> and I'm sure if your car's GPS indicated locations with high crime rates as "not safe" and prevented you from going there, there would be much outrage.
This is just a warning though, no one is preventing you from "going there", it's merely a warning that it might not be safe. Your analogy is more similar to "there's a slow down on that road, let me navigate you somewhere else, but feel free to go there if you want". You have exactly the same amount of freedom.
How exactly is using HTTPS "gain control over the masses"? Google does not control the HTTPS infrastructure.
It's not like those sites are gone either. There's always archive.org.
Now consider that things like Meltdown and Spectre have JavaScript PoCs
If this was instead 'Chrome 68 will mark all JS-using sites as "not secure"', I wouldn't want that warning either, but then I'd be in agreement with the majority...
So a better analogy would be a carmaker announcing that they don't want people to drive to unsafe areas. They'll monitor people's driving behavior via telemetry and OTA-update the car's software accordingly to nudge people's behavior closer to that goal.
So the warning would probably be the first step. Driving to unsafe areas will still be technically possible but it will become progressively more cumbersome until you just give up.
It should always be a choice. If something is insecure, show a warning, in big red bold letters if you have to, but allow the freedom of choice to the end-user. But here, what do we have ? Many newer Javascript, HTML or HTTP features are restricted to HTTPS. Even things like Brotli stream compression which bear no security implications. This is done only to coerce people to use HTTPS.
HN works just fine without Javascript. The only thing that doesn't work is collapsing comment threads.
Confirmed by me[0] using HN throw Links2, screenshot[1] attached ;-)
> The only thing that doesn't work is collapsing comment threads.
Voting on comments also not work without JavaScript on HN, but in same time voting on threads work without JS.
also we know how these things go. first a warning, then a ban, then extinction from history
http://blogs.adobe.com/flashplayer/2012/06/flash-player-and-...
The most straightforward thing to do would be to disable javascript on non https sites by default or warn if a nonhttps site has javascript. Most of the old sites we want to keep around don't have javascript in them (or much javascript in them).
Ideally people should only be enabling javascript on sites they trust (and are running https for "real" "trust") but having a trusted whitelist for enabling javascript brings back your big brother arguments.
Penalizing all http users is heavy handed and google should not go down that path.
As other commenter noted, Comcast has been observed to inject content to its customers; would you rather that on HTTP or that you run HTTPS?
Good one. Next you'll be telling me that those very same companies don't spend billions on getting the laws written the way they want.
Sure you could try the top down approach where everyone has the best intentions but that's not going to happen, in the meantime I'm installing bulletproof windows in my car.
Now if you could explain to me how using secure connections and showing a correct warning for insecure connections is restricting your freedom that'd be interesting.
Cloud hosting is much more expensive than my current hosting plan. It seems like this is also highly convenient for ISPs that http will be phased out because either way, ISPs make a lot more money out of web site business by the newly required standard.
This is the future we knew was coming, where it becomes so expensive for individuals to do the same as companies do. It's how Radio, TV, and many other things were taken away over the years, it simply became too much of a legal hurdle and way too expensive to run until large companies became the only channel owners.
It's just history repeating itself, but now to shut out individual web site and application makers who don't have resources to compete with big business. :\
I think it can be summed up in one old but very relevant-in-our-times quote: "Those who give up freedom for security deserve neither."
At first, the idea that something is being done "for your safety and security" sounds good, but like all utopian goals, it has deeper connotations that are truly dystopian.
As mentioned in another of the comments here, this is yet another instance of companies using the "more secure" argument to gain control over the masses and ostracise anything they don't like. They're harnessing fear and exploiting it to their advantage.
To give an analogy in the real world, we don't lock ourselves in bulletproof cages and expend great efforts in hiding from others (for the most part), and I'm sure if your car's GPS indicated locations with high crime rates as "not safe" and prevented you from going there, there would be much outrage. We shouldn't let companies and (and try very hard, unfortunately not always succeeding for) governments dictate every detail of how we should live our lives offline, and the same should apply online.
There's a very long tail of sites, many sadly disappearing from Google[1], of old yet extremely useful information, which are probably going to stay HTTP for the forseeable future. I made a comment about this in a previous "HTTP/S debate" article:
https://news.ycombinator.com/item?id=14751540
Fortunately the only good thing that may come of this is that people will just start completely ignoring "not secure".
And I have JS off by default and whitelisted on a very small number of sites, if you were wondering...
[1] https://news.ycombinator.com/item?id=16153840