Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US Senate website says use HTTP instead of HTTPS

senate.gov

Post reply on HN
Print view View original

21–30 of 129 posts

Re: US Senate website says use HTTP instead of HTTPS

#21

Post by viraptor »

blackhaz wrote: post #13

And it's OK. This "HTTPS everywhere" concept is damaging. I think it should be revised. The amount of overhead and the lack of ability to optimize encrypted content for transferring over, say, satellite or other radio links, is bad. Lots of people still use very expensive (>$2,000 per Mbps) long-RTT connections that would benefit immensely from content optimization techniques. And most of them are cost-sensitive beca…

You mean that super costly 1KB in front of a request that pulls extra megabyte of data on a typical website? I really hope you missed a /s

Re: US Senate website says use HTTP instead of HTTPS

#22

Post by nihonde »

demarq wrote: post #15

I also noticed it seems blocked from access outside the US... so what would happen if a traveling american wants to access it? edit: FYI I'm trying from Kenya. edit2: Using my phone I'm able to switch between wifi, and mobile and on mobile it is unblocked. hmmm Also for those who don't see the Access Denied page but are curious, here is what it reads in full. -------------------- Access Denied You don't have permissi…

I can see the http version in Japan.

Re: US Senate website says use HTTP instead of HTTPS

#23

Post by beedogs »

blackhaz wrote: post #13

And it's OK. This "HTTPS everywhere" concept is damaging. I think it should be revised. The amount of overhead and the lack of ability to optimize encrypted content for transferring over, say, satellite or other radio links, is bad. Lots of people still use very expensive (>$2,000 per Mbps) long-RTT connections that would benefit immensely from content optimization techniques. And most of them are cost-sensitive beca…

This is almost as bad as when people were arguing against long signatures on Usenet.

https is the least of your worries in terms of overhead.

Re: US Senate website says use HTTP instead of HTTPS

#24

Post by raimille1 »

Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted?

Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.

Re: US Senate website says use HTTP instead of HTTPS

#25

Post by blowski »

klez wrote: post #18
demarq wrote: post #15

I also noticed it seems blocked from access outside the US... so what would happen if a traveling american wants to access it? edit: FYI I'm trying from Kenya. edit2: Using my phone I'm able to switch between wifi, and mobile and on mobile it is unblocked. hmmm Also for those who don't see the Access Denied page but are curious, here is what it reads in full. -------------------- Access Denied You don't have permissi…

Nope, I'm in Italy and can access it from here.

UK here. No problems viewing the https and http pages.

Re: US Senate website says use HTTP instead of HTTPS

#26

Post by SFJulie »

blowski wrote: post #8
sacheendra wrote: post #2

Can someone tell me why this might have been required? What are the situations which might prompt a developer to make their users use http instead of https?

At a guess, it was built years ago by an agency selected on the basis of anything other than technical competence. As a result it probably has thousands of hard coded HTTP links and an oddly configured out of date web server. Given the 'encryption is only used by terrorists' climate, spending the time and money to make it work for https sounds like a hard sell. No sources, but I have done some work in UK public secto…

Well it does the job, and if it aint broken why fix it?

Re: US Senate website says use HTTP instead of HTTPS

#27

Post by reustle »

nihonde wrote: post #22
demarq wrote: post #15

I also noticed it seems blocked from access outside the US... so what would happen if a traveling american wants to access it? edit: FYI I'm trying from Kenya. edit2: Using my phone I'm able to switch between wifi, and mobile and on mobile it is unblocked. hmmm Also for those who don't see the Access Denied page but are curious, here is what it reads in full. -------------------- Access Denied You don't have permissi…

I can see the http version in Japan.

I can't see either version in Tokyo. Both give me access denied.

Re: US Senate website says use HTTP instead of HTTPS

#28

Post by blowski »

blackhaz wrote: post #13

And it's OK. This "HTTPS everywhere" concept is damaging. I think it should be revised. The amount of overhead and the lack of ability to optimize encrypted content for transferring over, say, satellite or other radio links, is bad. Lots of people still use very expensive (>$2,000 per Mbps) long-RTT connections that would benefit immensely from content optimization techniques. And most of them are cost-sensitive beca…

So serve the same content over both http and https and let the user choose.

That said, if making the site very low bandwidth were the goal I would start by removing the pointless images.

Re: US Senate website says use HTTP instead of HTTPS

#29

Post by MichaelGG »

raimille1 wrote: post #24

Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.

No reason for it not to. And certainly I could find some fun uses of changing information for visitors to a .gov site.

Re: US Senate website says use HTTP instead of HTTPS

#30

Post by mike-cardwell »

raimille1 wrote: post #24

Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.

If you visit any non-https site, then you leave a vector wide open for a MITM to perform numerous types of attacks. Not just against the unencrypted site you're visiting. They can launch phishing attacks or CSRF attacks or inject malware.

If every site were https, then that would provide a huge boost to peoples privacy and security.

Post reply on HN