News for hackers. Stuff that matters.
Re:Chrome 68 will mark all HTTP sites as “not secure” by JoshMnem on Thursday February 08, 2018 @11:43PM (#16337936)
> this assumes we burn stupid shit browsers that look to mangle URL bar by removing data from it

That's just about every browser now. I think that full URLs are only available in Firefox, and only if you set `browser.urlbar.trimURLs` to `false` in about:config. Hiding URL information is a very bad trend.

Re:Chrome 68 will mark all HTTP sites as “not secure” by gmueckl on Friday February 09, 2018 @06:55AM (#16339521)
As it is demonstrated now, the indicators work to show the http part of the URL in a way that relates some of its subtext much better to average users. Now, if it were to stay that way, I would be fine with it. But if past performance is any indicator here, this will be just the first step on that silly warnings spiral. If browser vendors aren't careful, they'll flood users with too many warnings, which makes them ignore them entirely.
Re:Chrome 68 will mark all HTTP sites as “not secure” by SquareWheel on Friday February 09, 2018 @09:53AM (#16340553)
>If browser vendors aren't careful

But they are being careful. This rollout has been taking place slowly over the last two years, and continues to do so.

Changes are incremental to give developers a chance to adapt, and to prevent users from getting used to warnings.

HTTP/2 requires https. New APIs have started requiring https. And only forms with passwords or CC inputs will trigger security warnings. These are incremental steps.

I don't know why people think browser vendors haven't considered this stuff before.

Eventually vendors will start deprecating existing APIs to continue the migration towards requiring https. That will put more heat on developers, but only after they've ignored warnings for literal years.

But even the change announced today is only a UI update to the omnibar. It's hardly earth shattering.

Re:Chrome 68 will mark all HTTP sites as “not secure” by gmueckl on Friday February 09, 2018 @10:57AM (#16341132)
Browser vendors are clearly not careful enough. Requiring SSL brings with it a kind of baggage that is ill-suited for tons of use cases. Do not simply assume that all developers ignored these signs out of laziness. They might instead be unable to comply in a useful fashion.

HTTP worked unchanged for close to 3 decades. People started to rely on that. Now they are trying apply crowbars to force that out. This is myopic.

Re:Chrome 68 will mark all HTTP sites as “not secure” by briandear on Friday February 09, 2018 @02:13AM (#16338500)
You can show full urls in Safari if you want.
Re:Chrome 68 will mark all HTTP sites as “not secure” by JoshMnem on Friday February 09, 2018 @12:15PM (#16341949)
Safari is the worst by default. I don't have any Apple devices, but when I look at screenshots of Safari's URLs, they are not full URLs. Also, it looks like you can't show the full URLs on iPads or iPhones. (You can on Firefox for Android.)

Not a full URL: example.com

Not the full URL: http://example.com (the page will load after completing the URL with a trailing slash)

This is the full URL for the homepage of example.com: http://example.com/

Re:Chrome 68 will mark all HTTP sites as “not secure” by Miredly on Friday February 09, 2018 @07:28AM (#16339687)
also Opera.