News for hackers. Stuff that matters.

A comment on Chrome 68 will mark all HTTP sites as “not secure”. Parent comment

Re:Chrome 68 will mark all HTTP sites as “not secure” by phicoh on Friday February 09, 2018 @10:33AM (#16340871)
People can administrate their personal enclaves as they see fit. There are a number of operating systems that you can rebuild from source. You can just create your own root CA and add it to your browsers. You can run your own root DNS zone.

Most people have no clue about computer security and don't want to get one. Tomorrow's grandmas will know as little about how their computers are attacked as today's grandmas.

And they don't want to know. They want technology that is safe to use.

We know from experience that a network where devices trust each other is a disaster waiting to happen. So let's kill that model. All devices have to survive in the open internet. Because if they don't, somebody will figure a way to attack them.

[ Parent | on HN ]
Re:Chrome 68 will mark all HTTP sites as “not secure” by dcow on Friday February 09, 2018 @11:42PM (#16345930)
I think we're talking past each other at this point. I want security both globally and locally. I want to be able to tell my browser who it should trust and what level of paranoid it should be in each context. If I go through the work of recompiling a bunch of software with custom trust anchors, I don't want it to all be for naught because in the last mile my browser says "I'm lost I only understand global TLS".

I LOVE the idea of NAT-less global internet. It's why I love IPv6. At that level anything that wants to participate should be secure and "go Chrome" for leading the charge. I even think firewalls for global IPv6 are stupid. If you're global you're global no amount of silly packet filtering rules is gonna change that.

But that's not the end all. I don't want my entire house to stop working because I got a new ISP and I have a few days of down time. Or more like because my ISP went down because they oversell bandwidth and haven't updated their routing hardware in 15 years. Maybe I don't want my file server with all my family photos globally addressable. Maybe I don't want my kids on the global internet at certain times. The point is I know what's best for my house. Im sick of the old IPv4 mindset where the only reasonable model is centralized global trust (see we agree that's been the status quo).

[ Parent | on HN ]