Disable HTTPS upgrade? [LWN.net]

Disable HTTPS upgrade?

Posted Mar 5, 2025 10:41 UTC (Wed) by PeeWee (subscriber, #175777)
In reply to: Disable HTTPS upgrade? by intelfx
Parent article: Firefox 136.0 released

It's implicit in the definition of HTTPS, which is just HTTP over TLS. And the mentioned effort of said HTTPS Everywhere addons has basically established this as a quasi standard. Also the problem @Cyberax describes looks like it can be fixed by proper authentication certificates for all the host names or a wildcard for the lower level domain.

to post comments

Disable HTTPS upgrade?

Posted Mar 5, 2025 10:46 UTC (Wed) by intelfx (subscriber, #130118) [Link] (5 responses)

So, it's not actually a thing. Thanks.

Disable HTTPS upgrade?

Posted Mar 5, 2025 10:56 UTC (Wed) by PeeWee (subscriber, #175777) [Link] (4 responses)

You may also want to checkout @csamuel's reply and the knowledge base article he linked to. If that method does not work, it's a bug which should be reported, simple as that.

Alas, this is yet another storm in a tea cup, imagined by people whose go-to response is ranting about some vendors they chose to hate, yet they still use their product. So the problem is in fact not a thing. Thank you.

Disable HTTPS upgrade?

Posted Mar 5, 2025 11:07 UTC (Wed) by intelfx (subscriber, #130118) [Link] (3 responses)

You are linking to internal documentation containing a description of the behavior of one specific implementation, the one whose behavior is being questioned. That does not advance the discussion at all.

Just like in your previous comment ("mentioned effort of said HTTPS Everywhere addons has basically established this as a quasi standard"), it is invalid to justify some sort of behavior by the fact that this behavior exists.

Disable HTTPS upgrade?

Posted Mar 5, 2025 11:31 UTC (Wed) by PeeWee (subscriber, #175777) [Link] (2 responses)

You are linking to internal documentation containing a description of the behavior of one specific implementation, the one whose behavior is being questioned.

That is very much public documentation, which one arrives at by following the link in the release notes.

That does not advance the discussion at all.

You are making up problems which are non-existent. That does not advance the discussion.

Just like in your previous comment (""mentioned effort of said HTTPS Everywhere addons has basically established this as a quasi standard""), it is invalid to justify some sort of behavior by the fact that this behavior exists.

The user who enters an incomplete URI is at fault, basically, and FF just changed how it defaults (hence the name) the request. And that's what you get when you rely on side effects. Always enter complete URIs and there is no problem.

Disable HTTPS upgrade?

Posted Mar 5, 2025 15:20 UTC (Wed) by intelfx (subscriber, #130118) [Link] (1 responses)

> The user who enters an incomplete URI is at fault

I never said I did this, yet you somehow assumed a fact that makes me at fault.

> You are making up problems which are non-existent

Okay, so you apparently know better than me what problems I experienced. This is a subtype of a personal attack, and, again, not something that's called a "good faith discussion". This is a pattern (even in this message, but also with you in general), therefore I will not talk to you further. Have a good day.

Disable HTTPS upgrade?

Posted Mar 5, 2025 15:50 UTC (Wed) by PeeWee (subscriber, #175777) [Link]

> The user who enters an incomplete URI is at fault

I never said I did this, yet you somehow assumed a fact that makes me at fault.

Why does everything have to be about you? Are you that narcissistic? I was (implicitly) referring to @Cyberax, or rather the problem they described above.

> You are making up problems which are non-existent

Okay, so you apparently know better than me what problems I experienced.

No, I am referring to your assertion that somehow FF is doing something wrong here, which it does not.

This is a subtype of a personal attack, and, again, not something that's called a "good faith discussion".

I apologize if it came across that way, which was not my intention.