> > https://... has a security policy called HTTP Strict Transport Security (HSTS), which means that Firefox can only connect to it securely. You can’t add an exception to visit this site.

> That's aggravating. What's the workaround?

Are you aware that you’re possibly being impacted by some kind of MITM attack?

Sounds like their ISP, Vodafone, is MITM-ing them. It's well-reported over the past many years that they do this, though whether its malicious or incompetent is unknown.

I thought this was fairly common?

It is and it's a best practice. I've never heard anyone complain about this.

Most security scanning software will ding any site that doesn't use HSTS

You don't see why Firefox refusing to connect would be annoying? I don't care whether the blog about curl is encrypted in transit or not and I do care about a forced change to chrome to see the content.

I can visit it in Firefox 123 just fine. Tests like [1] say the site works on everything from Firefox 31 to Firefox 73.

You're probably the target of a MITM attack. Or you've done something weird, like taking a job with an employer that MITMs your web traffic then refusing to install their MITM certificates.

[1] https://www.ssllabs.com/ssltest/analyze.html?d=daniel.haxx.s...

I once was talking to somebody who was a brother in law staying on the couch sort of deal.

They were complaining that their battery life on their phone just got decimated recently and kept dying over and over. I believe I was helping to troubleshoot, so I had them turn on airplane mode, he flipped it and complaining of something else annoying happening and saying oh yeah my phone airplane mode doesn't work, I still get internet. I was totally baffled, it was all very weird to me.

A little bit of time later that person got busted as a part of a big local drug bust. I'm assuming that's how they tap phones.

I'm definitely the victim of Vodafone screwing with the connection. They want me to prove my identity by giving them a card number, despite already having that because I pay for the SIM connection, but both their website and their mobile app are so poorly implemented that it's not actually possible to meet that inherently meaningless request.

It seems Firefox notices this and refuses to contact the site, and Chrome notices this and lets me override, but generally I don't see this failure mode. I wonder what is significant about this particular website.

I unsportingly separate work hardware from personal, no idea if my employer's likely MITM nonsense would have the same behaviour.

Learned something today, albeit with details missing. Oh and Vodafone employee if you're reading this? None of your tech works for shit.

Firefox connects to https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobb... fine. Are you connecting to a http:// URL instead? If yes, why?

But it's working just fine in my Firefox, so it sounds more like there's something wrong on your end by either security software or on the network level.

Common misconception, but Https / TLS provides a combination of gaurantees, and the one cannot work without the other:

Encrypted transit but you might be talking with the hacker on the other end == worthless.

And with plaintext transit you cannot prove integrity during transit AND also not prove talking with the proper endpoint.

In short: Browser really is warning you that something is fishy. Don’t shoot the messenger.

I think his complaint is that HSTS also prevents the user from overriding it and Firefox is complying, which I agree is a bit annoying.

Complaining about no overrides is complaining about not being able to ignore quite serious symptoms.

Firefox makes you fix the root problem.

Bingo. Primarily because I don't really mind if reading this post is compromised, but at least partly because I hadn't thought through the implications of vodafone intercepting traffic.

In Chrome you can type `thisisunsafe` to bypass HSTS.

Can I be cheeky and ask what VF service and in what country?

I've been using their CityFibre backed broadband in the UK for about 3 years and really can't complain - £32/month for 900mbit synchronous (which mostly actually lives up) and 4g backup.

I had to call them to remove the "child safe" filters when I first got it, but that's been the case for every ISP or phone provider I've used in the last 20 years. I also run my own DNS which might help, as I've seen others complain about that, but other than those two it's been impressively ignorable.

The 4G mobile service, UK. Chosen based on mast placement. That's the filter that complained under Chrome, Firefox didn't get that far. DNS by Google, nominally, though I wouldn't be shocked if that wasn't configured successfully.

vodafone has been blocking my site daniel.haxx.se for several years.

Discussed on this very site for example back in 2022: https://news.ycombinator.com/item?id=31248250