I'm not talking about how difficult it is to set up a proxy. I meant that getting someone else's computer to accept a rogue root CA is a big deal, so saying an attack "only" needs that to happen is misleading.

I guess I misunderstood.

> getting someone else's computer to accept a rogue root CA is a big deal

IMO not necessarily. See this part of what I said:

> telling their users to trust a certificate signed by them, without properly explaining the consequences of that. And a lot of novice users would likely use that proxy service. Gleefully unaware that even the “encrypted” traffic is completely visible to the proxy.

But in addition to that, note that where I was using the word “only” was specifically in the part of my comment where I was talking about how I set up Squid for myself using my own Raspberry Pi and my own personal computer.

>Just because someone does not know how to do something does not mean it is difficult. It just means they did not try to learn how to do it. This is very common comment on HN. It's quite silly.

Honestly, whats even more common and more silly are these kinds of comments:

"blah blah blah its easy, i did it blah blah i don't understand the problem"

Ever consider that other people are somehow different than you? Have different strengths, weaknesses and abilities? Have different needs from software? It's like, why do we even make software, you could just learn binary duh.

Every user is different. But software developers commenting on HN like to assume one size fits all. Perhaps this makes sense if they are getting paid from advertising. If every user is doing something different instead of all looking at the same website, using the same app, watching the same video, repeating the same meme, using the same few browsers on the same few operating systems, etc., then advertisers are less interested in throwing money away on "advertising services" from so-called "tech" companies.