Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

And what I am talking about is why.


there are many layers of indirection.

i wouldn't dispute that disabling sslv3 gui prefs in Firefox may have had significant positive impacts on many users or that many users are clueless about crypto in general as it seems you're implying, but it's worth considering that those decisions also have implications that may be convenient for other parties, like dramatically increasing the activation energy to configuring a browser for security.

another example is how long it currently takes to configure via GUI distrusting or at least warning users when Firefox relies on CAs that users from a given country may almost never encounter. should your average Firefox user in the United States always silently trust Turkmenistan's CA out of the box?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: