Re: HTTP is just fine -- v. HTTP is insecure --> need a better metaphor

> I understand it's really jarring to have a large organization like Mozilla
> suddenly tell you they're going to punish you unless you do something you
> don't feel like doing, or don't think is necessary for your own thing. But
> I personally think it's not realistic to expect to tackle the long tail
> without introducing a stick alongside the carrot.
> 
> Maybe the reason I don't see Mozilla's deprecation move as so martial or
> oppressive is because I don't think it's really aimed at individual
> bloggers or site owners. I see Mozilla's (and Google's) deprecation pushes
> as constructively affecting two major audiences:
> 
> * Persuading apathetic bureaucrats at large organizations to roll their
> eyes and add "HTTPS transition" line items to their Fiscal Year 2016 and
> 2017 budgets.
> 
> * Finally giving enthusiasts inside small to medium organizations the
> headline they need to win the argument they've been losing for months or
> years.

I am an enthusiast inside a currently small organisation and whilst I
may encourage adoption generally, it is not about necessary, it is about
mozilla forcing me or not to choose between two actions, both of which
are detrimental to my business.

1./ DDOS amplification meaning it's harder to keep any parts of my
sites and future sites running and not just http pages, should such an
attack occur. (This is important at most scales). It's probably
worth noting that wasting extra redundant resources on protection here
would actually be far worse for the world.

2./ Whatever this "stick" is, which will just seriously affect my
view and advocacy of mozilla and may lead to sites actually stating
the truth behind this stick in their FAQ.

People should be encouraged like the green bar (which is
technically very close to pointless btw) and not threatened. I believe
googles policy is meant to be "no harm". How about mozilla's??

-- 

KISSIS - Keep It Simple So It's Securable