David Gessel
Making Chrome Less Horrible
Google’s Chrome is a useful tool to have around, but the security features have gotten out of hand and make it increasingly useless for real work without actually improving security.
After a brief rant about SSL, there’s a quick solution at the bottom of this post.
Chrome’s Idiotic SSL Handling Model
I don’t like Chrome nearly as much as Firefox, but it does do some things better (I have a persistent annoyance with pfSense certificates that cause slow loading of the pfSense management page in FF, for example). Lately I’ve found that the Google+ script seems to kill firefox, so I use Chrome for logged-in Google activities.
But Chrome’s handling of certificates is abhorrent. I’ve never seen anything so resolutely destructive to security and utility. It is the most ill-considered, poorly implemented, counter-productive failure in UI design and security policy I’ve ever encountered. It is hateful and obscene. A disaster. An abomination. The ill-conceived excrement of ignorant twits. I’d be happy to share my unrestrained feelings privately.
I’ve discussed the problem before, but the basic issues are that:
- The certificate authority is NOT INVALID, Chrome just doesn’t recognize it because it is self-signed. There is a difference, dimwits.
- This is a private network (10.x.x.x or 192.168.x.x) and if you pulled your head out for a second and thought about it, white-listing private networks is obvious. Why on earth would anyone pay the cert mafia for a private cert? Every web-interfaced appliance in existence automatically generates a self-signed cert, and Chrome flags every one of them as a security risk INCORRECTLY.
- A “valid” certificate merely means that one of the zillions of cert mafia organizations ripping people off by pretending to offer security has “verified” the “ownership” of a site before taking their money and issuing a certificate that placates browsers
- Or a compromised certificate is being used.
- Or a law enforcement certificate is being used.
- Or the site has been hacked by criminals or some country’s law enforcement.
- etc.
A “valid” certificate doesn’t mean nothing at all, but close to it.
So one might think it is harmless security theater, like a TSA checkpoint: it does no real harm and may have some deterrent value. It is a necessary fiction to ensure people feel safe doing commerce on the internet. If a few percent of people are reassured by firm warnings and are thus seduced into consummating their shopping carts, improving ad traffic quality and thus ensuring Google’s ad revenue continues to flow, ensuring their servers continue sucking up our data, what’s the harm?
The harm is that it makes it hard to secure a website. SSL does two things: it pretends to verify that the website you connect to is the one you intended to connect to (but it does not do this) and it does actually serve to encrypt data between the browser and the server, making eavesdropping very difficult. The latter useful function does not require verifying who owns the server, which can only be done with a web of trust model like perspectives or with centralized, authoritarian certificate management.
How to fix Chrome:
The damage is done. Millions of websites that could be encrypted are not because idiots writing browsers have made it very difficult for users to override inane, inaccurate, misleading browser warnings. However, if you’re reading this, you can reduce the headache with a simple step (Thanks!):
Right click on the shortcut you use to launch Chrome and modify the launch command by adding the following “--ignore-certificate-errors”
Once you’ve done this, chrome will open with a warning:
YAY. Suffer my ass.
Java? What happened to Java?
Bonus rant
Java sucks so bad. It is the second worst abomination loosed on the internet, yet lots of systems use it for useful features, or try to. There’s endless compatibility problems with JVM versions and there’s the absolutely idiotic horror of the recent security requirement that disables setting “medium” security completely no matter how hard you want to override it, which means you can’t ever update past JVM 7. Ever. Because 8 is utterly useless because they broke it completely thinking they’d protect you from man in the middle attacks on your own LAN.
However, even if you have frozen with the last moderately usable version of Java, you’ll find that since Chrome 42 (yeah, the 42nd major release of chrome. That numbering scheme is another frustratingly stupid move, but anyway, get off my lawn) Java just doesn’t run in chrome. WTF?
Turns out Google, happy enough to push their own crappy products like Google+, won’t support Oracle’s crappy product any more. As of 42 Java is disabled by default. Apparently, after 45 it won’t ever work again. I’d be happy to see Java die, but I have a lot of infrastructure that requires Java for KVM connections, camera management, and other equipment that foolishly embraced that horrible standard. Anyhow, you can fix it until 45 comes along…
To enable Java in Chrome for a little while longer, you can follow these instructions to enable NPAPI for chrome <42 (which enables Java). Type “chrome://flags/#enable-npapi” in the browser bar and click “enable.”
Undoing the Job Justifying Efforts of UX Kids
If you’re a UX designer on a mature project, you have to justify your pay somehow – design refreshes become a requirement. If tool companies had UX designers on staff, hammers would look like porcupines.
One of the most annoying features of FireFox V34 was the pop-down search menu. Nice concept, but if your mouse drifts, you end up searching on twitter or amazon or some other useless thing, or just calling up the idiotic “add search options” dialog. Srsly. The search bar is a nice thing, thank you, leave it be.
Fortunately, FF offers a way to undo most of the horrible changes visited on the UI and you can keep it functional and efficient by undoing the damage that treating a program like a fashion plate rather than a tool has wrought. Classic Theme Restorer is a good example.
Fixing the drop down search menu barf is easy: enter “about:config” in the URL bar and search for “browser.search.showOneOffButtons” Set the value to “False” and stop being delayed by random search destinations.
Dear dev teams: your first responsibility is to the users who have adopted your product. If you want to change the use case, fork.
Lufthansa Business Class
I’ve occasionally had to buy business on poorly planned Lufthansa intra-Europe flights. While Lufthansa long-haul premium seats are possibly the best in the business, on short-haul/intra-Europe flights, LH business class seats would seam a little mean in most carrier’s coach sections.
There is no difference between coach seats and business class, none at all. In business all middle seats are blocked out, but that isn’t that hard to find in coach. It is efficient to scale business, it involves only moving a rack-mounted divider that is the only obvious differentiation in the classes.
In both the seats are substandard to the amenities one usually expects, especially on a long haul flight:
– little padding on the seats
– cramped seat pitch (worse than econ +)
– typical economy seat width
– no in seat power (not even a usb port)
– no personalized IFE
Such limitations would be cheap in economy, but in business they are, perhaps we should say “disappointing.” Neither the economy nor the business class zone is going to leave the passenger well-rested (IST-FRA is a long enough flight that rest matters); such a flight is a grim endurance test for everyone. But it is very egalitarian in shared suffering, though not particularly egalitarian in pricing. And were LH business not priced competitively with other carrier’s business, the disparity in services wouldn’t seem quite so jarring.
LH is, of course, efficient and well organized, but every other airline I’ve flown that has a business class has far, far better business class, even those that can’t really manage the basics.
Superfish proves certs are useless for identification
Can we please, please stop with the stupid certificate verification warnings?
Dear security developers, your model is broken. It never worked. Stop warning people about certificate errors. Now. Forever.
Certificate errors serve two purposes:
- They make developers uncomfortable with using perfectly secure self-signed certs, and since commercial certs cost money, much of the web that could be encrypted remains unencrypted. That’s harm done to the public. Thanks.
- They happen so often, so relentlessly, for such trivial reasons (not even Google can keep their certs up to date) that users learn to ignore them, which makes an actual man-in-the-middle attack almost certain to succeed with most people, despite the warnings.
The Certificate Authority system is predicated on the idea that Certificate Authorities are flawless and trustworthy. They are neither. The Lenovo/Superfish problem shows another obvious flaw: hardware vendors (and actually any trusted software installer) has to be trustworthy too or client-side MITM is easy. And CA’s simply can’t verify against that.
This whole idiocy creates massive problems for something so basic as LAN administration. Even before wireless became pervasive, LAN coms should always be encrypted when passwords or any meaningful data is moving. Current security settings create a massive avalanche of useless errors for “untrustworthy certs” on one’s own network (the obvious fix is to automatically trust all certs on private networks, duh).
This is an issue that bothers me a lot. It gets in my way constantly and makes real security and encrypted communications way harder and way more complicated than it needs to be and the only beneficiaries at all are the certificate Mafiosi. This is just stupid. Superfish proves, again, how broken it is. Can we stop pretending now?
Also, this most recent of many certificate flaws comes with a bonus feature: the MITM cert Superfish uses is apparently really pathetically insecure, aside from using broken crypto, their software had their passwords in it, making it easy for crackers to develop tools to harvest additional data from the victims of the Superfish/Lenovo attack.It probably hurts more to find out your vendor hacked you, but the penalty is that the hack also destroyed the security of all of your communications. Thanks. This is why we can’t have nice things. It is also why any back door, no matter what the motive, compromises security.
Update: Superfish is, apparently, out of business. While that sucks for the people at the company, who were probably very happy with their Lenovo OEM deal and instead got a big sock of coal, one might naively hope for an upside that companies considering a model based on stealing people’s data might take notice of the cautionary tale of superfish.
Unfortunately – that won’t happen, not in the current valley climate. While it is economically advantageous to hire cheap kids who have no life and will work long hours for meagre pay, they come with a downside: they are all ignorant idiots. I don’t mean they’re not smart or capable (though the smart barrel was long ago drained and the vast majority of brogrammers sauntering around SF really are stupid), rather that they are foolish as in the opposite of ‘wise.” Wisdom comes from experience, and experience only comes with time, an immutable dimension. This superfish debacle was only from Feb 2015, but this year’s batch of idiot brogrammers weren’t around to see it and as they gather in self-congratulatory clusters in posh, VC-funded collaborative spaces, company barrista-brewed latte in one hand and social-media-distraction feeding portable device in the other, they’ll be high-fiveing and fist-bumping the brilliance of their brand-new idea for getting around SSL so they can collect marketing data and better target advertising. Yay.
How to fix Superfish:
Install Perspectives. And support them.
Also, this bugs the crap out of me:
Overthrow the Cert Mafia!
SSL for Authentication Sucks
Unbreaking Firefox SSL Behavior
The CA System is Intractably Broken
Better Cabling May Fix The Internet
Do you find that the internet seems harsh? Do you find Facebook unclear and that it lacks dynamic contrast? Is there less detail than there should be? Do you notice a loss of energy from the Internet?
It might all come down to the network cables themselves.
Well designed cables like these have perfect-surface extreme-purity silver conductors minimizing distortion caused by grain boundaries in inferior OFHC, OCC, or 8N conductors for better clarity and reduced harshness. Explanations and arguments will be both more clearly constructed and less confrontational.
Noise and other distractions are reduced by a 3-layer noise dissipation system, not just shielding your data but preventing modulation of your ground plane by noisy RFI. Even more problematically for those doing research on the web, the untested orientation of standard network cables results in inferior data quality.
Standard network cables either don’t enforce orientation of the pairs at all (Cat 5e and below) or merely segregate pairs with a flexible spacer (Cat 6 and above). These cables use solid polyethylene insulation to ensure critical geometry is preserved to minimize phase errors. Phase errors can easily result in Doppler shifts manifest in either an unnaturally shrill tone or affected bass (sometimes manifest as “mansplaining”).
Most remarkably, the dielectric bias system puts a 72V bias on the insulation and thus organizes the molecules of the insulation to minimize energy loss which creates a surprisingly black background, more essential than ever in the wake of Ferguson.
Only $10,521 for a 12m cable. Now that the internet has become our primary source of information, understanding, and personal communication this is a tiny price to pay for clear, undistorted data.
Basra Snow Storm
I was feeling a little left out, reading posts by people digging out of snow storms and here I am in Basra where it gets down to 10C at night sometimes and usually hits the mid 20’s during the day. Rough. But the weather here came through with our own sort of snow storm.
Starting to look like a brown-out!
Obligatory shot of the yard furniture getting covered.
Kitty’s head is starting to show some accumulation.
With all this blowing through you can barely see a few hundred meters!
It’s really starting to accumulate. Where’s the snow blower?
It takes some special cleaning after playing out in it.
Cat Watch
Cat Watch
The twins resting after a busy day.
Lizard Visit
A New animal visitor came by today.
Just hangin’
