back
143 comments
This is the kind of sunset you love to see. Retirement because they succeeded and therefore became redundant, rather than due to failure. If there's one organization I love to see succeed, it's the EFF.
Eh, kind of. It's successful as far as the Internet, which is great. But Internet web pages isn't everything.

There's still a real issue with infrastructre that has web configuration. Everything from home routers to video cameras and so on. Not being able to ship with a certificate that passes browser security checks is a problem that essentially nobody has addressed.

When people connect to an IOT device, they need to be able to connect with a web browser and not jump through hoops to say, "No, really I know that this is a secure connection." Because we can't keep teaching people to dodge secure connections when they should care about having secure connectinos. As much as I don't like IOT, but this is an issue that needs to be easier than "understand cyrptography configuration, generate your own keys, and install them wherever you need them".

That's all besides the vendor "solution" of "install this phone app that will maybe barely work except for the parts that track your data forever LOL thx sucker".

Right, but that's not HTTPS Everywhere.

HTTPS Everywhere was "this site already has HTTPS, and really should only use that, but doesn't, so we'll redirect you to the HTTPS version". Now sites that have HTTPS default to it, and browsers have options to basically try https first and see if it works.

Couldn't browsers just designate the .local tld to not check for SSL certs and enforce that it resolves to an IP on the current network? Seems like a simple solution for this.
It's security theater, it's not meant to solve real problems for real people.
Not entirely.

They don't provide an alternative to "HTTPS Everywhere User Rules" as well as adding exceptions to HTTPS only sites (under "HTTPS Everywhere Sites Disabled"), which can be found in HTTPS Everywhere options.

In Chromium I can only turn HTTPS on all sites, without exception. It also doesn't allow me to have mixed content (on certain sites)

Well Firefox has also exceptions.
Plus:

* Long sunset period

* Instructions to make sure you can enjoy the same security after they sunset

That’s how I used to feel until I found out they accepted millions in donations from companies like Google and Facebook/their executives/their executives’ charities.

I’m just some guy on the Internet but IMHO their being OK with massive conflicts of interest means I no longer trust them.

Would you turn down millions of dollars in no-strings-attached donations if you were running a charity? What was the negative result of those donations that you can point to?

I'm not a fan of Google or Facebook, but I also don't outright boycott everything that they've ever touched. They donate money and developer time to tons of projects that I use regularly (including Linux), and it would be hypocritical of me to look down on the EFF for benefiting from the companies that I also benefit from.

I don't like the bad behavior from Google or Facebook, but I don't think donating millions to the EFF is bad behavior, nor do I think getting tens of thousands of pull requests merged into public FOSS projects from Google and Facebook employees is bad behavior. Black and white guilt-by-association doesn't work when you have companies of this size, with hundreds of thousands of employees, and tons of varying internal cultures.

What would you have them do? Not accept those donations, and be unable to work on as wide a range of issues that they do?

EFF works on a wide range of issues, ranging from anti-censorship, software patent reform, online free speech, just to name a few. Many of those areas are where their values align with those of the Facebook/Google executives which donate to them. That they are able to receive those donations in spite of the areas where they disagree speaks more to EFF's track record of being an effective and powerful force for good in tech.

Serious question: is there a popular charity that by rule doesn't accept donations from really rich people?
Then nut up and donate the millions yourself.
It doesn't seem to be mentioned by the EFF, but coincidentally, January 2023 is when Manifest v2 extensions stop working in Google Chrome: https://developer.chrome.com/blog/mv2-transition/
And its going to be a very big moment, since V3 effectively bans Adblockers and website redirect extensions.

It might increase Firefox adoption if it actually happens.

- bans adblockers that use their own matching engine

- bans website redirect extensions that can't use declarativeNetRequest action.redirect https://stackoverflow.com/a/66394857/3878893

You do realize Firefox is going to V3 as well?
There's a piece of animation software that I use in my game development called Spine, and it's truly fantastic and the developers and staff are great... but the PHPBB forums don't have https enabled. I've brought it up on these same forums[0] but I don't think they get why https is an important thing to turn on, even in 2022.

Turning on https mode in my browser brings up, as it should, a large error message saying that the site is insecure. I can't imagine that's a terribly good first impression, even though, again, Spine is one of the best animation packages out there.

[0] - http://esotericsoftware.com/forum/HTTPS-for-EsotericSoftware...

Not only do the forums have HTTPS disabled, but they expect you to download executables to run on your computer over HTTP. And, the kicker: they already have a legit HTTPS cert for the entire site: visiting on HTTPS redirects you to HTTP _facepalm_.

Never heard of Spine before your comment, but if I found this in the wild I'd assume it was amateur hour and turn back immediately.

A slight correction here, the download of the exe does take place over https. As does buying the software, and signing up to the forums. But everything else doesn't?

The software itself is some of the smoothest and most stable I've ever used. And when there's an update within the software that, as far as I'm aware, takes place over https too.

But the rest of the site and forums, even when signed in, is http, and I don't really know why.

> Turning on https mode in my browser brings up, as it should, a large error message saying that the site is insecure. I can't imagine that's a terribly good first impression, even though, again, Spine is one of the best animation packages out there.

A site being on HTTP isn't necessarily insecure. That warning is inaccurate. It's more about creating censors and gatekeepers in the form of certificate authorities.

(Debian packages are still served over HTTP and are secure with no certificate authority. Try to figure that out!)

Debian packages are verified via a separate mechanism after download. The only verification method included in your web browser is HTTPS.
Debian ships with its own signing keys to authenticate the packages that it downloads. They are acting as their own CA.

This isn't scalable to the web.

> A site being on HTTP isn't necessarily insecure. That warning is inaccurate.

The actual semantics of HTTP are very surprising to humans and this is a problem.

We have a whole bunch of systems - including some that are key to making HTTPS work such as OCSP, which rely on plain HTTP but those systems know about its semantics and account for them in how they work while ordinary users do not and shouldn't be expected to learn.

HTTPS delivers much closer to the semantics people actually expect, with the remaining exception being that people are often surprised that McDonalds.phishing.example isn't necessarily anything to do with McDonalds.

That was a good extension for a specific time. I stopped using it about 5 years ago when everyone had been pushing HTTPS hard, and Let's Encrypt had become popular. I didn't notice any websites not using HTTPS, so I didn't look back.
http://neverssl.com remains for those badly-setup wifi networks.
Or alternatively http://httpforever.com/
Similar to HTTPS-only being built into web browsers, isn't captive portal detection built into all modern OSes? What's the badly-setup wifi network that requires you to open your browser but doesn't get detected properly by the OS as a captive portal?
It's funny that if I navigate to this site with HTTPS-only mode, it redirects to an HTTPS page.
There are still places that don't auto-redirect to https for some reason. Maybe a temporary misconfiguration. I just ran into http://www.mbsonline.gov.au today and was surprised it didn't redirect and has broken https, even though that org really shouldn't do that.
I've been using HTTPS-only mode on Firefox for many months now. The place where I see HTTP links most often is email tracking links. I'm commonly automatically upgraded to HTTPS and it works but very often there is no HTTPS support at all. Even for sensitive things like password resets that have secret tokens in the URL.
One website not supporting HTTPS which caught my eye is http://paulgraham.com/
I'm surprised by the number of German websites (.de) I've encountered this year that don't support HTTPS. I think they're all small businesses or personal sites, but still unexpected.
Whew, for a sec I confused HTTPS Everywhere with Let’s Encrypt! I’m glad Let’s Encrypt isn’t going anywhere :)
Noob question: If I have a personal HTTP website running out of GCP cloud storage (without the load balancer, bells & whistles), is it possible to upgrade it to HTTPS so that visitors don't get warnings
Looks like you can either do this by referencing static pages with HTTPS directly or by putting a load balancer in front of your site:

https://cloud.google.com/storage/docs/troubleshooting#https

My shared hosting provider (Cooini) gives an HTTPS option out of the box. It used to be a paid option that required upgrading to dedicated hosting, but they changed it years ago to a simple cost-free toggle in their dashboard

Interesting. Just a couple hours ago, I was reading their post (2016) on how they were sunsetting their canary watch program, saying that it had achieved the goals they had set out on for it (internally, my knee-jerk reaction was "...what?").

Of course, I'm not as incredulous this time around over HTTPS Everywhere.

https://www.eff.org/deeplinks/2016/05/canary-watch-one-year-...

Great news. Now the only required extensions are an ad blocker, tamper monkey, no script, multi-account containers, container proxy, tree style tabs and auto tab discard.
Great job on this. The sunset in this case means it worked. Everyone benefits from the work done here and will continue to do so. Love to see it!
Is https enough or do we also need hsts? And how does QUIC fit into all of this?
Pretty much all browsers will try HTTPS first if you type a URL without a protocol. HSTS only practically helps in the case where you have URLs that have the wrong protocol.

QUIC and H2 are both always encrypted. But since quic is purely supplemental at this point, it really doesn't factor into anything relevant here.

Now, if only we could become better at securely managing keys.
Can we also sunset animated GIFs, while we’re at it?
I think it still has value. A lot of sites have https but users or resource-fetch from them over http is still not redirected to https.

If the internet is navigable while blocking plain http on your host firewall, then we don't need this. But I do get it takes time and resources to maintain their list.

The article talks about how to get this HTTPS by default functionality in all major browsers. I don't see how your complaint about not being redirected to HTTPS is relevant with those settings enabled.
HTTPS Everywhere being available in browsers as an option is great. HTTPS Everywhere being promoted as something you should have on by default is bad. HTTPS, like much else, relies on incorporated entities as certificate authorities. And that's fine for commercial interactions and if browsers were only for interacting with businesses.

But by a combination of centralization in a few CAs (everyone uses LetsEncrypt now) and browsers shipping HTTPS only we are now entering an age when you can only host a visitable website on the continued temporary whim of some external corporation. LE may be a benign dictator for now, just like dot Org was, but the more people that use it and the more centralized it becomes in all interactions the greater pressures will be put on it re: corruption from within and political attack from without to allow some but not others.

HTTP only is okay. HTTP+HTTPS is great. HTTPS-only is the end of the web for human persons and the beginning of the commercial only web.

HTTP is not ok. Anyone can ready / modify what is being sent. This privacy intrusion will definitely happen, whereas the risk of being banned by "some external corporation" is low. And, you always have the option of self-signing your own certificate, which is at least as secure as using HTTP, and much more secure if you can verify the certificate via a side channel.
Again and again, even supposedly smart people are fine when what a dictator claims aligns with what they think is good while handwaving the long term issues of giving up control and power to them.

Especially around security where techies have a tendency to shut down their brains whenever it is brought up, as if in the name of security everything else should be compromised.