Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Users will only be able to view patents via HTTP. HTTPS will no longer work”

uspto.gov

Post reply on HN
Print view View original

41–50 of 172 posts

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#41

Post by sgt101 »

mcbits wrote: post #27
stonesam92 wrote: post #16

Earlier quoted context omitted.

If that were the case and USPTO were in on the trick, why the need to drop HTTPS? They'd have that data already, so could just share it directly.

This will allow ISPs to track who is viewing particular patents and when. That would be very lucrative data to sell in some circumstances. I doubt the USPTO would distribute a list of IP addresses that accessed a patent without some kind of due process.

I think this might be gutted out already though as big companies use proprietary databases which have enhanced data on the patents. Also google patents...

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#42

Post by mthoms »

a3n wrote: post #34
popey456963 wrote: post #4

Why on Earth could they possibly feel it necessary to do this? The United States Patent Office doesn't have a complex system of sub-domains or even an EV license, if money were the object then they could just go with Let's Encrypt (not to mention the current license continues until 2018 anyway). The amount of computing power it takes to encrypt with SSL is minimal, especially if you use some of the newer systems like…

Maybe they fired or lost the only person left who understood how it works, it broke, and whoever they yanked across the hall to get it going again could only do it this way. I think there's still a govt-wide hiring freeze.

TL;DR - They decided to give the job to Jared Kushner.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#43

Post by vesinisa »

tinlicker wrote: post #32
vesinisa wrote: post #22

The USPTO databases have to be one of the most torturous services to their users in the whole of internet. The UI of both the patent and trademark search is archaic, but not in a HN way but in a really bad way. In patent search, there is no "search" box. Instead, the "quick search" forces you to specify two (and exactly two) text queries on the database columns with obligatory boolean operation.[1] Even if you happen…

See also the HTTP shopping cart: http://ebiz1.uspto.gov/vision-service/ShoppingCart_P/ShowSho... Probably the only thing keeping this from being abused is that it's the government, it's a low-value target, and they're paying millions upon millions for someone to support this trainwreck with security patches.

Of course - obscure as it gets, session state based navigation and top of it off with username/password form over unencrypted HTTP.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#44

Post by corrigible »

Karunamon wrote: post #17
doubleplusgood wrote: post #14

Earlier quoted context omitted.

TLS offload is usually extra on F5 BigIP

Does F5 do any special secret sauce that can't be replicated with an equally powerful set of hardware and a good HAProxy config? I know one of our network admins is continually complaining about how shitty their UI is...

Not an expert, but the last BIG-IP LTM I saw a couple of months ago didn't support TLS acceleration without a dedicated hardware module (and the accompanying license); this would usually mean upgrading to a more expensive model.

Plain old TLS termination isn't license-limited as far as I know.

EDIT: to answer your question, yes, you could probably do it with haproxy, but the added value in these appliances is iRules (TCL hooks for all network events, you could augment request processing etc) and vendor support.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#45

Post by xorcist »

Karunamon wrote: post #17
doubleplusgood wrote: post #14

Earlier quoted context omitted.

TLS offload is usually extra on F5 BigIP

Does F5 do any special secret sauce that can't be replicated with an equally powerful set of hardware and a good HAProxy config? I know one of our network admins is continually complaining about how shitty their UI is...

F5 has some secret sauce to it but it's mostly performance related. They have a good chunk of hardware offloading, all the way up to the TLS layer.

I seem to remember even the entry license includes full TLS offloading so I doubt the poster above is correct that it is a cost issue.

As to if HAProxy can do the job, well, that depends. F5s are complex beasts and they can load balance application specific protocols that can be hard to find elsewhere, with the support contract that goes with it.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#46

Post by mdekkers »

Karunamon wrote: post #17
doubleplusgood wrote: post #14

Earlier quoted context omitted.

TLS offload is usually extra on F5 BigIP

Does F5 do any special secret sauce that can't be replicated with an equally powerful set of hardware and a good HAProxy config? I know one of our network admins is continually complaining about how shitty their UI is...

Does F5 do any special secret sauce that can't be replicated with an equally powerful set of hardware and a good HAProxy config?

Not unless you think "extract a lot of money from clueless execs" is secret sauce. That, and support contracts - you know, throats to choke when it all goes wrong.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#47

Post by cjhanks »

chickenfries wrote: post #21
cjhanks wrote: post #15

Also, at the bottom of the page "This page is owned by Service Desk." What does that mean? And it's legal to publish a .GOV site using Drupal?

Drupal is all over government sites. So is Wordpress. Do you expect them to be using closed source CMSs or something? (I get that Drupal is insecure, but no, it's not "illegal" to use Drupal...)

I have no idea.

The US Federal Government is essentially the arbiter of all regulations and minimum standards within the United States. It's just surprising to see an opensource framework running on Apache/Coyote expected to run over HTTP.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#48

Post by zkms »

jbob2000 wrote: post #13
popey456963 wrote: post #4

Why on Earth could they possibly feel it necessary to do this? The United States Patent Office doesn't have a complex system of sub-domains or even an EV license, if money were the object then they could just go with Let's Encrypt (not to mention the current license continues until 2018 anyway). The amount of computing power it takes to encrypt with SSL is minimal, especially if you use some of the newer systems like…

Well if you put on your tinfoil hat - maybe someone wants to track who's viewing which patents, which they can't do when it's encrypted. You're right, it doesn't make any sense to do this, so there must be an ulterior motive.

> Well if you put on your tinfoil hat - maybe someone wants to track who's viewing which patents, which they can't do when it's encrypted.

No, a third-party attacker can just look at size/timing of packets to figure out which page is being viewed, especially given it's among a limited and static corpus.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#49

Post by mcbits »

sgt101 wrote: post #41
mcbits wrote: post #27

Earlier quoted context omitted.

This will allow ISPs to track who is viewing particular patents and when. That would be very lucrative data to sell in some circumstances. I doubt the USPTO would distribute a list of IP addresses that accessed a patent without some kind of due process.

I think this might be gutted out already though as big companies use proprietary databases which have enhanced data on the patents. Also google patents...

Yeah, I don't think it's actually their reason for the change. It's just one hypothetical consequence that the decision makers probably failed to consider. Still, the decision makers should be investigated for conflicts of interest because they've made a really fishy-smelling decision.
Post reply on HN