Notices by Rysiekúr Memesson (rysiek@mastodon.social), page 26

Current status: Inbox from Hell. https://mastodon.social/media/P356F2DeZmnzkvlxVl4

@cypnk this is how I respond to e-mail sometimes... :/

@pony but if you have some other constructive ideas how to get website admins to get their heads out of their arses and roll out HTTPS, please share.

@pony still, most admins are solving it by rolling out HTTPS. the way I know is because the percentage of HTTPS sites is steadily growing. So, there's that.

@pony complain to the damn admin. That's an indirect way of putting pressure on site admins. And apparently pressure is dearly needed.

You don't want your inputs bastardized? Fine! Roll-out HTTPS.

@pony how is it a bad thing? How is sending credentials via pure HTTP a sane idea?

@thomas @MichaelBall @killerdicke I mean honestly, if your controller is too weak to do HTTPS, it is too weak to handle anything even remotely sensitive.

@killerdicke @MichaelBall @thomas you're telling me that this is an issue in 2017? Come on we have *phones in our pockets* that have 8 cores and 4GiB of RAM!

Upgrade your damn controllers.

@pony they mean that you either have to roll out HTTPS or fake them.

Since the amount of work to do the former is going down, more and more people will decide to roll-out HTTPS instead of doing a stupid.

@bram I hear you...

@pony they are not inherently meaningless. They *are* effective in pushing people to implement HTTPS.

Some people will always choose to do a stupid, and that's it.

Found in #IRC:

"apparently people are getting around Chrome and Firefox telling everyone that non-HTTPS password fields are 'not secure' by just using regular text fields. they change the font on the text field to 'text-security-disc', which is apparently a font that exists of all bullets and looks just like traditional password fields."

How about instead of investing time and effort into schemes like these, you just ROLL OUT #HTTPS FOR FSCK'S SAKE!

#InfoSec #DevOps #SysAdmin