explain xkcd - User contributions [en]

Talk:2634: Red Line Through HTTPS

2022-06-19T22:12:15Z

Kzkzb: question

HTTPS was standardized in 2000 or so, so 2015 is quite a stretch for a site to not use it because the site was last updated before HTTPS was widely available.
With pretty much any browser now, a red line through HTTPS means that the site _is using HTTPS_, but it is _not trusted by the browser_ (due to e.g. the certificate being self-signed or expired).
[[User:Darrylnoakes|Darrylnoakes]] ([[User talk:Darrylnoakes|talk]]) 04:28, 18 June 2022 (UTC)

:I think the intended joke is that the site's certificate expired in 2015, instead of the site is not using HTTPS. [[Special:Contributions/108.162.221.101|108.162.221.101]] 06:29, 18 June 2022 (UTC)

:2015 is when the first Let's Encrypt certs were issued, and 2016 is when LE became generally available to the public and thus when free SSL/TLS became very very easy for just about anyone setting up a web server, hence the comic citing 2015. However even with a valid cert you might have a number of issues, like [https://www.mixedcontentexamples.com/ mixed content]. At least in Firefox, an expired cert gives a big warning screen that gives you an option to add a security exception; I don't care enough to install Chrom{e,ium} to test its UI. [[Special:Contributions/172.69.69.250|172.69.69.250]] 08:30, 18 June 2022 (UTC)

::Chrome has this warning screen including an option to bypass the warning as well. I believe all browsers do. I think the only exception to this is when a site has strict transport security enabled. [[User:Jespertheend|Jespertheend]] ([[User talk:Jespertheend|talk]]) 10:49, 18 June 2022 (UTC)

:::Until about 2015 no-one complained if you didn't offer HTTPS as long as you didn't request anyone's credit card number or offered .exe files: An internet site offers nothing but inherently untrustable text. It might contain ads that can execute any piece of javascript. It even could contain flash - so why pay a substantial amount of money to make the transport of that data more secure? Nowadays most web browsers tell on you if you don't secure connections and allowing the telco to see what data you download from where is felt as a privacy intrusion. On the other side not every hoster offers https for multiple domains...--[[User:Gunterkoenigsmann|Gunterkoenigsmann]] ([[User talk:Gunterkoenigsmann|talk]]) 15:03, 19 June 2022 (UTC)

Not sure it's true that if there is a problem with HTTPS like an expired cert that the connection is made with HTTP instead. [[Special:Contributions/172.69.79.201|172.69.79.201]] 10:11, 18 June 2022 (UTC)

:It's not, it still uses the https connection. It only indicates that the connection might not be secure anymore and anyone could be listening in at that point. [[User:Jespertheend|Jespertheend]] ([[User talk:Jespertheend|talk]]) 10:49, 18 June 2022 (UTC)

I actually am bemused by this. Not sure if I only visit the wrong (or right?) websites with the wrong (or right?) browsers, but I don't recall ever notably having seen struck-red links. (Perhaps I have, and assumed it was a site informing me that they were dead links, not now followable?) I ''do'' occasionally follow a normal-looking link (maybe locally CSSed in a over-riding manner of format?) and I get the browser load up a whole-screen "Problem with certificate (Are you sure? Jump through hoops for me to progress.)" which I may then take under considered advisement but mostly has me checking I'm not being spoofed as to the destination or something. Is this where the red strikethrough appears for others?
<br/>I also have at least one site that is steadfastly still HTTP-only, and neither I nor my various browsers have any problem with it as I know what I'm doing, whilst the browsers just go there without particular complaint or anything more than usual addressbar clues... I might have "added to exception from warning" once or twice in the distant past, but not in every case. So I'm learning something here, but I don't know what. Sounds like something Edge would do, but I don't use Edge... I'm generally on Chrome, Firefox and a handful of 'lesser' flavours, all definitely updated. [[Special:Contributions/172.70.90.173|172.70.90.173]] 11:21, 18 June 2022 (UTC)

:You can find some examples of the red line on https://badssl.com/, but pretty much in all cases you get a full page warning first that something is amiss. You can also try out the http connection at http://http.badssl.com/, http connections are a bit more complicated. Some browsers don't show a warning at all, while others only show a gray 'insecure' label in front of the url. And as can be seen here [https://blog.chromium.org/2017/04/next-steps-toward-more-connection.html], the plan is to eventually show similar warnings for HTTP sites as what is currently shown for HTTPS sites with a failed certificate. [[User:Jespertheend|Jespertheend]] ([[User talk:Jespertheend|talk]]) 11:32, 18 June 2022 (UTC)
::Ugh, I'd hate that. I have a little webpage of my own, and I'm not in a position to be able to go https, :( That "badssl" site has several example issues, which ones go red/strikethrough? I want to confirm no browser I have does that. [[User:NiceGuy1|NiceGuy1]] ([[User talk:NiceGuy1|talk]]) 04:56, 19 June 2022 (UTC)

:I was about to remark the same thing, :) NEVER seen a strikethrough. I'm rather assuming it's something Chrome does, because I about exclusively use Firefox, and Chrome likes to be weird and non-standard (main reason I generally don't use it), and too many people act like there's no other browser than Chrome. Likewise, most I get is "Security Risk!", then find out it's a Bad Certificate, then it turns out it expired and they just haven't updated it yet. Stop being so dramatic, LOL! [[User:NiceGuy1|NiceGuy1]] ([[User talk:NiceGuy1|talk]]) 04:28, 19 June 2022 (UTC)
::I'm a Chrome user (part of the time, being the "handful of lesser flavours" contributor, above, but using it this very second) and I don't see it. But then I turned off its look-ahead (downloading of pages it thinks I'll go to next) because I'd rather it not, and as some sort of pre-emptiveness seems necessary to know a link ''should'' be red-struckthrough, I probably (hopefully?) neutered that stupid potential exploit too... So don't take my experience as gospel. (But still sounds like an Edge thing, to me, the way that's the new IE in the current browser ecosystem.) [[Special:Contributions/172.70.162.5|172.70.162.5]] 11:32, 19 June 2022 (UTC)

I've made a rather large change to the page to better explain the meaning of a red line through https. I removed any mentioning of using the HTTP protocol as that is incorrect. If a browser uses the HTTP protocol it is shown in the url using 'http://'. Since the comic was talking about a red line through 'https' I'm assuming the usage of the HTTP protocol is unrelated here.
Though it's possible I removed some more information from the page that might still be desired. Such as the mentioning of AI-generated spam sites and man in the middle attacks. These seemed redundant to me for explaining the joke.
I also put some more emphasis on the red line usually meaning that something bad is going on. Browser venders put a lot of effort in security, and having everyone think that a red line is not that big of a problem is the last thing they'd want. [[User:Jespertheend|Jespertheend]] ([[User talk:Jespertheend|talk]]) 11:23, 18 June 2022 (UTC)

While it's true that some browser security warnings are false alarms, I think that paragraph is missing the point of the comic. Cueball is assuming that any site that's been around for years must be operated well. But often the maintainers of the site get complacent and don't update to newer standards. And even if the real site is legit, the security warning can mean that traffic has been intercepted, so you're not actually going to the real site. [[User:Barmar|Barmar]] ([[User talk:Barmar|talk]]) 13:40, 18 June 2022 (UTC)

I presumed this was about using outdated protocols like TLS 1.0 or weak ciphers. [[Special:Contributions/172.70.110.121|172.70.110.121]] 00:28, 19 June 2022 (UTC)

You'd almost think Randall didn't live in the Boston metropolitan area. I was disappointed. [[User:JohnHawkinson|JohnHawkinson]] ([[User talk:JohnHawkinson|talk]]) 04:30, 19 June 2022 (UTC)

Okay, at least two of us don't see this behaviour, so this is NOT as universal as Randall seems to think, could somebody figure out why and put it in the explanation? (I reject the possibility that we just haven't visited the right (wrong) sites. I, for one, go to WAY too many sites, LOL!). My leading theory is that instead of being universal, this behaviour is actually unique to Chrome (as I don't use it much and can easily have never visited an insecure website on it), since I use Firefox primarily, and many people seem to forget that there are other browsers than Chrome, and Google goes out of it's way to be as weird as possible, including being fancy for the sake of fancy (like the colour-coding and strikethrough). [[User:NiceGuy1|NiceGuy1]] ([[User talk:NiceGuy1|talk]]) 04:49, 19 June 2022 (UTC)

Where is Cueball saying that websites with a red line through HTTPS are more secure than modern websites? In the comic he merely says that the red line means that the website is legit, he doesn't make any comparison at all. [[User:Kzkzb|Kzkzb]] ([[User talk:Kzkzb|talk]]) 22:12, 19 June 2022 (UTC)

2544: Heart-Stopping Texts

2021-11-20T04:07:33Z

Kzkzb: /* Is this your house? */ add the fact that this might be a violation of privacy

{{comic
| number = 2544
| date = November 19, 2021
| title = Heart-Stopping Texts
| image = heart_stopping_texts.png
| titletext = Was this your car? [looping 'image loading' animation]
}}

==Explanation==
{{incomplete|Created by a LITERAL HEART STOPPING ROBOT - Please change this comment when editing this page. Do NOT delete this tag too soon.}}

Text messages have become a ubiquitous form of communication in most countries, and have become a basic part of many people's everyday lives. Conversations over text frequently jump straight to the purpose of the communication, without salutation or prelude. Some texts, particularly when delivered without context, can carry implications that cause immediate anxiety.

"Out of the blue" is an English expression meaning "to appear in a sudden and unexpected fashion". 'The blue' alludes to the clear daylight sky. Something arrived/appeared/dropped/flew "out of the blue" not just without warning, but there's no reason for you not to have seen it (e.g. looming out of a foggy night), which implies that it's not just a surprise, but even the fact that you are getting surprised by something is surprising.

This comic lists texts that would be worrying to receive with no context, for a variety of reasons. It seems to suggest that sending these is a good way to prank someone; particularly the title text, where deliberately sending an animated loading icon seems like it couldn't be intended for any other purpose. The different messages are explained below.

==== Did you forget what day it is? ====
This implies that the recipient forgot some important event happening today. This could be an important day to a spouse or friend, and a relationship can be damaged by the recipient having forgotten. Or it could mean that the recipient failed to deliver on an important commitment scheduled for that day, which can create a variety of other problems.

==== I bet you're probably getting bombarded with texts right now, huh? ====
This implies that something of major significance has happened, that would make many people want to get in touch with the recipient. There are a lot of possibilities, many of which are negative. The non-specific nature of the text leaves the recipient wondering what has happened, and how bad it is.

==== Did you mean to post that to everyone? ====
Implies that the recipient has made a public post (presumably on some social network) that was offensive or otherwise inappropriate to post publicly; so much so that the text sender is asking if they perhaps meant it to be forwarded to a more contained group or possibly not even revealed to anyone at all. This is a common occurrence as on many platforms it can be easy to accidentally post something with the wrong visibility or mis-click something private into a media post.

==== Is this your house? ====
{{w|CNN}} is a popular news outlet in the United States. This text implies that the recipient's house has for some reason been mentioned (or probably photographed) in a CNN article. This would mean that a newsworthy event has occurred there, or at least nearby. Many newsworthy events are upsetting, possibly dangerous (eg. a fire, a natural disaster, a violent crime, etc). This might also imply a violation of privacy, as many people would not want to have a picture of their house on national news.

==== You didn't click on any weird emails recently, did you? ====
{{w|Phishing}} is the practice of sending fraudulent messages in order to steal information (credentials, etc.), infect them with {{w|malware}}, or otherwise perform some undesirable action. One overwhelmingly common form of this is getting people to click on {{w|hyperlink|hyperlinks}} in emails, which generally purport to lead somewhere reputable but instead lead to somewhere controlled by the sender.

This text implies something makes the sender think that the recipient has fallen victim to such an attack. It's common for the victim of such an attack to not be the first to discover it. For example, some attacks hijack the victim's email, and use it to bombard everyone in their contact list with further phishing attempts. If the sender of this text had received such an email, they might suspect an attack. If this has already happened, it's likely to cause major problems.

==== Can I call? ====
While this is a seemingly benign and simple request, texting someone to ask if you can call is usually a sign that the conversation will be long and serious, and the sender wants to ensure that the other party is available for such a discussion. Many such situations are negative (ranging from a breakup to the death of a loved one), and there's a great deal of tension in knowing that something is serious, but not knowing what it is.

==== Wait, do you know Joe Rogan? How does he know your name? ====
{{w|Joe Rogan}} is a public personality, best known for his podcast {{w|The Joe Rogan Experience}}. This message implies that the recipient has been discussed by Rogan for some reason. Similarly to the CNN case, this is likely to cause worry about what possible circumstances would prompt this.

Joe Rogan has recently been in the news for his anti vaccine stance so some people may not want to be associated with him.

==== Why are you trending on Twitter? ====
{{w|Twitter}} is a social network, which – among other features – tracks and shows topics that are currently being discussed by a large number of users on the platform, or "trending". An individual trending across the entire network (unless that person is a public figure) is usually either because they're connected with a news story, or because something they did or wrote has gone viral. There are sufficiently many negative things that can cause such unexpected fame that hearing about it would be worrying..

Twitter in particular is known for frequently involving very heated discussion, and often even the targeting of individuals by mobs who perceive them to have done something wrong.

==== Was this your car? [looping 'image loading' animation] ====
(title text) The past tense ('was') implies that your car no longer exists, with the animation additionally implying an image or a video of it being damaged or destroyed. In addition, it might take a long time for the receiver to realize that the media will never load, during which they will be worried about their car without knowing what happened to it.

==Transcript==

:[Comic heading:]
:Most heart-stopping texts to receive out of the blue

:[A collection of light gray text bubbles in two columns:]

:Did you forget what day it is?

:I bet you're probably getting bombarded with texts right now, huh?

:Did you mean to post that to everyone?

:Is this your house? cnn.com/2021/11/19/S...

:You didn't click on any weird emails recently, did you?

:Can I call?

:Wait, do you know Joe Rogan? How does he know your name?

:Why are you trending on Twitter?

{{comic discussion}}
[[Category:Phones]]
[[Category:Social networking]]
[[Category:Comics featuring real people]]

2544: Heart-Stopping Texts

2021-11-20T04:03:12Z

Kzkzb: /* Was this your car? [looping 'image loading' animation] */ add the anxiety brought by the 'image loading' animation

{{comic
| number = 2544
| date = November 19, 2021
| title = Heart-Stopping Texts
| image = heart_stopping_texts.png
| titletext = Was this your car? [looping 'image loading' animation]
}}

==Explanation==
{{incomplete|Created by a LITERAL HEART STOPPING ROBOT - Please change this comment when editing this page. Do NOT delete this tag too soon.}}

Text messages have become a ubiquitous form of communication in most countries, and have become a basic part of many people's everyday lives. Conversations over text frequently jump straight to the purpose of the communication, without salutation or prelude. Some texts, particularly when delivered without context, can carry implications that cause immediate anxiety.

"Out of the blue" is an English expression meaning "to appear in a sudden and unexpected fashion". 'The blue' alludes to the clear daylight sky. Something arrived/appeared/dropped/flew "out of the blue" not just without warning, but there's no reason for you not to have seen it (e.g. looming out of a foggy night), which implies that it's not just a surprise, but even the fact that you are getting surprised by something is surprising.

This comic lists texts that would be worrying to receive with no context, for a variety of reasons. It seems to suggest that sending these is a good way to prank someone; particularly the title text, where deliberately sending an animated loading icon seems like it couldn't be intended for any other purpose. The different messages are explained below.

==== Did you forget what day it is? ====
This implies that the recipient forgot some important event happening today. This could be an important day to a spouse or friend, and a relationship can be damaged by the recipient having forgotten. Or it could mean that the recipient failed to deliver on an important commitment scheduled for that day, which can create a variety of other problems.

==== I bet you're probably getting bombarded with texts right now, huh? ====
This implies that something of major significance has happened, that would make many people want to get in touch with the recipient. There are a lot of possibilities, many of which are negative. The non-specific nature of the text leaves the recipient wondering what has happened, and how bad it is.

==== Did you mean to post that to everyone? ====
Implies that the recipient has made a public post (presumably on some social network) that was offensive or otherwise inappropriate to post publicly; so much so that the text sender is asking if they perhaps meant it to be forwarded to a more contained group or possibly not even revealed to anyone at all. This is a common occurrence as on many platforms it can be easy to accidentally post something with the wrong visibility or mis-click something private into a media post.

==== Is this your house? ====
{{w|CNN}} is a popular news outlet in the United States. This text implies that the recipient's house has for some reason been mentioned (or probably photographed) in a CNN article. This would mean that a newsworthy event has occurred there, or at least nearby. Many newsworthy events are upsetting, possibly dangerous (eg. a fire, a natural disaster, a violent crime, etc).

==== You didn't click on any weird emails recently, did you? ====
{{w|Phishing}} is the practice of sending fraudulent messages in order to steal information (credentials, etc.), infect them with {{w|malware}}, or otherwise perform some undesirable action. One overwhelmingly common form of this is getting people to click on {{w|hyperlink|hyperlinks}} in emails, which generally purport to lead somewhere reputable but instead lead to somewhere controlled by the sender.

This text implies something makes the sender think that the recipient has fallen victim to such an attack. It's common for the victim of such an attack to not be the first to discover it. For example, some attacks hijack the victim's email, and use it to bombard everyone in their contact list with further phishing attempts. If the sender of this text had received such an email, they might suspect an attack. If this has already happened, it's likely to cause major problems.

==== Can I call? ====
While this is a seemingly benign and simple request, texting someone to ask if you can call is usually a sign that the conversation will be long and serious, and the sender wants to ensure that the other party is available for such a discussion. Many such situations are negative (ranging from a breakup to the death of a loved one), and there's a great deal of tension in knowing that something is serious, but not knowing what it is.

==== Wait, do you know Joe Rogan? How does he know your name? ====
{{w|Joe Rogan}} is a public personality, best known for his podcast {{w|The Joe Rogan Experience}}. This message implies that the recipient has been discussed by Rogan for some reason. Similarly to the CNN case, this is likely to cause worry about what possible circumstances would prompt this.

Joe Rogan has recently been in the news for his anti vaccine stance so some people may not want to be associated with him.

==== Why are you trending on Twitter? ====
{{w|Twitter}} is a social network, which – among other features – tracks and shows topics that are currently being discussed by a large number of users on the platform, or "trending". An individual trending across the entire network (unless that person is a public figure) is usually either because they're connected with a news story, or because something they did or wrote has gone viral. There are sufficiently many negative things that can cause such unexpected fame that hearing about it would be worrying..

Twitter in particular is known for frequently involving very heated discussion, and often even the targeting of individuals by mobs who perceive them to have done something wrong.

==== Was this your car? [looping 'image loading' animation] ====
(title text) The past tense ('was') implies that your car no longer exists, with the animation additionally implying an image or a video of it being damaged or destroyed. In addition, it might take a long time for the receiver to realize that the media will never load, during which they will be worried about their car without knowing what happened to it.

==Transcript==

:[Comic heading:]
:Most heart-stopping texts to receive out of the blue

:[A collection of light gray text bubbles in two columns:]

:Did you forget what day it is?

:I bet you're probably getting bombarded with texts right now, huh?

:Did you mean to post that to everyone?

:Is this your house? cnn.com/2021/11/19/S...

:You didn't click on any weird emails recently, did you?

:Can I call?

:Wait, do you know Joe Rogan? How does he know your name?

:Why are you trending on Twitter?

{{comic discussion}}
[[Category:Phones]]
[[Category:Social networking]]
[[Category:Comics featuring real people]]

2544: Heart-Stopping Texts

2021-11-20T03:55:52Z

Kzkzb: /* Explanation */ copy edits

{{comic
| number = 2544
| date = November 19, 2021
| title = Heart-Stopping Texts
| image = heart_stopping_texts.png
| titletext = Was this your car? [looping 'image loading' animation]
}}

==Explanation==
{{incomplete|Created by a LITERAL HEART STOPPING ROBOT - Please change this comment when editing this page. Do NOT delete this tag too soon.}}

Text messages have become a ubiquitous form of communication in most countries, and have become a basic part of many people's everyday lives. Conversations over text frequently jump straight to the purpose of the communication, without salutation or prelude. Some texts, particularly when delivered without context, can carry implications that cause immediate anxiety.

"Out of the blue" is an English expression meaning "to appear in a sudden and unexpected fashion". 'The blue' alludes to the clear daylight sky. Something arrived/appeared/dropped/flew "out of the blue" not just without warning, but there's no reason for you not to have seen it (e.g. looming out of a foggy night), which implies that it's not just a surprise, but even the fact that you are getting surprised by something is surprising.

This comic lists texts that would be worrying to receive with no context, for a variety of reasons. It seems to suggest that sending these is a good way to prank someone; particularly the title text, where deliberately sending an animated loading icon seems like it couldn't be intended for any other purpose. The different messages are explained below.

==== Did you forget what day it is? ====
This implies that the recipient forgot some important event happening today. This could be an important day to a spouse or friend, and a relationship can be damaged by the recipient having forgotten. Or it could mean that the recipient failed to deliver on an important commitment scheduled for that day, which can create a variety of other problems.

==== I bet you're probably getting bombarded with texts right now, huh? ====
This implies that something of major significance has happened, that would make many people want to get in touch with the recipient. There are a lot of possibilities, many of which are negative. The non-specific nature of the text leaves the recipient wondering what has happened, and how bad it is.

==== Did you mean to post that to everyone? ====
Implies that the recipient has made a public post (presumably on some social network) that was offensive or otherwise inappropriate to post publicly; so much so that the text sender is asking if they perhaps meant it to be forwarded to a more contained group or possibly not even revealed to anyone at all. This is a common occurrence as on many platforms it can be easy to accidentally post something with the wrong visibility or mis-click something private into a media post.

==== Is this your house? ====
{{w|CNN}} is a popular news outlet in the United States. This text implies that the recipient's house has for some reason been mentioned (or probably photographed) in a CNN article. This would mean that a newsworthy event has occurred there, or at least nearby. Many newsworthy events are upsetting, possibly dangerous (eg. a fire, a natural disaster, a violent crime, etc).

==== You didn't click on any weird emails recently, did you? ====
{{w|Phishing}} is the practice of sending fraudulent messages in order to steal information (credentials, etc.), infect them with {{w|malware}}, or otherwise perform some undesirable action. One overwhelmingly common form of this is getting people to click on {{w|hyperlink|hyperlinks}} in emails, which generally purport to lead somewhere reputable but instead lead to somewhere controlled by the sender.

This text implies something makes the sender think that the recipient has fallen victim to such an attack. It's common for the victim of such an attack to not be the first to discover it. For example, some attacks hijack the victim's email, and use it to bombard everyone in their contact list with further phishing attempts. If the sender of this text had received such an email, they might suspect an attack. If this has already happened, it's likely to cause major problems.

==== Can I call? ====
While this is a seemingly benign and simple request, texting someone to ask if you can call is usually a sign that the conversation will be long and serious, and the sender wants to ensure that the other party is available for such a discussion. Many such situations are negative (ranging from a breakup to the death of a loved one), and there's a great deal of tension in knowing that something is serious, but not knowing what it is.

==== Wait, do you know Joe Rogan? How does he know your name? ====
{{w|Joe Rogan}} is a public personality, best known for his podcast {{w|The Joe Rogan Experience}}. This message implies that the recipient has been discussed by Rogan for some reason. Similarly to the CNN case, this is likely to cause worry about what possible circumstances would prompt this.

Joe Rogan has recently been in the news for his anti vaccine stance so some people may not want to be associated with him.

==== Why are you trending on Twitter? ====
{{w|Twitter}} is a social network, which – among other features – tracks and shows topics that are currently being discussed by a large number of users on the platform, or "trending". An individual trending across the entire network (unless that person is a public figure) is usually either because they're connected with a news story, or because something they did or wrote has gone viral. There are sufficiently many negative things that can cause such unexpected fame that hearing about it would be worrying..

Twitter in particular is known for frequently involving very heated discussion, and often even the targeting of individuals by mobs who perceive them to have done something wrong.

==== Was this your car? [looping 'image loading' animation] ====
(title text) The past tense ('was') implies that your car no longer exists, with the animation additionally implying a video of it being damaged or destroyed.

==Transcript==

:[Comic heading:]
:Most heart-stopping texts to receive out of the blue

:[A collection of light gray text bubbles in two columns:]

:Did you forget what day it is?

:I bet you're probably getting bombarded with texts right now, huh?

:Did you mean to post that to everyone?

:Is this your house? cnn.com/2021/11/19/S...

:You didn't click on any weird emails recently, did you?

:Can I call?

:Wait, do you know Joe Rogan? How does he know your name?

:Why are you trending on Twitter?

{{comic discussion}}
[[Category:Phones]]
[[Category:Social networking]]
[[Category:Comics featuring real people]]