German Geek wrote:
well httpus seems like a good idea though. Thats the kind of response i was hoping for. :-) Maybe browsers would implement that idea in the future. I like that idea a lot actually. I mean when you login to your linux server the first time with openssh, you also have to accept the certificate. In the end you have to trust something somewhere anyway, even if it's just the programmers of the browser and other software...
If your server is remote, yes, the very first time you have to accept the public key. After that you can pass the key to other hosts you plan to log in.
I mean who seriously looks through all the source code of the linux kernel even though it is open source?
A lot of people do. That's how potential exploits are found.
And even if someone does it (good on them), do they understand every single line? A back door could be just a few lines of hard to understand code, that you might skip. It could even be encrypted and assembly making it very hard to decipher. Who has that much time and brains?
kernel engineer. The NSA. Etc.
With windows you have to trust M$ even more because you cannot even look, and i seriously doubt anyone can disassemble the whole windows OS and read the code. They would not finish in this life time, not even through 50MB of source code i believe. That's a lot!
At least parts of the windows source are made available to those who have a need to see it, have a lot of money, and are willing to sign an NDA. It's extremely hard to get access, but it can be done.
A warning at the top of the page like as if there were blocked content would be sufficient until the user clicks to confirm the validity of of the cert. The warning could just stay until clicked or don't show me again or something like that.
I agree - the way Opera does it is sufficient.
FF3 atm changes the whole page when a cert is not authenticated. httpus could have a small warning but leave the site in shape and let it work. This would also have to be implemented in web servers though, but why not? Seems like a brilliant idea to me. The warning could also only be displayed once.
The way opera does it, you click a button to accept it for one session. If you want to accept it permanently, you have to click the security tab on the warning and check a box. That's the way it should be done in FF3.
It's not the job of FireFox to second guess the user. Inform them of the issue, but don't try to force them into rejecting it by making it over cumbersome to accept it.
-- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
