<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Opera and Trusting Applications vs Trusting Servers</title>
	<atom:link href="http://etbe.coker.com.au/2010/03/04/opera-trust-applications-vs-servers/feed/" rel="self" type="application/rss+xml" />
	<link>http://etbe.coker.com.au/2010/03/04/opera-trust-applications-vs-servers/</link>
	<description>Linux, politics, and other interesting things</description>
	<lastBuildDate>Thu, 09 Feb 2012 01:09:24 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
	<item>
		<title>By: Daniel</title>
		<link>http://etbe.coker.com.au/2010/03/04/opera-trust-applications-vs-servers/comment-page-1/#comment-24382</link>
		<dc:creator>Daniel</dc:creator>
		<pubDate>Tue, 09 Mar 2010 20:13:58 +0000</pubDate>
		<guid isPermaLink="false">http://etbe.coker.com.au/?p=1833#comment-24382</guid>
		<description>Your statement about Android may be partially correct.  The Nokia n900, which I own, may also fit the bill of &quot;designed for the user.&quot;  I am not knowledgeable enough to conclusively state &quot;it is so&quot; but submit it for your review.</description>
		<content:encoded><![CDATA[<p>Your statement about Android may be partially correct.  The Nokia n900, which I own, may also fit the bill of &#8220;designed for the user.&#8221;  I am not knowledgeable enough to conclusively state &#8220;it is so&#8221; but submit it for your review.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: etbe</title>
		<link>http://etbe.coker.com.au/2010/03/04/opera-trust-applications-vs-servers/comment-page-1/#comment-24373</link>
		<dc:creator>etbe</dc:creator>
		<pubDate>Mon, 08 Mar 2010 20:13:44 +0000</pubDate>
		<guid isPermaLink="false">http://etbe.coker.com.au/?p=1833#comment-24373</guid>
		<description>Simon: Good point.  I think that Google however has a reasonable record of not breaking things.  If we look at web compatibility issues it doesn&#039;t seem to be major site vs major browser but slightly less popular site vs a browser that is not particularly popular or disliked by the people who run the site.  But I guess that this is actually a worse problem, if Google broke Opera then not long after the first headline news article in the IT press at least one of Google or Opera would make changes - maybe both would.  The fact that a little web store that sells a niche item you desire won&#039;t accept your credit card when you use your favorite browser is something that you can expect to happen fairly often with no news reports and a low probability of a fix.

Regarding the cost of inconvenience, I expect that there are significant corporate interests that oppose measuring such things.  Imagine if all the inconveniences of DRM, toll roads, and other anti-features were assigned costs.  It would probably inspire legislative changes...</description>
		<content:encoded><![CDATA[<p>Simon: Good point.  I think that Google however has a reasonable record of not breaking things.  If we look at web compatibility issues it doesn&#8217;t seem to be major site vs major browser but slightly less popular site vs a browser that is not particularly popular or disliked by the people who run the site.  But I guess that this is actually a worse problem, if Google broke Opera then not long after the first headline news article in the IT press at least one of Google or Opera would make changes &#8211; maybe both would.  The fact that a little web store that sells a niche item you desire won&#8217;t accept your credit card when you use your favorite browser is something that you can expect to happen fairly often with no news reports and a low probability of a fix.</p>
<p>Regarding the cost of inconvenience, I expect that there are significant corporate interests that oppose measuring such things.  Imagine if all the inconveniences of DRM, toll roads, and other anti-features were assigned costs.  It would probably inspire legislative changes&#8230;</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Simon</title>
		<link>http://etbe.coker.com.au/2010/03/04/opera-trust-applications-vs-servers/comment-page-1/#comment-24372</link>
		<dc:creator>Simon</dc:creator>
		<pubDate>Mon, 08 Mar 2010 18:33:26 +0000</pubDate>
		<guid isPermaLink="false">http://etbe.coker.com.au/?p=1833#comment-24372</guid>
		<description>&gt; But then I’ve worked for ISPs that had arrays of transparent web proxies for non-https traffic that could have been good for MITM attacks – and the customers of those ISPs didn’t know about them…

Speaking as a customer of an ISP who does this (at work), have to say that sometimes you suddenly become aware of them.

But as I suggested I&#039;d be less concerned that someone bad might do something to them, but that they might disappear for other reasons. I mentioned bankruptcy, but administrator cock-up is probably just as likely. Indeed you only need a key site, like urm Google, to start using a feature the proxy doesn&#039;t support, or doesn&#039;t support well, and lots of people will be inconvenienced.

I think part of the issue is we don&#039;t yet have in place ways off assessing cost of mass inconvenience. I saw a study recently pondering how long a traffic jam needs to be before you are stopping someone on a life saving mission - what with Ambulance going to car accidents and such like apparently it isn&#039;t that long. I wonder what the &quot;cost&quot; of stopping a browser working on a million cell phones is?</description>
		<content:encoded><![CDATA[<p>&gt; But then I’ve worked for ISPs that had arrays of transparent web proxies for non-https traffic that could have been good for MITM attacks – and the customers of those ISPs didn’t know about them…</p>
<p>Speaking as a customer of an ISP who does this (at work), have to say that sometimes you suddenly become aware of them.</p>
<p>But as I suggested I&#8217;d be less concerned that someone bad might do something to them, but that they might disappear for other reasons. I mentioned bankruptcy, but administrator cock-up is probably just as likely. Indeed you only need a key site, like urm Google, to start using a feature the proxy doesn&#8217;t support, or doesn&#8217;t support well, and lots of people will be inconvenienced.</p>
<p>I think part of the issue is we don&#8217;t yet have in place ways off assessing cost of mass inconvenience. I saw a study recently pondering how long a traffic jam needs to be before you are stopping someone on a life saving mission &#8211; what with Ambulance going to car accidents and such like apparently it isn&#8217;t that long. I wonder what the &#8220;cost&#8221; of stopping a browser working on a million cell phones is?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: etbe</title>
		<link>http://etbe.coker.com.au/2010/03/04/opera-trust-applications-vs-servers/comment-page-1/#comment-24368</link>
		<dc:creator>etbe</dc:creator>
		<pubDate>Mon, 08 Mar 2010 11:17:46 +0000</pubDate>
		<guid isPermaLink="false">http://etbe.coker.com.au/?p=1833#comment-24368</guid>
		<description>Gregory:  One final thing that occurred to me is that I should have discussed the issue of who is to use the Opera installation in question.

If it is to be used by someone like you or I then they could decide not to take any excess risks and use it for things that don&#039;t matter much while another (slower) browser could be used for online banking, credit card purchases, etc.  If it is to be used by a typical user (who in my experience can&#039;t tell you which browser they were using when they file a bug report) then this is more of a problem.

The same thing applies to phones.  If I had a real need to update a phone then I know I could get it done, but my parents couldn&#039;t even apply to a telco to have a phone unlocked at the end of it&#039;s contract without my assistance.

Then there&#039;s the issue of application design.  The programmers at LG and other phone companies are spending time on menu systems that the owner can&#039;t bypass (without a base firmware update) instead of spending time on improving the security of the device.

The discussion of this started with a blog post on the topic of whether Apple would approve Opera.  I&#039;m sure that whether people like you or I can use Opera properly isn&#039;t an issue that Apple cares much about, it&#039;s the millions of people who don&#039;t even know which web browser they are using.

It is handy to know that you can download software to re-flash phones.  I may check that out some time when I have spare time and a phone that&#039;s old enough that I don&#039;t care much if I brick it.</description>
		<content:encoded><![CDATA[<p>Gregory:  One final thing that occurred to me is that I should have discussed the issue of who is to use the Opera installation in question.</p>
<p>If it is to be used by someone like you or I then they could decide not to take any excess risks and use it for things that don&#8217;t matter much while another (slower) browser could be used for online banking, credit card purchases, etc.  If it is to be used by a typical user (who in my experience can&#8217;t tell you which browser they were using when they file a bug report) then this is more of a problem.</p>
<p>The same thing applies to phones.  If I had a real need to update a phone then I know I could get it done, but my parents couldn&#8217;t even apply to a telco to have a phone unlocked at the end of it&#8217;s contract without my assistance.</p>
<p>Then there&#8217;s the issue of application design.  The programmers at LG and other phone companies are spending time on menu systems that the owner can&#8217;t bypass (without a base firmware update) instead of spending time on improving the security of the device.</p>
<p>The discussion of this started with a blog post on the topic of whether Apple would approve Opera.  I&#8217;m sure that whether people like you or I can use Opera properly isn&#8217;t an issue that Apple cares much about, it&#8217;s the millions of people who don&#8217;t even know which web browser they are using.</p>
<p>It is handy to know that you can download software to re-flash phones.  I may check that out some time when I have spare time and a phone that&#8217;s old enough that I don&#8217;t care much if I brick it.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: etbe</title>
		<link>http://etbe.coker.com.au/2010/03/04/opera-trust-applications-vs-servers/comment-page-1/#comment-24367</link>
		<dc:creator>etbe</dc:creator>
		<pubDate>Mon, 08 Mar 2010 11:02:09 +0000</pubDate>
		<guid isPermaLink="false">http://etbe.coker.com.au/?p=1833#comment-24367</guid>
		<description>http://www.reddit.com/r/programming/comments/b9yz5/the_opera_mini_dispute_what_apparently_isnt/

Reddit has some discussion of this post at the above URL.</description>
		<content:encoded><![CDATA[<p><a href="http://www.reddit.com/r/programming/comments/b9yz5/the_opera_mini_dispute_what_apparently_isnt/" rel="nofollow">http://www.reddit.com/r/programming/comments/b9yz5/the_opera_mini_dispute_what_apparently_isnt/</a></p>
<p>Reddit has some discussion of this post at the above URL.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: etbe</title>
		<link>http://etbe.coker.com.au/2010/03/04/opera-trust-applications-vs-servers/comment-page-1/#comment-24366</link>
		<dc:creator>etbe</dc:creator>
		<pubDate>Mon, 08 Mar 2010 10:59:49 +0000</pubDate>
		<guid isPermaLink="false">http://etbe.coker.com.au/?p=1833#comment-24366</guid>
		<description>Simon: While an application can&#039;t be weakened, new attacks can be discovered against libraries or algorithms that are used.

Good point about Opera going bankrupt.

Regarding proxies for security, there are some products that do such things.  I wonder whether Opera is doing any such things, they could, but presumably they would have announced it if they did.

Gregory: I&#039;m using a phone that&#039;s just under 2 years old right now.  I know that there are a variety of services that charge moderate amounts of money to unlock phones.  I haven&#039;t tried them because during the contract period I don&#039;t want to risk doing something that had the potential to cause expensive problems and after the contract period the phone wasn&#039;t worth enough to justify the expense.  I can buy a new Viewty now for $150, when my current one comes out of contract I might be able to buy one for less than $100 - which would be better than paying $40 to unlock and old scratched phone.

I agree that Opera&#039;s proxy is a giant MITM attack vector.  But then I&#039;ve worked for ISPs that had arrays of transparent web proxies for non-https traffic that could have been good for MITM attacks - and the customers of those ISPs didn&#039;t know about them...

For all I know my Telco could be proxying all the http traffic that originates from my mobile phone or 3G network device.  When they assign me an IP address in the 10.0.0.0/8 range I know that they are at least doing NAT.</description>
		<content:encoded><![CDATA[<p>Simon: While an application can&#8217;t be weakened, new attacks can be discovered against libraries or algorithms that are used.</p>
<p>Good point about Opera going bankrupt.</p>
<p>Regarding proxies for security, there are some products that do such things.  I wonder whether Opera is doing any such things, they could, but presumably they would have announced it if they did.</p>
<p>Gregory: I&#8217;m using a phone that&#8217;s just under 2 years old right now.  I know that there are a variety of services that charge moderate amounts of money to unlock phones.  I haven&#8217;t tried them because during the contract period I don&#8217;t want to risk doing something that had the potential to cause expensive problems and after the contract period the phone wasn&#8217;t worth enough to justify the expense.  I can buy a new Viewty now for $150, when my current one comes out of contract I might be able to buy one for less than $100 &#8211; which would be better than paying $40 to unlock and old scratched phone.</p>
<p>I agree that Opera&#8217;s proxy is a giant MITM attack vector.  But then I&#8217;ve worked for ISPs that had arrays of transparent web proxies for non-https traffic that could have been good for MITM attacks &#8211; and the customers of those ISPs didn&#8217;t know about them&#8230;</p>
<p>For all I know my Telco could be proxying all the http traffic that originates from my mobile phone or 3G network device.  When they assign me an IP address in the 10.0.0.0/8 range I know that they are at least doing NAT.</p>
]]></content:encoded>
	</item>
</channel>
</rss>

