Re: Draft finding - "Transitioning the Web to HTTPS"

* Chris Palmer wrote:
>On Tue, Dec 9, 2014 at 1:23 PM, Bjoern Hoehrmann <derhoermi@gmx.net> wrote:
>
>> It is actually quite common that you cannot install certificates and do
>
>I'm interested in this. When does that happen? I would really like for
>the owner of a device to be able to control the device's trust anchor
>store.

I believe devices running older versions of Android are an example. By
the looks of it, contemporary gaming consoles might be another. It's
also unlikely, when such functionality is offered, that it affects any
and all connections from the device; for instance, privileged software
running on it might perform additional checks for software updates.

>> not have debugging tools available, or would not be able to rely on them

>> because their use is detectable.
>
>Detectable by whom...? I generally know when I am using the developer console.

Mark's example was researchers studying computer systems. If computer
systems behave differently depending on whether they are being studied,
such research can be rather complicated. This can happen accidentally,
but also deliberately as part of copy protection, anti-cheat, or other
obfuscation schemes.

>> Considering that heteronomous computing
>> is being made a fundamental part of the Web, it seems very unlikely that
>> the TAG would agree that users have a right to know what their computers
>> do and what data they send and receive.
>
>Users *absolutely do* have a right to know what their computers do,
>and what data they send and receive.

I have seen too many people threatened to be banned from W3C mailing
lists without due process for voicing such an opinion that I am not
comfortable to comment on that. In any case, it should be clear that
the Chair of the TAG very strongly disagrees.
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
D-10243 Berlin · PGP Pub. KeyID: 0xA4357E78 · http://www.bjoernsworld.de
 Available for hire in Berlin (early 2015)  · http://www.websitedev.de/

Received on Tuesday, 9 December 2014 23:54:18 UTC