Chrome 68 will mark all HTTP sites as “not secure”

Re:Chrome 68 will mark all HTTP sites as “not secure” by PeterisP on Friday February 09, 2018 @02:34AM (#16338563)

A common use case is a device serving a status report as a single simple, static, read-only (i.e. the backend has no intended ability to receive data) html file with limited or no markup. This can reasonably be expected to run for 30 years without an update - there's nothing to update, you have a fixed hardware system showing the same type of numbers to the user until it dies.

Serving this over http in a secure network would be reasonable.

Serving this over https would be reasonable if you can embed a certificate with an appropriate lifetime. Which you can't.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by onion2k on Friday February 09, 2018 @02:56AM (#16338644)

30 years ago browsers didn't exist, so the assumption that in 30 years time they're still going to be compatible with today's servers seems wrong to me. The equivalent would be that you were building this device in 1987 and you embedded a Gopher server on it. It'd still be accessible today but users wouldn't be very happy about how they access it.

As another user said, you own both sides of this problem so write your own client software.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by PeterisP on Friday February 09, 2018 @03:28AM (#16338743)

My browser can show a 26 year old web page (http://info.cern.ch/hypertext/WWW/News/9211.html) just fine, and I have all reasons to assume that it'll be able to do it also after 26 more years.

If I write my own client software, that's far less likely to be the case. Writing your own is exactly the thing that you should avoid if long-term compatibility is important, sticking to open standards is a much better way to do that.

Using your own example illustrates it perfectly: if I had a 30 year old device running a Gopher server, that would be usable and I would easily be able to get a client running on a modern computer/OS - but if it needed 30 year old custom client software, then porting it would likely be a quite nasty project.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by tcd on Friday February 09, 2018 @06:09AM (#16339363)

That example you linked uses absolutely NO CSS or JS! Which yes, is fine and in theory it should work "forever", but any extra functionality and you can't be sure.

Open standards change, software changes and things move on. If you are seriously relying on anything technological working for a decade or more you're out your mind.

You need to keep up and adapt because nobody gives a crap about you or your use case. Here we see Google doing what it thinks best and you need to live with this.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by PeterisP on Friday February 09, 2018 @02:16PM (#16343041)

Of course it doesn't use CSS and JS, none of those existed back in 1992 when the website was made.

However, content using CSS1 and javascript 1.0 standards (1996?) should also work in modern browsers; but I couldn't easily find any sites that actually use them and haven't been updated for the last 20+ years to test it; the sites from e.g. 1997-1999 seem to avoid it like the plague since back then you couldn't rely on CSS1 and javascript 1.0 being properly supported.

So yes, just as modern browsers support all web technologies since their very start - a CSS3 compliant browser should be compatible also with CSS2 and CSS1 (20+years old), I'm quite convinced that 20 years into future when we might have CSS 5 or 6, the current CSS3 content will also work as well. New javascript doesn't work on ancient browsers, but ancient javascript works well in modern browsers, that's a core design principle of the web standards - we build them for compatibility.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by Dylan16807 on Friday February 09, 2018 @03:31AM (#16338749)

> The equivalent would be that you were building this device in 1987 and you embedded a Gopher server on it. It'd still be accessible today but users wouldn't be very happy about how they access it.

By using firefox 56? I'm not seeing the issue.

> As another user said, you own both sides of this problem so write your own client software.

Running 30 year old DOS software is a lot more painful than accessing a Gopher server. Is that really the comparison you want to make?

[ Parent | on HN ]