Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Users will only be able to view patents via HTTP. HTTPS will no longer work”

uspto.gov

Post reply on HN
Print view View original

91–100 of 172 posts

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#91

Post by jagger27 »

copperx wrote: post #80
jagger27 wrote: post #66

Earlier quoted context omitted.

Tracking users over HTTPS is a solved problem, so I doubt that'd be it. Something about "never attribute to malice that which can be adequately explained by incompetence"?

What do you mean by that? Is knowing the URL of a HTTPS request a solved problem?

What I mean is that if a third party wanted tracking info all they'd have to do is pay for a tracking script to be injected. Let's say the patent office is okay with this. Why wouldn't they just include a instead of going through the trouble of disabling HTTPS just so a third party can get their eyes on the juicy information? Just as easily, patent office could sell access logs to interested parties. In that not-very-roundabout way, knowing the URL and who wants it is very much a solved problem.

If third party tracking (for malicious intent or otherwise) is the main reason behind the change, why not do it how everyone else does?

It stands to reason they just don't want to deal with SSL termination anymore, for whatever reason. Though, at least in my eyes, that's a solved problem too.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#92

Post by otterley »

mdekkers wrote: post #46
Karunamon wrote: post #17

Earlier quoted context omitted.

Does F5 do any special secret sauce that can't be replicated with an equally powerful set of hardware and a good HAProxy config? I know one of our network admins is continually complaining about how shitty their UI is...

Does F5 do any special secret sauce that can't be replicated with an equally powerful set of hardware and a good HAProxy config? Not unless you think "extract a lot of money from clueless execs" is secret sauce. That, and support contracts - you know, throats to choke when it all goes wrong.

BigIP's iRules (Tcl) are pretty nice. (https://devcentral.f5.com/irules). I hear HAproxy has Lua support now, but I don't know how comprehensive it is compared to iRules.

Also, F5 load balancers have real hardware failover capability, and can even synchronize TCP session state across instances. That's a pretty nice feature.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#93

Post by otterley »

mdekkers wrote: post #52
xorcist wrote: post #45

Earlier quoted context omitted.

F5 has some secret sauce to it but it's mostly performance related. They have a good chunk of hardware offloading, all the way up to the TLS layer. I seem to remember even the entry license includes full TLS offloading so I doubt the poster above is correct that it is a cost issue. As to if HAProxy can do the job, well, that depends. F5s are complex beasts and they can load balance application specific protocols that…

crypto offloading isn't hard, and can be done on the NIC if you want/need: https://www.nextplatform.com/2016/10/03/server-encryption-fp...

Can you show us how to configure that on a typical box?

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#94

Post by yjftsjthsd-h »

paulddraper wrote: post #77
shif wrote: post #72

That's regressive as fuck, it's like saying that cars will no longer be allowed, only horse carriages

The gap between those two technologies is larger than you suggest. Horse carraiges: 1400 Automobiles: 1890

Horses and cars were in use at the same time, just like HTTP and HTTPS; I'm not sure why their invention times are relevant?

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#95

Post by anigbrowl »

popey456963 wrote: post #4

Why on Earth could they possibly feel it necessary to do this? The United States Patent Office doesn't have a complex system of sub-domains or even an EV license, if money were the object then they could just go with Let's Encrypt (not to mention the current license continues until 2018 anyway). The amount of computing power it takes to encrypt with SSL is minimal, especially if you use some of the newer systems like…

You think they have a free hand, but they don't. People who work are federal agencies are hemmed in by a thicket of rules that prevent them from just entering into an agreement with a private vendor who has not been through a qualification process. Likewise technicians and administrators are enjoined from spending money on their own initiative, eg you can't just see the problem, sign up for a renewable SSL certificate, and then shoot the bill over the accounts payable.

I don't want to speculate about what's going on at the managerial/administrative level, but I notice the current administration is committed to the goal of slashing most government spending by some huge amount while simultaneously cutting taxes. It may be that the head of the USPTO got a phone call telling them not to spend a single damn penny. Now, iirc the USPTO is actually self-financing on patent application fees, but I don't think they're so independent that they can just ignore directives from higher up in the executive branch.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#96

Post by anigbrowl »

xtreme wrote: post #86
makecheck wrote: post #23

This would be interesting for patent research; you could legitimately say "I looked for a patent that already covers X but since you cannot guarantee the data was not modified in transit, I cannot be certain that I saw what was actually in the patents I reviewed".

Even if the courts allowed this to be a valid defense, it could only protect you from willful infringement. Not having knowledge of an existing patent does not stop the other party from claiming damages. If they can prove you knew that your work infringes the patent, they can sue you for treble damages from willful infringement.

They might allow it, but in civil litigation liability hangs upon the balance of probabilities rather than being beyond a reasonable doubt as in criminal trials. So a court might well allow it but that doesn't mean a jury would find it persuasive.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#97

Post by anigbrowl »

paulddraper wrote: post #77
shif wrote: post #72

That's regressive as fuck, it's like saying that cars will no longer be allowed, only horse carriages

The gap between those two technologies is larger than you suggest. Horse carraiges: 1400 Automobiles: 1890

Pretty sure horse carriages were around a lot earlier than 1400, unless you were thinking BC.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#98

Post by tjalfi »

cryptarch wrote: post #26

Anyone looking at creating an IPFS or BitTorrent mirror yet? Edit: the PDF attachment URL's are very predictable, they're the number of the patent in a weird order + a page number, e.g.: http://pdfpiw.uspto.gov/10/292/096/2.pdf Back of the envelope calculations say all PDF's should only take 1 - 6 TB's (assuming 100kb to 600kb in PDF's on average). Seriously, why hasn't anyone mirrored this?

The USPTO has a bulk download option[0]. The datasets are available from ReedTech[1].

[0] https://www.uspto.gov/learning-and-resources/bulk-data-produ... [1] http://patents.reedtech.com/Public-PAIR.php

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#99

Post by pbhjpbhj »

otoburb wrote: post #39
dsmithatx wrote: post #28

Earlier quoted context omitted.

You could easily terminate SSL at the LB or even just a proxy in front of the app. Sniffing the line after that is as trivial as turning a mirror port on the switch. In this day and age SSL is trivial and there is honestly no good reason to disable it. In fact protecting users privacy is a good reason they should switch to SSL only. I know you were only trying to coming up with some kind of reason but, there just isn…

The grandparent comment touches upon the reality of working in most large organizations. There tend to be silo'd teams, which in more concrete terms translates into the "application/website" team and the "networking" team. Sometimes, there's a "system administration" team sandwiched in between. HTTPS everywhere reduces the number of teams that used to, in the old "HTTP-only" world, serendipitously pitch in to help tr…

Having worked doing independent full-stack web design I'd expect an individual could, from scratch, set up a working system with load balancing and failover in perhaps 2-3 weeks ... an experience team should surely be able to do that in their sleep inside a week?

What would be others expectation for such a service? USPTO do have a web team, yes? That site has been the same for over a decade AFAIR, what have they been doing?

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#100

Post by [deleted] »

dom0 wrote: post #60
stonesam92 wrote: post #16

Earlier quoted context omitted.

If that were the case and USPTO were in on the trick, why the need to drop HTTPS? They'd have that data already, so could just share it directly.

Didn't your country just drop the privacy protection rules that hindered ISPs from selling any American's browser history?

[deleted]
Post reply on HN