Browsers are not the internet police, and browser vendors should not be in the business of deciding which server software it wants to talk to.
Flash and other plugins are a completely different thing. Running flash is not a core functionality of the browser. Making HTTP requests and rendering HTML is.
Browser vendors have already inserted themselves into this role by selectively blocking Flash, messing around with how certificates are presented by the browser to imply certain things ("green lock == safe") when no such implication can be made, blocking and/or allowing ad blockers, etc.
Maybe you're too young to remember when everyone had to update their Flash installations every week because that product was improperly sandboxed, so you think that the issue was purely battery related. Blocking and restricting flash is as much about security as battery, more-so in my opinion.
But OK, let's compromise -- rather than preventing connections to Wordpress sites, maybe they could draw a big red line through a picture of the Wordpress logo, and then perhaps warn the user that this site is or soon will be serving malware.
Browser vendors have already inserted themselves into this role by selectively blocking Flash, messing around with how certificates are presented by the browser to imply certain things ("green lock == safe") when no such implication can be made, blocking and/or allowing ad blockers, etc.
If you'd read my reply, you'd see I addressed this point.
Maybe you're too young to remember when everyone had to update their Flash installations every week because that product was improperly sandboxed, so you think that the issue was purely battery related. Blocking and restricting flash is as much about security as battery, more-so in my opinion.
Yes, it is. And again, I addressed this in my post. I suggest reading it and responding to the points made. The key is the core functionality of the browser, of which the plugin API is not.
As for TLS, the CA system is completely broken. I wish we had something better. Given that we don't have anything that squares zooko's triangle that's likely to get uptake today (I don't see namecoin having reached a state where it's ready for large-scale deployment), I wonder what you'd like to do there instead?
The "green lock" EV stuff is clearly a racket. Browser vendors shouldn't put stock in it, but they do. I don't see how that's an argument for refusing to render HTML they don't like.
Comments
Browsers are not the internet police, and browser vendors should not be in the business of deciding which server software it wants to talk to.
Flash and other plugins are a completely different thing. Running flash is not a core functionality of the browser. Making HTTP requests and rendering HTML is.
Browser vendors have already inserted themselves into this role by selectively blocking Flash, messing around with how certificates are presented by the browser to imply certain things ("green lock == safe") when no such implication can be made, blocking and/or allowing ad blockers, etc.
Maybe you're too young to remember when everyone had to update their Flash installations every week because that product was improperly sandboxed, so you think that the issue was purely battery related. Blocking and restricting flash is as much about security as battery, more-so in my opinion.
But OK, let's compromise -- rather than preventing connections to Wordpress sites, maybe they could draw a big red line through a picture of the Wordpress logo, and then perhaps warn the user that this site is or soon will be serving malware.
If you'd read my reply, you'd see I addressed this point.
Yes, it is. And again, I addressed this in my post. I suggest reading it and responding to the points made. The key is the core functionality of the browser, of which the plugin API is not.
As for TLS, the CA system is completely broken. I wish we had something better. Given that we don't have anything that squares zooko's triangle that's likely to get uptake today (I don't see namecoin having reached a state where it's ready for large-scale deployment), I wonder what you'd like to do there instead?
The "green lock" EV stuff is clearly a racket. Browser vendors shouldn't put stock in it, but they do. I don't see how that's an argument for refusing to render HTML they don't like.