Can someone tell me why this might have been required? What are the situations which might prompt a developer to make their users use http instead of https?
Legacy site/infrastructure that hasn't (or can't) be upgraded?
US Senate website says use HTTP instead of HTTPS
11–20 of 129 posts
Re: US Senate website says use HTTP instead of HTTPS
#12Weird, they're hosted on Akamai. Even weirder, it doesn't appear that www.senate.gov supports IPv6.
What's weird about them not supporting ipv6?
Well, briefly - the General Service Administration declared "By September 30, 2014, agencies needed to update their public networks to Internet Protocol Version 6 (IPv6)"
There is an exception process, but Akamai already supports IPv6 (though they do charge extra for it, booo!). You'd like to think something as high visibility (PR, not web traffic) as senate.gov would comply with the GSA.
Re: US Senate website says use HTTP instead of HTTPS
#13And it's OK. This "HTTPS everywhere" concept is damaging. I think it should be revised. The amount of overhead and the lack of ability to optimize encrypted content for transferring over, say, satellite or other radio links, is bad. Lots of people still use very expensive (>$2,000 per Mbps) long-RTT connections that would benefit immensely from content optimization techniques. And most of them are cost-sensitive because they live in developing countries.
Re: US Senate website says use HTTP instead of HTTPS
#14And it's OK. This "HTTPS everywhere" concept is damaging. I think it should be revised. The amount of overhead and the lack of ability to optimize encrypted content for transferring over, say, satellite or other radio links, is bad. Lots of people still use very expensive (>$2,000 per Mbps) long-RTT connections that would benefit immensely from content optimization techniques. And most of them are cost-sensitive beca…
Wouldn't that be a whole new level of "premature optimization"? Serve https by default and also http for those still needs it for the reasons you outline.
Re: US Senate website says use HTTP instead of HTTPS
#15I also noticed it seems blocked from access outside the US...
so what would happen if a traveling american wants to access it?
edit: FYI I'm trying from Kenya. edit2: Using my phone I'm able to switch between wifi, and mobile and on mobile it is unblocked. hmmm
Also for those who don't see the Access Denied page but are curious, here is what it reads in full.
--------------------
Access Denied
You don't have permission to access "http://serve-403-www.senate.gov/" on this server. Reference #xx.xxxxxxxx.xxxxxxxxxx.xxxxxxxx
---------------------
It seems it has little to do with geography. It's an IP thing.
Re: US Senate website says use HTTP instead of HTTPS
#16And it's OK. This "HTTPS everywhere" concept is damaging. I think it should be revised. The amount of overhead and the lack of ability to optimize encrypted content for transferring over, say, satellite or other radio links, is bad. Lots of people still use very expensive (>$2,000 per Mbps) long-RTT connections that would benefit immensely from content optimization techniques. And most of them are cost-sensitive beca…
Something like gzip that "all" browsers and servers support? Which i would belive more than makes up for any https overhead.
Re: US Senate website says use HTTP instead of HTTPS
#17Can someone tell me why this might have been required? What are the situations which might prompt a developer to make their users use http instead of https?
Just a wild guess, but if there are non secure assets in the page, this would result in a browser warning, arguably more suspicious looking than this for average users. As a quick and dirty workaround they may have done this?
Interestingly, some of the subdomains like https://www.budget.senate.gov/ use the same certificate and do allow you to load their pages with mixed sources. If this was the idea, it was done fairly shoddy.. more than a few sites in the 'Alternative Name' field will still load.
Re: US Senate website says use HTTP instead of HTTPS
#18I also noticed it seems blocked from access outside the US... so what would happen if a traveling american wants to access it? edit: FYI I'm trying from Kenya. edit2: Using my phone I'm able to switch between wifi, and mobile and on mobile it is unblocked. hmmm Also for those who don't see the Access Denied page but are curious, here is what it reads in full. -------------------- Access Denied You don't have permissi…
Nope, I'm in Italy and can access it from here.
Re: US Senate website says use HTTP instead of HTTPS
#19And it's OK. This "HTTPS everywhere" concept is damaging. I think it should be revised. The amount of overhead and the lack of ability to optimize encrypted content for transferring over, say, satellite or other radio links, is bad. Lots of people still use very expensive (>$2,000 per Mbps) long-RTT connections that would benefit immensely from content optimization techniques. And most of them are cost-sensitive beca…
The trade-off is worth it. By a large margin.
Re: US Senate website says use HTTP instead of HTTPS
#20I also noticed it seems blocked from access outside the US... so what would happen if a traveling american wants to access it? edit: FYI I'm trying from Kenya. edit2: Using my phone I'm able to switch between wifi, and mobile and on mobile it is unblocked. hmmm Also for those who don't see the Access Denied page but are curious, here is what it reads in full. -------------------- Access Denied You don't have permissi…
Not blocked in the Netherlands, but it opens the https version , which displays the following error:
The submitted https request was not able to be completed at this time.
Please retry your request using http. This may require disabling some browser based plug-ins.
Clicking the provided link causes a redirect loop(i.e. the http version redirects back to https)