Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Firefox will now automatically try to upgrade <img>, <audio>, and <video> elements from HTTP to HTTPS if they are embedded within an HTTPS page. If these so-called mixed content elements do not support HTTPS, they will no longer load.

Web developers make no sense to me. In one moment, it's all about "not breaking the web" (see: Smooshgate, and the stubborn resistance to reasonable API naming because it would break a 15-year-old third party library). And then they casually drop a huge breaking change like this. Ok.



It's almost as if people consider all possible upsides and downsides, and try to make a good trade-off for that specific situation, instead of adhering to a simplistic black/white thinking...


It's all trade-offs. No one likes breaking software. In this case, it's a security issue, so that can justify a breaking change.


Safari already disallows mixed content, so not really new. And it's been an error for a long time, no one should really be surprised that their broken code is broken causing their website to break. It's more surprising that you are demanding we keep allowing affirmatively wrong code.


Changes made in the name of security have a higher chance of being allowed to break backwards compatibility. If changing that API name fixed some security issue, or even reduced the security exposure of some part of the browser, it might be allowed even if it breaks some third-part library.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: