Oh no, this was my go-to site whenever I had to login to public wifi and https wouldn't redirect :(
I just run `curl -v http://google.com` in my termainl and click the redirect link. No risk of caching that way.
HTTPS on NYTimes.com
121–130 of 167 posts
Re: HTTPS on NYTimes.com
#122It's nice to see more news media moving towards using HTTPS. NYTimes now joins a small club, alongside the Guardian and the Washington Post. Here's a dev blog post on the WaPo moving to https: https://developer.washingtonpost.com/pb/blog/post/2015/12/10... And one on the Guardian moving to https: https://www.theguardian.com/info/developer-blog/2016/nov/29/...
Still waiting for Ars Technica to roll that out (for non subscribers)...
Does Ars Technica support HTTPS for subscribers? That's an interesting option for sharing the support cost of HTTPS hosting.
Re: HTTPS on NYTimes.com
#123Earlier quoted context omitted.
> OV are considered more secure than DV due to the higher registration requirements[0] Nonsense. OV is no more secure than DV, just more expensive.
To be fair, it's more secure in the sense that someone who gets access to their domain name service can't generate their own OV cert without more access. They could however create their own DV cert. So while it uses the same technology, if you see an OC cert you can be more sure that it's the actual organization and not a cert that just proves that the domain is the domain.
But unless clients or humans do anything in response to the extra OV information, or in response to a lack of the extra OV information, that information has no security value.
No browsers do anything with OV data unless humans manually take action to examine the certificate. So I'm comfortable saying they offer negligible security value.
Re: HTTPS on NYTimes.com
#124I'm curious of what's the technologies that are only available with https mentioned in the post. Service workers?
Re: HTTPS on NYTimes.com
#125Oh no, this was my go-to site whenever I had to login to public wifi and https wouldn't redirect :(
Relevant xkcd: https://xkcd.com/1172/
Re: HTTPS on NYTimes.com
#126I'm curious of what's the technologies that are only available with https mentioned in the post. Service workers?
HTTP/2 only supports HTTPS, which means HTTP connections don't benefit from HTTP/2's speed improvements. In addition, recent versions of Chrome only allow use of the location API by sites served over HTTPS. These are just two immediate examples that come to mind, but more exist.
Re: HTTPS on NYTimes.com
#127Finally. Redirecting from https to http is quite annoying.
Re: HTTPS on NYTimes.com
#128Earlier quoted context omitted.
What happens with local LAN machines, like the admin webpage for your wireless access point? It's not like they can go HTTPS?
This is an issue we're encountering. One solution is trust on first use of a self signed cert, which makes the scary untrusted page a one time cost. This isn't terribly easy in the browser though. With more IOT devices entering the market, this could become a more common issue. Using https for a local network connection will also be more common, in the case you decide you don't trust the network.
I think for the case of the home router admin page (or really any admin page on your local network), the browser can easily detect that it's being served a page on the local net, and could provide a less scary warning that has some text that acknowledges that you're on your local net and that either ignoring the password form security warning (for http) or accepting the self-signed cert (for https) is probably ok. Whether they'll do this is another question...
Re: HTTPS on NYTimes.com
#129Earlier quoted context omitted.
Still waiting for Ars Technica to roll that out (for non subscribers)...
Does Ars Technica support HTTPS for subscribers? That's an interesting option for sharing the support cost of HTTPS hosting.
Is that still a thing? My understanding was that https these days adds very little to the cost of hosting a site, given hardware accelerated crypto being more prevalent, and other niceties.
Re: HTTPS on NYTimes.com
#130They mention it has been a complex undertaking and not complete yet - does anyone know why they can't just sit a traffic manager in front of everything with SSL offloading? Also does anyone know what the new personalisation features are that they mention being able to offer now HTTPS in place?
At any large media organization, there are tremendous amounts of content no longer connected to any CMS that may have hard-coded insecure links/resources in them. Some of them may live on obscure servers or domains. Or the developers/journalists who worked on them and have knowledge of their construction are long gone. These pages are very laborious to find and update. If you don't mind 404ing or breaking a ton of yo…
You also mention "insecure resources", wich I think is a big deal too. I'd imagine there'd be the oddA hard-coded http link to an image that serves an important purpose to an article... that suddenly going missing because a browser refuses to load it would be bad.
But I think you hit the nail on the head -- being the "newspaper of record" means you want to ensure that all your content displays like it did the day it was published.