Top all-time · #2162
Eric Mill
Personal blog · konklone.com/postsecuritypoliticsweb
Eric Mill's personal blog at konklone.com covers security, politics and web. Since 2012, 34 different Hacker News readers have linked it 46 times, most often “We're Deprecating HTTP and It's Going to Be Okay”. No feed was found, so read it on the site itself.
Too few sampled comments (27) to say how often HN recommends it.?
Why HN links it
HN readers link Eric Mill's posts on HTTPS and deprecating HTTP, GitHub Pages' limited HTTPS for custom domains, Slack's arbitration clause, and registrar 2FA. Often cited as supporting evidence.
- Recommended for · 2 comments
- Called the post on Slack's new arbitration clause "excellent" and urged readers to read it; called a post on switching to HTTPS for free a "good guide".
Summarised by Claude from a sample of 27 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Eric Mill is a leader in technology policy and cybersecurity, with a long background in public service.
Most-linked posts?
- We're Deprecating HTTP and It's Going to Be Okay5 people · 5 mentions · first linked 2015-05-13
- Slack's New Arbitration Policy5 people · 5 mentions · first linked 2014-11-24
- Why Google is Hurrying the Web to Kill SHA-13 people · 3 mentions · first linked 2014-09-08
- Dropbox Bug Can Permanently Lose Your Files3 people · 3 mentions · first linked 2012-10-26
- Switch to HTTPS Now, For Free3 people · 3 mentions · first linked 2013-09-25
- Quora Keeps the World's Knowledge for Itself3 people · 3 mentions · first linked 2014-10-15
- /post/github-pages-now-sorta-supports-https-so-use-it3 people · 3 mentions · first linked 2015-05-30
- The lesson of n_is_stolen is to use 2FA for your domain name2 people · 4 mentions · first linked 2014-01-29
- Switch to HTTPS Now, For Free2 people · 2 mentions · first linked 2013-09-06
- GitHub Pages Now Supports HTTPS, So Use It2 people · 2 mentions · first linked 2014-04-04
What Hacker News says?
Hashes are generally a part of the signature generation used with certificates. See for example "What role do hashes play in TLS/SSL certificate validation?" -> https://security.stackexchange.com/questions/67512/what-role... In certificates, md5 - and sha1 - was used quite some time after it was known to be weak, I suspect OP was thinking of that. This article seems to give a good summary what happened with sha1, me…
Comment linking /post/why-google-is-hurrying-the-web-to-kill-sha-1
on “Hash collision in Apple NeuralHash model”Submitted Switch to HTTPS Now, For Free as a story · 622 points
HN discussionThe fault in that case lies entirely with GoDaddy's poor security. Use a competent registrar, preferably one that supports 2FA with a hardware token. https://konklone.com/post/protect-your-domain-name-with-two-...
Comment linking /post/protect-your-domain-name-with-two-factor-authentication
on “Don’t Mess with The Google”Submitted Why Google is Hurrying the Web to Kill SHA-1 as a story · 423 points
HN discussionThis is a terrifying story, and I'm very glad Hiroshima wrote it, because I didn't have two factor auth turned on with my domain provider. Now I do! It seems like if he'd had 2FA turned on with GoDaddy, this may not have happened. So rather than use @gmail.com addresses to register for things, as he recommends, just turn on 2FA with your provider. And if your provider doesn't support it, leave them and tell them why…
Comment linking /post/protect-your-domain-name-with-two-factor-authentication
on “How I Lost My $50,000 Twitter Username”Submitted Quora Keeps the World's Knowledge for Itself as a story · 305 points
HN discussionYeah, I disagree with Naoki's conclusion. I'm pretty sure he just didn't have 2FA turned on with GoDaddy (which I understand - I didn't think to turn 2FA on with my provider until I read his story). The admonition to use a @gmail.com address was annoying enough to me that I responded with a blog post: https://konklone.com/post/protect-your-domain-name-with-two-...
Comment linking /post/protect-your-domain-name-with-two-factor-authentication
on “How I Lost My $50,000 Twitter Username”Submitted The Door To The FISA Court Doesn't Even Have A Sign On It as a story · 273 points
HN discussion> https://konklone.com/post/github-pages-now-sorta-supports-ht... > https://sheharyar.me/blog/free-ssl-for-github-pages-with-cus... Looks like you can, ("sorta")
Comment linking /post/github-pages-now-sorta-supports-https-so-use-it
on “GitLab Pages”Submitted Slack's New Arbitration Policy as a story · 193 points
HN discussionThere already kinda is TLS on github.io but it's only user<->CDN, CDN<->Github is unencrypted. [ https://konklone.com/post/github-pages-now-sorta-supports-ht... ] And it doesn't work on custom domains (Github can't present a cert for your domain); you can make it "work" via Cloudflare but that only works if Cloudflare doesn't validate Github's cert, which introduces yet another unsecure link. [ https://github.com/is…
Comment linking /post/github-pages-now-sorta-supports-https-so-use-it
on “Rearchitecting GitHub Pages”Submitted Dropbox Bug Can Permanently Lose Your Files as a story · 193 points
HN discussion> Have I missed a memo that HTTP is going away? https://konklone.com/post/were-deprecating-http-and-its-goin... (FWIW, I personally don't like it and think that it's a mistake.)
Comment linking /post/were-deprecating-http-and-its-going-to-be-okay
on “The modern HTTPS world has no place for old web servers”Submitted Slack is now forcing users into arbitration as a story · 124 points
HN discussionSo now github "sorta sorta" [1] supports https: - You CAN force HTTPS for your *.github.io site. - You CAN use an https://yourname.github.io URL. - You CANNOT use a custom domain name with a fully secured HTTPS connection. [1] https://konklone.com/post/github-pages-now-sorta-supports-ht...
Comment linking /post/github-pages-now-sorta-supports-https-so-use-it
on “HTTPS for GitHub Pages”Submitted How to Hack the Developer Console to be Needlessly Interactive for Christmas as a story · 69 points
HN discussionIt's just basic connection integrity -- without HTTPS, there's no guarantee the user is actually getting the content that the site meant to send, and vice versa. Those kind of attacks really do happen, and at scale (e.g. Verizon XUID, or China's Great Cannon). If it's at all interesting, I laid out in detail, with examples, why I've been comfortable taking a very hard line on deprecating HTTP: https://konklone.com/p…
Comment linking /post/were-deprecating-http-and-its-going-to-be-okay
on “Why HTTPS for Everything?”Submitted Switch to HTTPS Now, For Free as a story · 18 points
HN discussionThis is great, but it should also be a reminder that SSL is currently not possible for custom domains hosted on GitHub: https://konklone.com/post/github-pages-now-supports-https-so... . I hope a solution materializes eventually.
Comment linking /post/github-pages-now-supports-https-so-use-it
on “HTTPS as a ranking signal”Submitted How to Hack the Developer Console to be Needlessly Interactive as a story · 9 points
HN discussionYou're not missing anything. Two posts were merged. This is the Privacy policy blog post by Slack. There was another blog post (third-party) that talked about changes in their TOS to include arbitration. https://konklone.com/post/slack-is-now-forcing-users-into-ar...
Comment linking /post/slack-is-now-forcing-users-into-arbitration-and-that-is-terrible
on “Slack's New Arbitration Policy”Submitted We're Deprecating HTTP and It's Going to Be Okay as a story · 8 points
HN discussionEric Mill's excellent post about Slack's new arbitration clause was just merged into this thread by the moderators. Here is the URL: https://konklone.com/post/slack-is-now-forcing-users-into-ar... The post is titled "Slack is now forcing users into arbitration and that is terrible." I highly recommend reading it, as there's no mention of the arbitration ToS change in Slack's own blog post. Edit: Also worth reading t…
Comment linking /post/slack-is-now-forcing-users-into-arbitration-and-that-is-terrible
on “Slack's New Arbitration Policy”Submitted The Making of isitchristmas.com 2012 as a story · 6 points
HN discussion> opting out of complying with any legal system by forcing an arbitration clause on its customers. I don't fully understand the context. Can you explain the arbitration clause they are forcing? Edit: Found this, also on the front page right now: https://konklone.com/post/slack-is-now-forcing-users-into-ar...
Comment linking /post/slack-is-now-forcing-users-into-arbitration-and-that-is-terrible
on “Slack's New Arbitration Policy”Submitted Webfinger Gets a Final Chance as a story · 3 points
HN discussionhttps://mobiforge.com/news-comment/no-https-then-bye-bye-geo... https://www.wordfence.com/blog/2017/01/chrome-56-ssl-https-w... https://blog.mozilla.org/security/2015/04/30/deprecating-non... http://stackoverflow.com/questions/32106849/getcurrentpositi... https://konklone.com/post/were-deprecating-http-and-its-goin... http://forums.whirlpool.net.au/archive/2598616 Just some random places to start to see why the majo…
Comment linking /post/were-deprecating-http-and-its-going-to-be-okay
on “HTTP/2 is not the future, it’s the present”Submitted GitHub Pages Now Supports HTTPS, So Use It as a story · 2 points
HN discussionI don't think this is correct for GitHub Page sites that use custom domains. See [1] and [2]. [1]: https://konklone.com/post/github-pages-now-supports-https-so... [2]: https://github.com/isaacs/github/issues/156
Comment linking /post/github-pages-now-supports-https-so-use-it
on “GitHub Pages – Usage Limits”Submitted Take Control of Your Email Address (2013) as a story · 2 points
HN discussion
