More generally, Dave Winer seems to have an attitude of reflexively opposing everything that Google advocates, merely because it is Google that is advocating for it. It reminds me of the late 90's and early 2000's when open-source people talked about "M$" and reflexively opposed everything that Microsoft did merely because it was Microsoft that was doing it, leaving aside technical merits or other considerations.
Corporations are neither pure good, nor pure evil. They are collections of people with collective interests that they pursue. Sometimes, like in the case of HTTPS, or net neutrality, those interests align with our interests as developers and users. In those cases, we should ally ourselves with corporations and use their leverage to effect change more quickly. In other cases, such as with RSS, and vendor lock-in, our interests diverge and we should oppose them with all our might so that we don't lose the free and open Internet that we've become accustomed to.
In both cases, however, we should examine the issue on the merits of that issue, and neither support nor oppose merely because the "right" or "wrong" organization is pushing for it.
The problem is that Google controls the most popular interfaces to consuming HTTP and HTTPS, i.e. their Chrome browser and their search engine. And so Google is in a position where they control how these protocols are consumed, which is the crux of Dave's argument. Google is already discouraging the use of HTTP through warning messages in Chrome and by adjusting search rank algorithms for HTTP sites. Dave's concern is that Google will "turn off" HTTP access in the same way they did with RSS after capturing the market share for consuming RSS feeds and then shutting down Google Reader and removing discoverabilty of RSS feeds in Chrome.
Dave Winer has been around the Web for longer than most and you'd be foolish to write him off as a curmudgeon. Dave is to the open Web what RMS is to FOSS.
Now, Dave acknowledges this: "They tell us to worry about man-in-the-middle attacks that might modify content, but fail to mention that they can do it in the browser, even if you use a 'secure' protocol."
The rhetorical slip here is bad. "They" is me. I say you should worry about man-in-the-middle attacks. I can't "do it in the browser." He keeps doing this; he's acting like Google is the only entity that thinks the move is a good idea.
It also fails to acknowledge that partial solutions matter! What, I should give up on putting locks on my door just because the lock manufacturer can go right through them? Further, right now I have a choice of three plausible browsers, and I can switch between them freely. There's a significant difference between the danger of man-in-the-middle attacks and the danger of a browser level attack. (Both pretty low, to be fair, but still.)
And that's just the concern about attacks. Tracking is a whole additional issue that he doesn't acknowledge.
So, yeah, he makes some good points. But since he won't engage in discussion on the topic, they're not useful and they get drowned out by the noise.
This is a great analogy!
The open web is worth fighting for. And Google is moving into new territory now, by deciding to force sites to switch to HTTPS. Most of the arguments you hear are about new sites, but people are missing that the web has been used for 25 years as an archiving medium. If you want to save something so it's available for others (and yourself too) in the future, put it on the web. It's been incredibly stable platform, far more so than the ones run by the tech industry, and precisely because it isn't run by the tech industry.
That's about to change.
Read the original post. Today's post is just a continuation of that one.
http://this.how/googleAndHttp/
And be a little more kind to Stallman. :-)
Dave
> Something bad could happen to my pages in transit from a server to the user's web browser.
This already happens. Verizon injects tracking cookies into unencrypted requests [1]. Hotels inject advertising on top of the existing advertising [personal experience]. They will do it when I read your blog archive from 2001. They will inject arbitrary JavaScript that records my every keystroke and mouse movement [2]. State actors will use persistent surveillance of all unencrypted cookies to pierce firewalls and target individual engineers in charge of anything they happen to find useful [3]. They will do worse things as compute becomes cheaper and cheaper.
If your argument is that there are lots of HTTP sites that are historically important and also that are unmaintained and that will never be upgraded, okay. That is a solvable technical problem [4].
If you want to know why you have to force people to do it, it is because security is a public health issue [5]. It is the same reason you have to force people to get vaccinations.
I don't work for Google (in fact I work for a direct competitor), and I disagree with a lot of the things that they do or want to do (unsurprisingly). But having more security on the web is not one of them. We live in a very different world than we did 25-plus years ago.
[1] https://www.eff.org/deeplinks/2014/11/verizon-x-uidh
[2] https://www.wired.com/story/the-dark-side-of-replay-sessions...
[3] https://theintercept.com/2014/12/13/belgacom-hack-gchq-insid... (search for MUTANT BROTH)
[5] https://www.schneier.com/blog/archives/2014/03/security_as_a...
We need maybe proxies as close to the origin servers as possible, to minimize the amount of traffic passing over insecure links. That seems like a political nightmare, but...
https://addons.mozilla.org/en-US/firefox/addon/resurrect-pag...
Of course, the whole point of this article is that centralisation of important resources is risky. Archive.org is an essential resource, and it's really far too important to be at the sole mercy of the of the Internet Archive organisation, well meaning and admirable in every way though they are.
>"In both cases, however, we should examine the issue on the merits of that issue, and neither support nor oppose merely because the "right" or "wrong" organization is pushing for it."
You're missing the point. In the article you're referring to Dave says "Google is a guest on the web, as we all are. Guests don't make the rules."
He's not advocating against HTTPS. He's advocating against Google pushing it down everyone's throat as the proprietor of the internet. And he's right in that if we allow Google to declare themselves the harbinger of digital trends then we're authorizing them to take it another step further. We're essentially endorsing the next stage, which would be to simply block http from Chrome or Android or whatever they feel like.
He goes on to state "If HTTPS is such a great idea... Why force people to do it? This suggests that the main benefit is for Google, not for people who own the content. If it were such a pressing problem we'd do it because we want to, not because we're being forced to."
He's right again. He isn't saying HTTPS is bad for the internet. He's saying letting Google decide in a vacuum that HTTPS should be the only way to internet is bad.
I use far too much Google stuff. I'm on GMail. I use Chrome. I am a Node developer which uses their V8 implementation of JavaScript. I hate it but I mostly use Google for search, habits die hard. It will be a huge pain to me if I have to fall back from using Google. I criticize them because I do use their products. When I stop, you can be pretty sure I will also stop writing about them.
The alternatives exist and I recommend using them. This is coming to you via Chrome and Android, but elsewhere I rely on Linux ans MacOS, as well as Firefox and increasingly text-based browsers. (I'm special, I know.)
Protonmail and DuckDuckGo are each quite good. I am divesting mysself of other digital services generally.
As for networks, technology, monopoly, and power, I'm seeing them as increasingly tightly interrelated. Look up Jules Dupuit and his work on rail fares (and classes) and bridge tolls, among others.
Why? Aren't Firefox and DuckDuckGo two straightforward alternatives you could use right now? Switching to both of those would reduce your dependency on Google and be relatively pain free transitions.
In theory but not practice, let’s not be naive. Corporations end up serving the purpose of their owners (shareholders) which is to generate maximum profit. That objective causes the corporation to commonly behave much closer to pure evil on your scale (to generate the profit).
Which are (gasp) still collections of people! What's naive is treating a corporation like a single individual with a single identify and set of known traits. That's just plain silly.
I'd suggest that Google has done more for the Web than any other organization in the 21st century: Google, Gmail, Chrome, Docs.
Nearly single-handedly, Google made the web useful to more than hobbiests and for more than single about me pages.
http://this.how/googleAndHttp/
which criticizes Google's support for replacing HTTP with HTTPS. (As someone working on this issue from the opposite side from Dave Winer, I can confirm that Google's support has been incredibly consequential at every moment and at every level in HTTPS adoption.)
Yes. See the section titled 'Arguments against securing the web'.
The points that Winer has made are more subtle than this. Any convincing rebuttal would be more subtle. That title is if anything less subtle. If there were a point at that link that was actually responsive to Winer, I presume you would have quoted it.
If you scroll down the article by Scott Helme, you can see that he does respond to Winer specifically. Here is the link with a fragment that goes to that section of the article:
https://scotthelme.co.uk/https-anti-vaxxers/#davewiner
Since you asked for a quote, here it is:
> It's pretty easy to see that Dave's problem really is with Google here and I disagree with this on many fronts. First, ...
(Read the article to see the rest to avoid copying the whole thing.)
Since you insisted, I clicked through, and read until I got to this gem:
Google has never said they're going to deprecate HTTP, the only things that have been said are around changing visual indicators for HTTP and HTTPS in the browser...
Perhaps the word "deprecate" has some idiosyncratic personal meaning for this yokel. I've seen the over-the-top warnings Google came up with for valid self-signed certificates, and their warnings for no certificate at all won't be much relaxed in comparison. The most popular browser loudly insisting that users never go to non-TLS sites would certainly be a deprecation.
Kudos for keeping the thread alive, though...
Maybe he shouldn't have launched an incomprehensible crusade against widespread SSL deployment in a post-Snowden world?
I'd describe Dave Winer as more of an iconoclast than a crank, from what I've seen. But his point is that an awful lot of the Web As It Exists is unsecured, particularly the older personal pages and sites that are still hanging on, and that if Google decides that Chrome will simply no longer browse to unsecured web sites -- or worse, that their search engine won't just deprioritize but will delist unsecured sites -- a lot of the web will be effectively lost.
I agree that from your perspective, you might see no benefit, but the HTTPS push is primarily for the users (and as a result, the web at large).
So the more Google does for the web the more dangerous they become. Should Google then start fighting the open web? Would that make the web... better?
Google's power over the web today, already, is not healthy. There are a lot of people within Google who care deeply about the free and open web, and a lot of people who don't, or who define "free" or "open" in ways that involving trusting a for-profit corporation more than anybody wise ever should. Many people get upset when they see Google being attacked, because the part of Google they depend on is a part that really supports the free and open web, or because they themselves don't value the freeness and openness as much as they should.
Google delivers a lot of value right now, and without people pushing back, hard, that value will enable them to get away with anything.
Anybody who has been around long enough ought to understand that power you grant to someone you trust inevitably ends up in the hands of someone you don't. Political parties switch back and forth, CEOs and corporate priorities come and go. Sometimes it's best to accept an option that is second-best today in order to avoid giving too much power to the organization providing the first-best for them to misuse tomorrow.