Reply to thread

Message

<blockquote data-quote="ForgottenSeer 92963" data-source="post: 966167">I have always disabled HTTPS scanning, even when browsers had no low rights containers. Since he Microsoft Nozzle and Sozzle javascript sanitizing studies&nbsp; (yes those projects&nbsp; really had those names) and the Chrome browser introduction with its internal sandbox and tthe need to stop bad stuff as early as possible also became less relevant IMO.Also HTTPS scanning often was combined with injecting DLL in the browser. These modules were often so badly designed and tested that they contained serious security risks. It was so bad that Google even threathened to block DLL injection in its browser.The AV-community turned that threat into an opportunity for Google to snoop on us (and launched the Google ID gossip). This made Google return on its tracks, because it had to deal with bad PR issues concerning the loss of privacy when using Chrome.Chrome in its turn started project Zero (to find and prevent Zero days in the wild) and positioned Tavis Ormandy as the lead speaker to make security companies and programs ridiculous because of the bugs/vulnabilities/security holes those so called security vendors had in their own software. Anyone ever questioned why a company would waist time of a top notch researcher into debugging software from another company? The only feasible answer could be to create awareness and real world proof of Google&#039;s take on this matter. The hilareous (or ashamingly sad depending on your take on it) twitter posts of Tavis Ormandy made clear to me that &quot;NO MAN IN HIS RIGHT MIND SHOULD EVER PUNCH A HOLE IN A SECURITY MECHANISM USING THE EXCUSE OF INCREASED SECURITY&quot;.To the OP and all agreeing with him: I am glad you have made the right choice.</blockquote>

[QUOTE="ForgottenSeer 92963, post: 966167"] I have always disabled HTTPS scanning, even when browsers had no low rights containers. Since he Microsoft Nozzle and Sozzle javascript sanitizing studies (yes those projects really had those names) and the Chrome browser introduction with its internal sandbox and tthe need to stop bad stuff as early as possible also became less relevant IMO. Also HTTPS scanning often was combined with injecting DLL in the browser. These modules were often so badly designed and tested that they contained serious security risks. It was so bad that Google even threathened to block DLL injection in its browser. The AV-community turned that threat into an opportunity for Google to snoop on us (and launched the Google ID gossip). This made Google return on its tracks, because it had to deal with bad PR issues concerning the loss of privacy when using Chrome. Chrome in its turn started project Zero (to find and prevent Zero days in the wild) and positioned Tavis Ormandy as the lead speaker to make security companies and programs ridiculous because of the bugs/vulnabilities/security holes those so called security vendors had in their own software. Anyone ever questioned why a company would waist time of a top notch researcher into debugging software from another company? The only feasible answer could be to create awareness and real world proof of Google's take on this matter. The hilareous (or ashamingly sad depending on your take on it) twitter posts of Tavis Ormandy made clear to me that "NO MAN IN HIS RIGHT MIND SHOULD EVER PUNCH A HOLE IN A SECURITY MECHANISM USING THE EXCUSE OF INCREASED SECURITY". To the OP and all agreeing with him: I am glad you have made the right choice. [/QUOTE]

Verification