Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Enabling Secure HTTP for BBC Online

bbc.co.uk

Post reply on HN
Print view View original

41–50 of 63 posts

Re: Enabling Secure HTTP for BBC Online

#41

Post by Symbiote »

reedloden wrote: post #39
0x0 wrote: post #37

Earlier quoted context omitted.

I don't think you can just run 'sed' on any random iOS app, any random symbian app, any random smart-TV app, some other guy's service that hits your APIs and feeds, and so on... :)

Now, that could be a valid issue, indeed, though not sure for how long I care about those devices continuing to work without any valid upgrade path... Using things like HSTS and CSP's `upgrade-insecure-requests` would help here for clients that do support it.

You might not care, but the BBC does — it's one of the issues they mention in the blog post.

If the BBC "channels" stopped working, but other providers' content continues to work, the BBC would be blamed.

Re: Enabling Secure HTTP for BBC Online

#42

Post by _uhtu »

gilgongo wrote: post #35
vtlynch wrote: post #29

Earlier quoted context omitted.

Washington Post. Buzzfeed. The Guardian. New York Times still dosent have HTTPs.

Their traffic is too high for them to afford it (and probably wouldn't outweigh the SEO uplift)

Can I ask you why you say it would be too high for NYT to afford it, when many companies with significantly more traffic have site-wide TLS?

Re: Enabling Secure HTTP for BBC Online

#43

Post by _uhtu »

blowski wrote: post #22
witty_username wrote: post #16

Earlier quoted context omitted.

> It hasn't been "standard on full sites for years", and still isn't now. I'd estimate about 75% of the time I'm on an HTTPS website. > The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard. This is insecure as the HTTP page can redirect to a malicious HTTPS page from a different domain.

I agree with the need for the BBC to do this. But I disagree with the OP's suggestion that, just because it took them until now to finish doing it, that I should be "afraid of their security practices".

The "afraid of the security practices" was more of a joke than an actual serious jab. But I do still hold that site-wide TLS should be default by all major websites at this point in time.

Re: Enabling Secure HTTP for BBC Online

#44

Post by wanda »

Karunamon wrote: post #31
reedloden wrote: post #26

> There are always practical limitations to site-wide technical changes, and HTTPS Everywhere is no different. Sites and content we consider ‘archival’ that involve no signing in or personalisation, such as the News Online archive on news.bbc.co.uk, will remain HTTP-only. This is due to the cost we’d incur processing tens of millions of old files to rewrite internal links to HTTPS when balanced against the benefit. N…

Sites and content we consider ‘archival’ that involve no signing in or personalisation, AUGH ! Seeing this "SSL is just for private things" mindset in 2016 is really disheartening. It's to keep people from screwing with your connection, not just snooping on it. I really hope the browser vendors start treating HTTP the same way they treat broken certs sometime soon. This will change once users start asking, en masse,…

Pretty sure a diluted form of the broken cert treatment for HTTP is available behind a flag in Chrome, so it might be in the pipeline.

Source: http://peter.sh/experiments/chromium-command-line-switches/

See:

    --mark-insecure-as

Re: Enabling Secure HTTP for BBC Online

#45

Post by pragmar »

reedloden wrote: post #26

> There are always practical limitations to site-wide technical changes, and HTTPS Everywhere is no different. Sites and content we consider ‘archival’ that involve no signing in or personalisation, such as the News Online archive on news.bbc.co.uk, will remain HTTP-only. This is due to the cost we’d incur processing tens of millions of old files to rewrite internal links to HTTPS when balanced against the benefit. N…

I think this trivializes the scope of what the BBC developed. Even with well automated processes, you'd still want a human doing light QA given the wide diversity of content. The BBC has been at it for over twenty years building ad hoc minisites[1]--sites so far down the long tail, that if forced to choose, they may be more prone to pull the plug than to maintain.

[1] http://news.bbc.co.uk/nol/ukfs_news/hi/uk_politics/vote_2005...

Re: Enabling Secure HTTP for BBC Online

#46

Post by seanwilson »

reedloden wrote: post #26

> There are always practical limitations to site-wide technical changes, and HTTPS Everywhere is no different. Sites and content we consider ‘archival’ that involve no signing in or personalisation, such as the News Online archive on news.bbc.co.uk, will remain HTTP-only. This is due to the cost we’d incur processing tens of millions of old files to rewrite internal links to HTTPS when balanced against the benefit. N…

> Not to be snarky, but haven't people written tools to help with this? This seems like a common issue. I mean, there's `sed` and similar tools, obviously, but something that could go, validate that the link works over https://, and update it. I don't see why that would need to be some monumental amount of work.

Not as trivial as you'd think: if there's an HTTP URL on the page when it should be HTTPS, how did the URL end up there? Dynamically from PHP code? Dynamically from JavaScript code? Did the URL come from a database? Did the URL come from an environment variable? It can be a lot of work to track all these down and a lot of them you won't be able to find using grep/sed e.g. URLs might appear as relative URLs in code with the "http" part being added dynamically.

You'll get insecure content warnings as well if you try to load HTTP images, css, iframes or JavaScript on an HTTPS page. Likewise, the URL for these can come from lots of places.

Re: Enabling Secure HTTP for BBC Online

#47

Post by jamespo »

dajohnson89 wrote: post #7

It was gutsy (and insightful) of them to publish to the world their upgrade experience. I wish people would be a little more positive about that instead of pointing out how much they suck.

A lot of people think they know better and think it's just a case of a few webserver directives, but have no idea of the scope of the BBC content.

Re: Enabling Secure HTTP for BBC Online

#49

Post by chriswwweb »

chriswwweb wrote: post #48

I don't get it ... for me their entire website is still http only, even if I add https myself I always get redirected back to http

Ah ok I see https://www.bbc.co.uk/travel is now https, but https://www.bbc.com still redirects me to the http version, I thought when they mentioned their "domestic" website they were talking about www.bbc.com or www.bbc.co.uk ... funny even their blog post that informs us about their https support can only be accessed through http ;)

Re: Enabling Secure HTTP for BBC Online

#50

Post by jsingleton »

Although this is good news, it will stop me from injecting a hidden breaking news banner to stop it popping up. Should still be able to block the domain, but that won't cache for as long when off WiFi. [^1]

At least this will stop ISPs like BT from doing deep packet inspection and serving stale pages from their cache. Once it's been rolled out to the news site over the next year, of course.

If they use ChaCha-Poly then the load on low power devices shouldn't be much. I did a lot of reading on this for my recent book and it's pretty good for devices lacking hardware AES acceleration.

[^1]: https://unop.uk/block-bbc-breaking-news-on-all-devices

Post reply on HN