News for hackers. Stuff that matters.
Re:Chrome 68 will mark all HTTP sites as “not secure” by protomyth on Thursday February 08, 2018 @09:36PM (#16337476)
Actually, I want a way to turn off the warning on my intranet because of all those printers, sensors, and control units on my intranet that are not going to get upgraded. I don't think I can find an HVAC or sensors with https, and I doubt anyone will authorize a 10's of thousand dollar replacement. I do not want a call anytime people have to deal with these devices and get a scary warning. Telling them to ignore it is not going to generate the right attitude when they go on the internet.
Re:Chrome 68 will mark all HTTP sites as “not secure” by Silhouette on Thursday February 08, 2018 @09:44PM (#16337514)
An inappropriate warning is still counterproductive, I agree, but it's in a different league to a solid block.

Not so long ago, I was dealing with the browsers vs. Java applets war, which had a similar effect on many devices as they became progressively harder and ultimately impossible to use. The attitude demonstrated by many defending those browser changes -- as if completely and permanently breaking useful, long-developed, working software on a private network was somehow a good thing -- was somewhere between smug, dismissive and arrogant, and actually quite offensive in some cases.

Re:Chrome 68 will mark all HTTP sites as “not secure” by protomyth on Thursday February 08, 2018 @10:05PM (#16337600)
Developers often wonder why people use iSeries (AS/400) machines. Well, the software is long lived and keeps working. The whole IoT is not going to go forward when the software infrastructure is sand as opposed to stone. I get the feeling if this stuff keeps up, it would be wise for some infrastructure company (e.g. Honeywell) to sponsor an OS specifically for infrastructure with some version of a remote desktop to talk to it. Obviously, web browsers are the wrong way to control long lived devices.
Re:Chrome 68 will mark all HTTP sites as “not secure” by Silhouette on Friday February 09, 2018 @05:42AM (#16339268)
The whole IoT is not going to go forward when the software infrastructure is sand as opposed to stone.

I agree with you about longevity, though I think IoT is mostly a solution in search of a problem anyway, even if the hype train is clearly going to run for a long time yet. Connectivity is obviously useful for some devices, but most of the products I have ever seen in the IoT space weren't IoT to benefit the user, they were IoT to benefit the developer, and they often made the user's experience worse. The other day I visited a friend, and he couldn't change the settings for the lights in his home because his Internet connection was playing up!

Obviously, web browsers are the wrong way to control long lived devices.

There, I will respectfully disagree. Web browsers are, or at least were, a useful way to access devices over well-defined and standardised protocols that were supported on many client devices. They allow UIs much more user-friendly than a command line for non-technical users, and they don't depend on native applications for each client or customised control protocols for each product.

I've built many browser-based UIs for clients over the years with good results, and the only thing that has ever seriously broken them was when browsers started dropping support for useful, long-established functionality -- hence my concern in the current case.

Re:Chrome 68 will mark all HTTP sites as “not secure” by protomyth on Friday February 09, 2018 @10:22AM (#16340791)
There, I will respectfully disagree. Web browsers are, or at least were, a useful way to access devices over well-defined and standardised protocols that were supported on many client devices.

I think its the "were" part that getting me. We had a standardized protocol: http which is now being phased out and a whole lot of developers of embedded systems jumped on it as a control mechanism for their devices. Now we have this crowd of other developers that focus on a different market segment and don't really give a damn about the problems that causes for others. "Move fast and break things" is fine for startups, but not for anything that our profession built into things. I just a little sick of a disposable culture. I agree https is a great thing and needed, but putting scary warnings on http that cannot be mitigated is a pain in the butt because at some point they will remove http entirely.

At this point, I honestly wish the embedded device programmers would jump off the web train and move on to something else.

Re:Chrome 68 will mark all HTTP sites as “not secure” by Silhouette on Friday February 09, 2018 @01:30PM (#16342636)
At this point, I honestly wish the embedded device programmers would jump off the web train and move on to something else.

OK, but what? That's the real question here, surely.

There are very few developments in the history of computing that have been as widely useful and long-lasting as the fundamental web technologies. The fact that certain browser developers are now trying to embrace, extend and extinguish those technologies for their own obvious purposes and without regard to collateral damage just means we need to push back hard against those browser developers. Google is already more powerful than is safe for our industry, and certainly we must not let it become the de facto owner of anything essential.

Re:Chrome 68 will mark all HTTP sites as “not secure” by protomyth on Friday February 09, 2018 @05:12PM (#16344307)
There are very few developments in the history of computing that have been as widely useful and long-lasting as the fundamental web technologies.

I'm not so sure. All of the web technologies have changed over time. I'm pretty sure only the simplest web pages from the 90's are still functional. Their are still computers sold today that can run IBM/360 programs unchanged.

The fact that certain browser developers are now trying to embrace, extend and extinguish those technologies for their own obvious purposes and without regard to collateral damage just means we need to push back hard against those browser developers.

Well, I still think the idea of using a document format as an application format was totally foolish. Frankly, something like a decedent of QML or even Sun NeWS would have been more appropriate. Heck even a networked p-machine with a UI would have been better. A frozen subset of HTML might work (well, could use WML and WMLscript since nobody uses that anymore). I think the whole push back is not going to happen. Instead we end up with a harder development environment than Visual Basic or NeXTSTEP with less functionality than either.

Google is already more powerful than is safe for our industry, and certainly we must not let it become the de facto owner of anything essential.

No disagreement there. They own the web and can declare your site removed from the internet as far as 90% of web users are concerned.

Re:Chrome 68 will mark all HTTP sites as “not secure” by sk5t on Friday February 09, 2018 @12:26AM (#16338093)
One might understand an extra-hostile stance against Java applets, having witnessed tortured attempts to keep a vendor's applet running when that applet required a very, very specific (and even then very obsolete) version of Java 1.3 incompatible with some other awful software's requirements. Breaking other, innocent software would have seemed like a pretty fantastic deal, in order to reduce future applet pain.
Re:Chrome 68 will mark all HTTP sites as “not secure” by jweather on Thursday February 08, 2018 @09:49PM (#16337539)
That was my life a few years ago when Java applets switched from being the best thing since sliced bread to being anathema. Or take ActiveX for another example. Trying to do business with consumer-grade browsers is just one pain point after another.
Re:Chrome 68 will mark all HTTP sites as “not secure” by noway421 on Friday February 09, 2018 @04:06AM (#16338877)
If that's really an issue, surely there's an option of putting a reverse https proxy? Definitely less then 10's of thousands dollars.
Re:Chrome 68 will mark all HTTP sites as “not secure” by protomyth on Friday February 09, 2018 @06:21AM (#16339401)
It’s really an issue, and why am I setting up another server app to fix something that should be a switch for the administrator in software that worked before?