Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Users will only be able to view patents via HTTP. HTTPS will no longer work”

uspto.gov

Post reply on HN
Print view View original

71–80 of 172 posts

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#71

Post by fiatjaf »

vesinisa wrote: post #22

The USPTO databases have to be one of the most torturous services to their users in the whole of internet. The UI of both the patent and trademark search is archaic, but not in a HN way but in a really bad way. In patent search, there is no "search" box. Instead, the "quick search" forces you to specify two (and exactly two) text queries on the database columns with obligatory boolean operation.[1] Even if you happen…

The bizarre practice of assigning session keys to visitors and somehow storing the page they're viewing in the server instead of in the URL is pretty common in Brazilian government, which is dominated by Java programmers.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#73

Post by shif »

snvzz wrote: post #29

Fun fact: HSTS https://securityheaders.io/?q=www.uspto.gov&followRedirects=... HSTS is 1 year at the time this comment is posted. They're in for some pain.

chrome://net-internals/#hsts

doesn't seem to show anything for the domain

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#74

Post by shif »

makecheck wrote: post #23

This would be interesting for patent research; you could legitimately say "I looked for a patent that already covers X but since you cannot guarantee the data was not modified in transit, I cannot be certain that I saw what was actually in the patents I reviewed".

HTTPS isn't bulletproof either, the argument could still be made with TLS

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#75

Post by shif »

drc0 wrote: post #31
chickenfries wrote: post #21

Earlier quoted context omitted.

Drupal is all over government sites. So is Wordpress. Do you expect them to be using closed source CMSs or something? (I get that Drupal is insecure, but no, it's not "illegal" to use Drupal...)

"Drupal is insecure", why?

https://www.cvedetails.com/product/2387/Drupal-Drupal.html?v...

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#76

Post by paulddraper »

makecheck wrote: post #23

This would be interesting for patent research; you could legitimately say "I looked for a patent that already covers X but since you cannot guarantee the data was not modified in transit, I cannot be certain that I saw what was actually in the patents I reviewed".

You also can't verify that the CA isn't rogue.

Or that the browser vendors that trust the CA the signed the certificate aren't just puppets for our lizard overlords.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#77

Post by paulddraper »

shif wrote: post #72

That's regressive as fuck, it's like saying that cars will no longer be allowed, only horse carriages

The gap between those two technologies is larger than you suggest.

Horse carraiges: 1400 Automobiles: 1890

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#78

Post by umhau »

cryptarch wrote: post #26

Anyone looking at creating an IPFS or BitTorrent mirror yet? Edit: the PDF attachment URL's are very predictable, they're the number of the patent in a weird order + a page number, e.g.: http://pdfpiw.uspto.gov/10/292/096/2.pdf Back of the envelope calculations say all PDF's should only take 1 - 6 TB's (assuming 100kb to 600kb in PDF's on average). Seriously, why hasn't anyone mirrored this?

Legal issues from mirroring something that's sort-of government property? I have no idea if it is or not, but I'd guess it's some sort of grey area.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#79

Post by progval »

fiatjaf wrote: post #71
vesinisa wrote: post #22

The USPTO databases have to be one of the most torturous services to their users in the whole of internet. The UI of both the patent and trademark search is archaic, but not in a HN way but in a really bad way. In patent search, there is no "search" box. Instead, the "quick search" forces you to specify two (and exactly two) text queries on the database columns with obligatory boolean operation.[1] Even if you happen…

The bizarre practice of assigning session keys to visitors and somehow storing the page they're viewing in the server instead of in the URL is pretty common in Brazilian government, which is dominated by Java programmers.

A Java app of my university does this too. Is this a practice shared by most Java programmers? How come?

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#80

Post by copperx »

jagger27 wrote: post #66
jbob2000 wrote: post #13

Earlier quoted context omitted.

Well if you put on your tinfoil hat - maybe someone wants to track who's viewing which patents, which they can't do when it's encrypted. You're right, it doesn't make any sense to do this, so there must be an ulterior motive.

Tracking users over HTTPS is a solved problem, so I doubt that'd be it. Something about "never attribute to malice that which can be adequately explained by incompetence"?

What do you mean by that? Is knowing the URL of a HTTPS request a solved problem?
Post reply on HN