Mailinglist Archive: opensuse (1355 mails)

< Previous Next >
[opensuse] Re: opensuse mailing list site ridiculousness
Knurpht@openSUSE wrote:
So tell me why everyone is kissing google's behind
again?
Linda, please read Per's reply and the first bit of the thread. This isn't about Google, or whatever, it's about someone with a 13.1 install complaining about websites not working ( browser outdated ), and that lists.opensuse.org could very well do without SSL ( to keep working with an outdated browser ).
One of the reasons that SSL is forced on most websites is that without this it would cause that Google ( most used, whether we like it or not ) and other search engines wouldn't index the site.
---
One of the reasons I point this out is that I don't believe it
and it's not true.

Most of the web was not encrypted 5-10 years ago and google indexed
them. Just because google wants https to protect their adstream, doesn't mean
that at some point in time they will STOP indexing sites that don't
use https. They'd be shooting themselves in the foot. They WANT to index
everything -- and that includes http and ftp sites. So please don't use google as an excuse for forcing on encryption. There's no need for it for most things. No one is forcing encryption on people.


Plus, EU governments acticvely teach their citizens *not* to trust http:// sites.
---
I've never heard that. Do you have a source for it? Furthermore,
I don't believe it in regards to non-sensitive data.


The fact that browsers have developed new features that make me aware, f.e. that some https page redirects me to an http page? That all up to date browsers warn my dad for not trusting an http site. I'll thank all involved for making stuff like that.
---
I've not encountered any such broken browsers -- vs. if you send
DATA to them (i.e. submit text to them), then I've seen warnings that your
text is not encrypted. That's very different from pure "browsing".

I've also seen many sites that use https for passwords but http
for non sensitive data.



I don't see this as google kissing. AFAICT Google was just an example.
---
But it is google kissing. Google has been the one pushing for
it -- but it's not needed for most things. They want it to make sure
their ads get through/can't be filtered except, maybe, at the browser --
which they also control if you use chrome.

Now, since everything is encrypted, NOTHING is particularly
safer or more sensitive. My bank and finances go through the same
decrypting proxy as text on slashdot. If I don't put in exceptions
for sensitive web sites, they automatically get decrypted now -- because
thats what the new standard that google has given us.

It's less safe than it used to be -- anyone who wants to monitor
traffic now finds a way to decrypt -- because if they don't they will have
nothing.
Vs. 10 years ago, they'd have 90+% of the traffic, and the rest they'd have the
website (finance, maybe medical) name and know that it was probably "boring"
and not worth decrypting for monitoring network connections for usage that
goes against policies.

Thank-you google for making the need for decryption a standard
such that even I go through the trouble so I can continue to cache
traffic.

I have a not super-fast connection. So I have always supplemented it
with a large cache. Sometimes works better, sometimes not. But overall,
10-30% of my traffic can come from a cache.
Right now(looking at recent activity):

squidstats
Hits/Total Bytes/Total mem: 28% (367/1287) 27% (14M/52M) dsk: 3% (40/1287) 0% (202K/52M) tot: 31% (407/1287) 27% (15M/52M)
Cacheable traffic had slowly dropped off, but w/google pushing
for everything encrypted, it made sense to use a decrypting proxy. Now,
while long term (disk) usage is still down (in the past I've gotten 700+MB images out of my disk cache 2-3 months later when I'd
forgotten I already downloaded an ISO -- but the cache still had it).
But short term use is still reasonable.

So people can give excuses like google...but they will never
stop indexing -- it would go against what they do.

BTW, if you want proof, I looked up words:
atkmm1_6-doc-2.24.2-2.1.noarch.rpm 08-Mar-2018 542K

It picked up this unencrypted website:
"http://www.nic.funet.fi/index/opensuse/tumbleweed/repo/oss/noarch/";

It's not the only one.

You may think I'm talking "off topic"...but I'm not. There's
no reason for such security on a public web-copy of a email list,
nor a distro-download site (that does have other methods of
guaranteeing integrity).

Cheers!
:-)










--
To unsubscribe, e-mail: opensuse+unsubscribe@xxxxxxxxxxxx
To contact the owner, e-mail: opensuse+owner@xxxxxxxxxxxx

< Previous Next >