[Clueless anti-s]ecurity quote of the week [LWN.net]

[Clueless anti-s]ecurity quote of the week

Posted May 7, 2015 12:07 UTC (Thu) by johill (subscriber, #25196)
In reply to: [Clueless anti-s]ecurity quote of the week by jschrod
Parent article: Security quote of the week

telnet would be a better analogy if the "telnet" binary was now saying "sorry, you cannot connect to anything that's not ssh protocol any more" - and then you couldn't watch "telnet towel.blinkenlights.nl" afterwards :)

...

to post comments

[Clueless anti-s]ecurity quote of the week

Posted May 8, 2015 8:06 UTC (Fri) by fredrik (subscriber, #232) [Link]

Well, as you just illustrated so well, one can still deploy and access a telnet service today. Even though telnet has been deprecated by the world for decades.

And you can deploy a gopher site. With an add-on you can use Firefox to visit that site. Even though the protocol has been more or less abandoned for two decades.

There will in all likelihood be a long tail of personal sites, sites of historic interest, cat picture sites, etc, served by plain http for decades more. When I read Mozillas proposal my conclusion is that you will be able to continue to use Firefox to visit those sites too. Am I really mistaken?

What is changing is that new web features - new javascript features and maybe some upcoming html5 features, etc - will not work on contemporary sites unless they are served over https. In my view the approach is very much a carrot thing, not a stick thing. You want new features? Well, move to https then.

Apart from the unreasonable demand that Mozilla stop hacking on Firefox and dedicate all their resources to solve all aspects of https server deployment for everyone before deprecating http, how else can they implement a carrot approach to migration to https?

Speaking of carrots, Mozilla are already involved in Let' Encrypt, an effort to make certificate deployment very much easier and available at no cost. How is that not to engage in a carrot approach?

To reiterate: Your old HTML 4.01 site that you last edited 1999 and still are proud validates to this day, and which is served over a HTTP 1.0 server that you implemented yourself in C and lost the source code to a long time ago, will keep on working. Please, just don't go and spoil it with html5 and javascript. Thanks! :)