News for hackers. Stuff that matters.
Re:Retaking the Web Browser, One Small Step at a Time by josephg on Sunday February 09, 2025 @03:20PM (#42993511)
Why? What benefit is there to browsing a package repo over plain http when https is available?

Mitm attacks seem incredibly dangerous in a package repo. Signing only gets you so far - and they probably don’t protect you from downgrade attacks.

Re:Retaking the Web Browser, One Small Step at a Time by ryandrake on Sunday February 09, 2025 @10:12PM (#42996541)
Whether or not there is a benefit should be a judgement left up to the user.

There's no benefit to saving a file on a floppy disk, but if I tell my computer to copy a file to my floppy drive, I don't expect it to say "No, can't do that. You should be using a USB flash drive--they're better in all ways!"

Re:Retaking the Web Browser, One Small Step at a Time by josephg on Monday February 10, 2025 @02:00AM (#42997624)
I'm sure there's plenty of good reasons for wanting to use unencrypted HTTP, just like there's probably plenty of reasons to enjoy using floppy disks.

But I'm asking you: Why do you want to use unencrypted HTTP? Surely there must be some reason you want to do that, right? You (and others) clearly care a lot about this. I'm sure you're not an idiot. Help me understand your point of view here?

Re:Retaking the Web Browser, One Small Step at a Time by ryandrake on Monday February 10, 2025 @10:57AM (#43001718)
In this specific case, it's a crappy IoT device supporting only TLS 1.1. So when my browsers "helpfully" redirect me from the http:// interface to the https:// interface, they then "helpfully" refuse to work because TLS 1.1 is icky and end-of-life and browsers have decided that means "tell the user to fuck off."

At the end of the day, I worked around all of this browser helpfulness by using Firefox and re-enabling TLS 1.1 in Firefox's settings. I never actually managed to force any browser to use http:// despite trying many proposed solutions in this thread and on the web.

But all that aside, it doesn't really matter why I want to use unencrypted HTTP. I am commanding my computer to do it, and I expect it to carry out my command. My computer is a tool. It should do what I want it to do, even if that might hurt me. If I type in sudo rm -rf /usr, I expect it to do what I tell it to do. Not ask "Why do you want to do that?"