When Mozilla's Fanatics Make Us All Look Bad
http://lauren.vortex.com/archive/001099.html
One of the recurring problems we face as technologists is accusations
that we are out of touch with the sorts of issues and problems that
affect most people. We're accused of pushing through changes without
taking into account the reality of the costs and collateral damage
that will be triggered, and basically of being downright arrogant
toward the world at large.
Unfortunately, such complaints are not wholly without merit, and one
need look no further than current discussions on a major Mozilla
development mailing list to understand why.
You know Mozilla, of course -- the custodians of the Firefox browser.
The same firm that stole a bundle of perfectly happy Google Search
users to hand over to Yahoo under the terms of a lucrative new
business deal.
Right, that Mozilla.
Well, if you run an older, legacy website that hasn't had the money,
time, technical ability, or other resources necessary to convert over
to encrypted https connections, it appears that Mozilla is talking
about a little surprise for you.
Looks like they may want to shut you down.
Now, one would be hard-pressed to find a more outspoken proponent of
opportunistic encryption than I am -- I've been boosting the concept
for ages. In fact, years ago I wrote a piece entitled "http: Must
Die!"
However, in the time since then, it's become ever more clear that
trying to force sites into the increasingly corrupt and dysfunctional
existing SSL/TLS certificate infrastructure would grossly disserve
many legacy sites, especially smaller ones with extremely limited
resources available.
I have long been an advocate of leveraging self-signed certificates --
yes, despite their known limitations -- as an interim step toward a
new, more practical opportunistic crypto infrastructure -- but this
obviously takes significant time even in the best of circumstances.
But whatever specific technological path is taken, a foundational
requirement should be using the carrot and not the stick to help
encourage these transitions.
And while Mozilla is by no means the only firm that can be accurately
accused of using rather hard-edged "we know better so just shut up or
get left behind, losers!" approaches, the folks over at Mozilla are
really sharpening up the javelins and charging up the cattle prods.
What they're discussing for Firefox is turning off unencrypted http
support. You're not able to run encrypted https? Too bad, Firefox
users won't be able to access your sites. Or perhaps for a while
they'll just get a big red warning telling would-be visitors that
you're subhuman slime who just doesn't care about security.
Plus -- you guessed it -- it seems that they'd like to make this an
Internet standard so you'd effectively have no escape regardless of
which browser was in use.
As someone who has long advocated the righteousness of fully-encrypted
Internet communications, I find the attitude being expressed over at
Mozilla to be infuriating, because while the end goal is laudable, the
approach is indeed arrogant and almost religious in its fervor, and in
its refusal to acknowledge the problems with which the "little guys"
on the Net have to deal with every day.
For all the talk of supposedly "automatic" ways to convert sites to
https, and the availability of so-called "free" security certificates,
the bottom line is that many legacy sites are simply unable to devote
the resources necessary to undergo such conversions and maintain them.
Many of these sites have been providing reference materials for many
years that -- frankly -- are not of the sort where communications
security can realistically be seen as a priority matter.
Now, if Mozilla is willing to establish a cadre of bonded and insured
site design experts willing to perform https conversions for such
sites without charge, and help maintain them forevermore, well, I'd
certainly be interested in having that conversation. That's using the
carrot approach I mentioned earlier.
On the other hand, plans to try use those sharp sticks and prods to
try bully these sites into the https camp like cattle -- well, if you
think the world has a mixed view of technologists now, if Mozilla gets
its way we'll end up with a positive rating on par with politicians --
if we're lucky.
I very much want to see an Internet where all communications are
securely encrypted, but only if it's done the right way, with sites
and users treated as valued partners with a full understanding of
their resource constraints and sensibilities -- and not as "losers" to
be treated with what amounts fundamentally to arrogant contempt.
Be seeing you.
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
nnsquad mailing list
http://lists.nnsquad.org/mailman/listinfo/nnsquad
