Chromium Blog: Towards HTTPS by default
Chromium Blog: Towards HTTPS by default
For the past several years, more than 90% of Chrome users' navigations have been to HTTPS sites, across all major platforms. Thankfully, th...
cross-posted from: https://lemmy.world/post/3301227
Chrome will be experimenting with defaulting to https:// if the site supports it, even when an http:// link is used and will warn about downloads from insecure sources for "high-risk files" (example given is an exe). They're also planning on enabling it by default for Incognito Mode and "sites that Chrome knows you typically access over HTTPS".
Don't use chromium based browsers.
Is this just general advice? If so, I agree, but if it's specific to this, what's the problem you see with it?
Google has shown that they're going to go the Microsoft strategy with Browser control. So long as they have majority control, that means they can be as anti-user as they would like, but since everything is downstream of chromium, everyone just basically accepts it. Everything from Google AMP (which was their attempt to take over the web in whole), to their new "Web Integrity API" which aims to lock out any competitors.
It is general advice, but https should have been the default for a good while.
If we have to pick just one reason: WEI. As someone who’s been a professional software engineer for a decade and a half, this has the potential to mutate and ruin the internet at large in ways we’re only beginning to fully explore and understand.
I'll keep using Brave because I like it. Thank you for your concern.
Keep grinding that ax.
I will. It’s sharp now. I will make it sharper.
Chrome didn’t already default to https? Why?
It does if you just type in something like wikipedia.org . This most recent change they're working on is so that a link on a page to:
http://wikipedia.org will get redirected to https://wikipedia.org if the site supports it.
This will fix a bunch of old links that are still floating around on various sites, forums, etc and keep people on https, instead of doing the https -> http -> https redirect bouncing around that can happen now.
Pushing traffic to https isn’t the worst thing. My ask would be to have a toggle to disable due to local development or server deployments where http/port 80 is the only choice.
It does specifically say "defaulting to https:// if the site supports it", so I think specifying http will still work if the site doesn't actually support https.
Got a message back from Https, let's switch!
The message:
"Internal nginx routing error."
No testing a server side http-to-https upgrade/redirect without reconfiguring your browser. This seems like an unnecessary and bad idea.
This could be easily done better by promoting such server-side configurations as a default.
I mean, why should the browser attempt to correct inappropriately configured servers? Shouldn't they rather be making PRs to NGINX/Apache/CAs or whatever?
Also: can't this be exploited to spoof an unavailable HTTPS and coerce an unencrypted connection?
Not touching chromium or chrome. Sworry! Happy with Firefox.
What's the difference between the two?
I'm not sure which thing you're referring to.
If it's between http and https, the s stands for secure and the connection to the server is authenticated and encrypted.
Their Googlebot has been pushing https hard for years. I really don't see the point for mundane sites with no sensitive or controversial content, but there is no way to fight Google so like a good little site operator I go along if I want to be in Google search results.