage.
Provided by @altbot, generated privately and locally using Ovis2-8B
📢 The #UK government is being taken to the High Court by Palestinian #humanrights group Al-Haq over its role in exporting F-35 fighter jet components used by Israel in #gaza
The UK government is being taken to the High Court by Palestinian human rights group Al-Haq over its role in exporting F-35 fighter jet components used by "Israel" in Gaza.
From Studio Ghibli-inspired illustrations to doll “starter packs,” an explosion of AI-generated images in recent weeks has sparked a fresh wave of concern among artists.
O líder da IL está disponível para a governação se “for para mudar Portugal”, frisando que o partido vai exigir a liberalização do mercado ferroviário, baixar o IVA da construção e o IRS.
Dal 15 al 19 maggio il #MIM sarà presente al Salone del Libro di Torino! Nello spazio espositivo del MIM, presso il padiglione Oval, saranno realizzate attività informative per i docenti, gli studenti e le famiglie con un programma di oltre 40 eventi…
Dal 15 al 19 maggio il #MIM sarà presente al Salone del Libro di Torino!
Nello spazio espositivo del MIM, presso il padiglione Oval, saranno realizzate attività informative per i docenti, gli studenti e le famiglie con un programma di oltre 40 eventi…
Il #Pkk depone le armi e annucia lo scioglimento mettendo fine alla #guerra con la #Turchia durata 40 anni. Resta da vedere quali effetti concreti potrà avere sul piano politico e sociale, sia per le comunità curde in patria sia per il destino di Abdullah #Ocalan, ancora al centro di un dibattito acceso nel Paese.
“Intelligenza artificiale, intelligenza emotiva: futuro semplice o imperfetto?” è il tema della conferenza in programma sabato 10 maggio 2025 alle ore 9.00 nell’aula magna di giurisprudenza a Palazzo Cavallini, via San Faustino 41 a Brescia. Relatori Francesco Morace, Cosimo Accoto, Arturo Di Corinto, Daniele Monteleone, Nicoletta Cusano Salvatore Frattallone. Moderatori Teresa Croce e Luigi Della Bora; introduzione a cura del prof. Maurizio Tira. L’iniziativa è sotto l’egida di Lions, Leo, Fondazione Lions Clubs Distretto 108 Ib2 “Bruno Bnà” Ets, Comune di Brescia, Università degli Studi di Brescia e Fondazione UniBS.
🏛️ ■ El 'talón de Aquiles' socialista: los mensajes de Ábalos y Sánchez despiertan un nuevo revuelo político ■ El diario El Mundo desvela conversaciones entre el presidente del Gobierno y Ábalos una vez este fuese destituido. huffingtonpost.es/politica/el-…
Hamas and the United States announced an agreement today that will lead to the freeing of Israeli soldier Edan Alexander, a dual American citizen, ahead of President Donald Trump’s trip to the region.
Trump lashed out at bipartisan critics after reports revealed he plans to accept a $400 million Boeing 747-8 jet from Qatar for use as Air Force One.
In a Truth Social post, Trump dismissed concerns as “world class losers” complaining about a transparent gift. Qatar stated the plane is under legal review between its Ministry of Defense and the Pentagon.
Critics, including Sen. Bernie Sanders, Sen. Chris Murphy, and Rep. Jamie Raskin, accused Trump of corruption and violating the Constitution.
Even allies like Laura Loomer led the MAGA pushback to the jet deal.
Besides the obvious corruption, it's a national security issue. I'm not an aircraft designer, but I'm pretty sure there's quite a bit of electronics aboard that craft. Pretty easy to slip in a few listening devices.
Not to mention the refit to include all the secure communication equipment Air Force One has. Also ECM, active countermeasures, NBC equipment, refuelling, etc.
L'immagine presenta un'opera d'arte in stile linocut, caratterizzata da un forte contrasto tra il blu turchese e il bianco. Al centro dell'immagine, un grande pesce, probabilmente un balenoptera, è rappresentato in modo stilizzato. Il corpo del pesce è decorato con piccoli punti bianchi, che suggeriscono le scaglie, e presenta linee bianche che delineano le sue forme. Il pesce sembra muoversi attraverso un'acqua rappresentata da curve bianche che si estendono in tutte le direzioni, creando un senso di movimento e dinamismo. Lo sfondo è uniformemente blu turchese, che accentua la figura del pesce e le curve bianche. L'opera d'arte è composta in modo da guidare lo sguardo del viewer attraverso il movimento del pesce e delle onde, creando un'atmosfera vivace e fluida.
Fornito da @altbot, generato localmente e privatamente utilizzando Ovis2-8B
Il Caffè Sospeso dà voce alle donne afghane oppresse dai Talebani pressenza.com/it/2025/05/il-ca… A maggio comincia il tour italiano di Zainab Entezar, giovane regista di Kabul, rifugiata in Europa per sfuggire alla cattura da parte dei Talebani. E’ la testimone che il Festival del Cinema dei Diritti Umani di Napoli e la Rete del… Redazione Italia
A maggio comincia il tour italiano di Zainab Entezar, giovane regista di Kabul, rifugiata in Europa per sfuggire alla cattura da parte dei Talebani. E’ la
Sources: Apple considers raising prices for its fall iPhone lineup, a step it is seeking to couple with new features and design tweaks, without blaming tariffs (Wall Street Journal)
Ciò che si muove nel movimento questa settimana. Per promuovere le iniziative e gli eventi nei posti occupati e di movimento mandare una mail a ondarossa@ondarossa.info.
Dal 15 al 18 maggio 2025, una delegazione della società civile italiana si recherà a Ustica per rendere omaggio alle vittime della deportazione coloniale italiana.
« Le sionisme, puis l’État d’Israël exigeront que les Palestiniens les reconnaissent en droit. Mais lui, l’État d’Israël, il ne cessera de nier le fait même d’un peuple palestinien. On ne parlera jam…
Sabemos pouco sobre o que os partidos pensam sobre as atrocidades em Gaza (com excepções), enquanto a Europa está totalmente abúlica perante a carnificina de Israel. E isso é importante para votar.
Some of the microplastics we ingest may come from the kitchen tools we use to prepare what we eat. If you want to reduce your reliance on plastic, here are some ideas.
Instead of using a plastic cutting board, she uses wooden ones. One recent study called plastic cutting boards a "potentially significant source of microplastics in human food" and found that a polyethylene chopping board could shed between 7.4 and 50.7 grams of microplastics per person per year.
When I see claims like this I grow skeptical. I've had a plastic cutting board for a decade. If it was shedding 50 grams a year it would have disappeared already. Even at 7 grams it would be noticeably eroded. Instead, it hasn't shrunk perceptibly at all.
The DOOD (CRYPTO:DOOD) token from the Ethereum-based (CRYPTO:ETH) NFT project Doodles experienced a significant market capitalisation decline following its airdrop on May 9, 2025.
Donald Trump, o atual Presidente dos Estados Unidos, tomou a decisão de despedir Shira Perlmutter, a figura que liderava o U.S. Copyright Office, a entidade re
Profitez des vidéos et de la musique que vous aimez, mettez en ligne des contenus originaux, et partagez-les avec vos amis, vos proches et le monde entier.
Am 24. Mai 2025 finden wir uns am Südplatz vor der naTo ein, um gemeinsam den dritten Photo Walk des Streetcollective Leipzig zu starten. Bei Fragen deinerseits kannst du einfach einen der unter Kontakt aufgeführten Kanäle nutzen. Wir freuen uns über jede:n Teilnehmende:n, Akzeptanz und Einhaltung unseres Kodex vorausgesetzt.
This was taken a few months ago, it's another photo of La Basilica di San Francesco. We are on a little seating area directly in front on it. Behind us, across the road, is a gelateria and this is the day I found out they had peanut butter ice-cream - hiiiiighly recommend it. 🍦✨
The BBC is suppressing a documentary about the plight of doctors in Gaza, saying the delay is linked to an internal review of a different film by a different producer. It makes no sense. The UK gover
Save the date, Dress History friends, for another "At Home with C19th Dress and Textiles Reframed" online event on Sunday, May 25!
"This themed session focuses on the development of the chemisette, the male shirt and the blouse in relation to themes of innovation, consumption, manufacture and the historic display of classed and gendered bodies. All welcome!"
Speakers: 👕 Hilary Davidson - When is a Chemisette a Chemisette? 👕 John Finkelberg - Inventing Modern Masculinity and the White Shirt 👕 Suzanne Rowland - Unpacking the fashionable 'Edwardian' Blouse
🇧🇷 Brazil’s President Lula is defending his visit to Putin at the Victory Parade. He says Brazil is still all about peace and that the trip doesn’t go against the country’s official position on the war in Ukraine. Lula thinks it was part of his effort to strengthen global ties and try to act as a mediator in peace talks between Russia and Ukraine.
It's a plant photography thread! Some of the photos from yesterday's trip to the botanical gardens, which I enjoyed. I'm going to be typing out the Alt Text for about eleven million years, slightly sleep deprived, so chances are it's going to be a bit interesting! 😂
C'è una leggenda urbana che circola da tempo e che ultimamente ha cominciato a diventare virale anche in rete. Il tutto anche grazie a siti come Il Giornale d'Italia che l'hanno riproposta ultimamente.
Hello, Myth Lovers! Join us for Monday's theme: funny myths! Which myths make you laugh? Write out your story and use the hashtag #MythologyMonday for boosts. If joining from #BlueSky: follow @ap.brid.gy so we can interact with your posts. See you tomorrow!
Profitez des vidéos et de la musique que vous aimez, mettez en ligne des contenus originaux, et partagez-les avec vos amis, vos proches et le monde entier.
Charl van der Walt 🌻🇵🇸
in reply to Marcus Hutchins • • •feld
in reply to Charl van der Walt 🌻🇵🇸 • • •Charl van der Walt 🌻🇵🇸
in reply to Charl van der Walt 🌻🇵🇸 • • •Thanks everyone for your comments on this. I like this excerpt from doesmysiteneedhttps.com:
"this discussion isn't about PKI. It's the best system we've got for right now. Deal with it and secure your site. Use CAA records to restrict which CAs can issue certificates for your site, then cross your fingers and hope transparency and oversight works (it does, so far)".
Do you all feel that there is enough integrity in browser trusted root certificate stores to still provide robust defence against the content / malware injection threat?
Also - have these kinds of injection attacks ceased now, and is SSL the reason for this?
Thanks!
feld
in reply to Charl van der Walt 🌻🇵🇸 • • •> Do you all feel that there is enough integrity in browser trusted root certificate stores to still provide robust defence against the content / malware injection threat?
It's the best we can do with what we've got to work with. All we can hope is that the bad actors get caught from the Certificate Transparency Logs and are swiftly removed from all root certificate stores as their punishment.
Charl van der Walt 🌻🇵🇸
in reply to Charl van der Walt 🌻🇵🇸 • • •@rysiek @simon_brooke @Gustodon @cigitalgem @paul @SpaceLifeForm @sabrinaweb71 @bruce @dascandy @leeloo @laird @nuintari @todb @iagox86 @TindrasGrove @tdp_org @http_error_418 @HodgesC @nuintari @lolennui @pluralistic @azonenberg @todb @iagox86 @HodgesC @truh @nuintari@bsd.cafe @dzwiedziu @freediverx @dascandy and others.
Thanks again to everyone who contributed to this thread. So this is what I'm hearing:
HTTPS still matters, even for static or non-interactive sites:
• Mitigates content injection: Many ISPs and network operators have historically injected ads, tracking scripts, or even malware into unencrypted traffic. HTTPS prevents this by ensuring the integrity of the response between server and browser.
• Defends against surveillance and manipulation: Examples of DNS hijacking, Gmail session spoofing, and targeted malware campaigns (e.g. FinFly), all made possible through unencrypted channels. HTTPS helps block these classes of attacks.
• Removes network-level ambiguity: On public or hostile networks (e.g. hotel WiFi), HTTPS is the only realistic protection against on-path attackers modifying or observing content in transit.
• Accessible and frictionless today: With Let’s Encrypt etc deployment is largely automated and cost-free for most use cases.
• Normalizes secure transport: Widespread adoption means sensitive or at-risk traffic doesn’t stand out. Universal encryption helps everyone by minimizing soft targets.
On the other hand:
The CA model is a systemic weakness: Certificate Authorities remain a centralized point of failure. Trust is implicit and broad, and mechanisms like Certificate Transparency offer only partial mitigation.
• Operational complexity remains an issue: Some tooling (e.g. Certbot) is complex and prescriptive, and certain practices (like root-required processes) can introduce risk or confusion for small deployments.
• HTTPS doesn’t secure everything: It encrypts transport, but does not protect against compromised endpoints, malicious JavaScript, or bad site logic.
• Trust shifts to browser vendors: Efforts like DNS-over-HTTPS, cert pinning, and HSTS move the locus of trust from networks to browsers — trading one set of risks for another.
Advanced Persistent Teapot
in reply to Charl van der Walt 🌻🇵🇸 • • •@charlvdwalt @rysiek @simon_brooke @Gustodon @cigitalgem @paul @SpaceLifeForm @sabrinaweb71 @bruce @dascandy @leeloo @laird @nuintari@infosec.exchange @todb @iagox86 @TindrasGrove @tdp_org @HodgesC @lolennui @truh @nuintari@bsd.cafe @dzwiedziu @freediverx
Yes to basically all of this, but I would suggest that trust in browsers over networks is demonstrably better, where those browsers' source code is available. With networks there are as many chances for something to be wrong as there are networks, and each network's problems are only visible and addressable by a small group. For browsers, anyone who can see the source can evaluate it, giving a much wider opportunity to spot misconfiguration and error, and it only needs correction in one place for everyone to receive the benefit.
Simon Brooke
in reply to Advanced Persistent Teapot • • •@http_error_418 @charlvdwalt @rysiek @Gustodon @cigitalgem @paul @SpaceLifeForm @sabrinaweb71 @bruce @dascandy @leeloo @laird @nuintari@infosec.exchange @todb @iagox86 @TindrasGrove @tdp_org @HodgesC @lolennui @truh @nuintari@bsd.cafe @dzwiedziu @freediverx
Agreed, **provided** the full source code of the browser is available **and is compact enough to be meaningfully audited**.
In my opinion, modern browsers are too heavyweight, seek to do too much, and this makes them hard to audit.
Marcus Hutchins
in reply to Charl van der Walt 🌻🇵🇸 • • •Ron Bowes
in reply to Marcus Hutchins • • •Gabriele Svelto [moved]
in reply to Ron Bowes • • •Leeloo
in reply to Gabriele Svelto [moved] • • •The regimes most of us need to worry about all have their own CA or several they can get to do their bidding with some kind of "national security letter".
Marcus Hutchins
in reply to Ron Bowes • • •Navi
in reply to Charl van der Walt 🌻🇵🇸 • • •Does my site need HTTPS?
CaddyDušan Mitrović
in reply to Charl van der Walt 🌻🇵🇸 • • •m_eiman
in reply to Dušan Mitrović • • •@dusnm On the minus side you have:
- adds dependency on CA
- requires one more thing to work, ie be kept updated, to request new certs regularly
- locks out old devices that don't support the crypto-flavor-of-the-month
- the above adds friction, which makes Cloudflare et al more attractive to not have to bother, leading to increased mono culture
slotos
in reply to m_eiman • • •m_eiman
in reply to slotos • • •@slotos @dusnm Fairly serious, I suppose 🤷♂️
These are actual issues and costs of forcing https everywhere. I suppose the benefits usually outweigh them, but that doesn't make them go away.
slotos
in reply to m_eiman • • •@mikaeleiman @dusnm
Encryption by default has removed a whole category of not just attacks, but scummy business practices. A little inconvenience to administrators is not even worth talking about.
Your comment reads exactly like a politician arguing for stripping worker protections or safety regulations because they inconvenience employers.
It’s tone deaf, deliberately ignorant, and dismissive of people who get to not be taken advantage of easily due to these measures.
m_eiman
in reply to slotos • • •@slotos Feel free to feel that way.
In practice I've had more problems with broken https cert setups blocking me from pages that I've tried to access that I've had with ISP-injected ads. But I don't live in the US where that is/was legal, so YMMV I suppose.
And the fact that Letsencrypt and Cloudflare are used by such a large percentages of websites is a huge problem, IMHO. We need fewer single-points-of-failure, not more.
Epic Null
in reply to m_eiman • • •Jon A. Cruz
Unknown parent • • •@todb @iagox86 @charlvdwalt @pluralistic I remember phone interviewing with some company that was doing injections as part of "web acceleration". I did not follow up once i learned that aspect.
Also that was after working at AOL and learning their image compression was actually not bad... as long as you didn't dial all the settings down to their lowest values (as they did). So would have been sometime after 2004
Scott Laird
Unknown parent • • •reshared this
Giuseppe Aceto reshared this.
Andrew Zonenberg
Unknown parent • • •Ed Chivers
in reply to Andrew Zonenberg • • •@azonenberg @nuintari @todb @iagox86 @charlvdwalt @pluralistic BT did this here in the UK with a technology called "phorm". I remember there was a hell of a stink about it and they ditched it after a year or so. news.bbc.co.uk/1/hi/technology…
The irony that this page isn't HTTPS and I can't change it to HTTPS, and searches from the main website drop it down to HTTP as well isn't lost on me...
(I can only guess they have a different host for their older articles that doesn't support SSL).
BBC NEWS | Technology | BT advert trials were 'illegal'
news.bbc.co.ukamy tech (bones)
in reply to Andrew Zonenberg • • •JP
in reply to Andrew Zonenberg • • •Advanced Persistent Teapot
in reply to Andrew Zonenberg • • •