Noncombatant

Please note, I am not accusing any specific person of being a government spook
intent on weakening security, but I can’t help notice the parallels in this
situation with what is known about how Internet standards get compromised

Except that's exactly what the author is doing. Otherwise why did I have to wade through the first 50% of this blog post? Palmer's blog on the subject [1] is well-reasoned and makes the motivations for the decision clear. Slepak may not like those reasons, but adding a veiled accusation of stoogery to an otherwise weak rebuttal just makes you look like an asshole.

I'll requote Palmer's fundamental assertion:

However, it is not possible for a low-privilege application to defend against
the platform it runs on, if the platform is intent on undermining the
application’s expectations. To try would be futile, and would necessarily
also violate a crucial digital rights principle: The computer’s owner should
get to decide how the computer behaves. Dell and Lenovo let their customers
down in that way, but for better and for worse, it’s not something that a web
browser can fix.

I can appreciate this argument. Today it's pre-installed certificates, but tomorrow it'll be some malware that hijacks the owner's machine in some other way. If Chrome's responsibilities expand to include the security of the entire system, it would place an impossible burden on its engineers.

[1] https://noncombatant.org/2015/11/24/what-is-hpkp-for/

As a software engineer you're more than half of the way there. A lot of people pivot into this industry with almost zero experience because it's pretty fun and they end up learning computer science along the way.

I'd first start by reading this blog https://noncombatant.org/2016/06/20/get-into-security-engineering/ and everything it links. Then study them to start getting a breadth of knowledge in the security space.

In parallel, I'd recommend studying real security vulnerabilities in products that use technologies that you have a background in. For example, if you are interested in both Web technologies and C++ ,I'd start studying Google Chrome, specifically it's Javascript engine V8 [1]. There is an entire cottage community of both offensive and defensive people looking for vulnerabilities in chrome so it's a good way to get started because there's a lot of information out there. One amazing thing about security engineering is that you get to learn how all of these amazing technologies work at a deep level, because you need to understand it almost as well as the developer to find security vulnerabilities in it. For example, I have a very deep understanding of how technologies like RTC, Browsers, Sandboxes, and the IOS operating systems work from auditing their code and finding security vulnerabilities.

[1] https://bugs.chromium.org/p/chromium/issues/list?q=Security_Severity%3DHigh%20Security_Impact%3DStable%20component%3ABlink%3EJavaScript&can=1

On one hand, Dell seems to think there is a market of people willing to pay to install Firefox. Whoever conducted that research probably found people trusting Firefox than IE or Chrome or Opera. That's just my guess. I have heard people saying "web download is broken. You first have to use some browser like Chrome or IE to install Firefox, but what if that IE version is compromised? What if people click on the wrong mozilla.org by googling and instead installed a malicious, modified Mozilla firefox?" Maybe Dell read HNs and thought "yeah let's help the poor souls out there!" (http://noncombatant.org/2014/03/03/downloading-software-safely-is-nearly-impossible/)

On the other hand, this charging practice is ridiculous. I can understand some people are not technical at all (espeically the elders and new computer users), but come on, this is a ripe off. If you already created a custom image to load into every hard drive you sell to your customer, modify that image by adding Firefox. How much effort is that, Dell?

edit:
Does Dell's installation bundles with third-party addons? Remember the old toolbar spam? It would be interesting one day Dell decides to sell Tor installation service.

Regarding Chrome, here's a good place to start:

https://noncombatant.org/2014/03/11/privacy-and-security-settings-in-chrome/

There are also people who use Chromium, or particular configurations of Chromium, instead of Chrome. That's fine. But don't use forks of Chromium, no matter who maintains them, even if it looks like a sizable effort. You don't want your browser to be any number of days behind the Chromium patch cycle.

I use the browser integration for 1Password on OS X (I might not if I was on Windows). I'm generally not that worried about localhost privilege escalation. I am very worried about how well I can reason about cloud-based storage of any sort, and how it will interact with things like my browser.

KISS: keep your secrets out of cloud systems and your backups offline.

If you're very sophisticated, I like Tarsnap for online backups. But you have to be very sophisticated to use it.

At first I thought "The title is bait.... what a waste of time, etc...". Clearly the problem isn't HTTPS, it is the current CA structure. I then went on Chris' site (http://noncombatant.org/) and there he summarizes it well: "The problems are social and economic more than technical. The technical problems are in usability, not in cryptography. In general, security people should start learning about usability."

I still argue that the is no 'usability' problem, but rather 'ignorance'. The fact that https has been hailed as 'secure' to the user (who has no formal understanding of what 'secure' is) is what has led up to the problem he is venting about...

It looks nice. I suggest that all http requests to redirect to https (also enabling HSTS and preload it into browsers HSTS list), it makes admins easier to suggest the software for their users. On the other hand I wouldn't suggest a closed source software for ssh for my users, but that's just me. However it's hard to suggest putty for Windows users either since it's virtually impossible to download it securely [1]. I think the most secure suggestion is cygwin+openssh also it's the most inconvenient.

[1] https://noncombatant.org/2014/03/03/downloading-software-safely-is-nearly-impossible/