Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Users will only be able to view patents via HTTP. HTTPS will no longer work”

uspto.gov

Post reply on HN
Print view View original

131–140 of 172 posts

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#131

Post by TheDong »

ronsor wrote: post #30
vesinisa wrote: post #22

The USPTO databases have to be one of the most torturous services to their users in the whole of internet. The UI of both the patent and trademark search is archaic, but not in a HN way but in a really bad way. In patent search, there is no "search" box. Instead, the "quick search" forces you to specify two (and exactly two) text queries on the database columns with obligatory boolean operation.[1] Even if you happen…

If you look at the url, you notice they are using CGI and Win32 EXEs

You can't know that.

It could have been redeveloped in anything, but kept the original url scheme for backwards compatibility.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#132

Post by javawizard »

Edmond wrote: post #59
snvzz wrote: post #29

Fun fact: HSTS https://securityheaders.io/?q=www.uspto.gov&followRedirects=... HSTS is 1 year at the time this comment is posted. They're in for some pain.

That should be considered a non-fun fact :) They are basically going to be DOSing a huge segment of users who've previously had that header set on their browsers...they're also violating the OMB mandate that requires TLS for all government sites...it is a rather strange move, I can't imagine there is a good reason for it. EDIT If it is for portal.uspto.gov then HSTS is a non-issue but still a very bad move.

> EDIT If it is for portal.uspto.gov then HSTS is a non-issue but still a very bad move.

Is it? I still see HSTS from portal.uspto.gov with the same age.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#133

Post by nullc »

Twirrim wrote: post #88
vesinisa wrote: post #22

The USPTO databases have to be one of the most torturous services to their users in the whole of internet. The UI of both the patent and trademark search is archaic, but not in a HN way but in a really bad way. In patent search, there is no "search" box. Instead, the "quick search" forces you to specify two (and exactly two) text queries on the database columns with obligatory boolean operation.[1] Even if you happen…

FWIW, you're often better off not searching, or looking at, patents. If you end up in a patent case, your liabilities will be much higher if they can sufficiently claim you knowingly infringed. Evidence that you searched for patents can weigh against you / your employer. Even if you weren't associated with the infringing product itself.

This is largely outmoded advice in the wake of in re seagate. Simply having looked at a patent is not enough to create willful infringement.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#134

Post by bitexploder »

15charlimitdumb wrote: post #53

it seems like most of the pro https arguments are asserting the right to anonymous public patent inspection. it is fundamentally impossible for the uspto to provide this access* (free speech traps ahead). if you don't want data about access patterns tracked the burden is on the consumer not the provider for public resources * https://thestack.com/security/2017/04/12/netflix-found-to-le...

Never mind that HTTP can easily be man in the middled and tampered with and I have no way to ensure I am communicating to who I think I am.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#135

Post by diebir »

fiatjaf wrote: post #71
vesinisa wrote: post #22

The USPTO databases have to be one of the most torturous services to their users in the whole of internet. The UI of both the patent and trademark search is archaic, but not in a HN way but in a really bad way. In patent search, there is no "search" box. Instead, the "quick search" forces you to specify two (and exactly two) text queries on the database columns with obligatory boolean operation.[1] Even if you happen…

The bizarre practice of assigning session keys to visitors and somehow storing the page they're viewing in the server instead of in the URL is pretty common in Brazilian government, which is dominated by Java programmers.

Uhm... A server side session Web apps is pretty basic stuff:

https://en.wikipedia.org/wiki/Session_(computer_science)#Ser...

This existed since the Perl CGI times. "Bizarre practice", wow.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#136

Post by curiouscats »

k_sh wrote: post #125
anigbrowl wrote: post #95

Earlier quoted context omitted.

You think they have a free hand, but they don't. People who work are federal agencies are hemmed in by a thicket of rules that prevent them from just entering into an agreement with a private vendor who has not been through a qualification process. Likewise technicians and administrators are enjoined from spending money on their own initiative, eg you can't just see the problem, sign up for a renewable SSL certificat…

sounds like the US government is ripe for disruption... /s

It is one of the rare organizations where the people responsible for the budget of the organization have long track records of trying to have them disrupted (or just eliminated).

Congress has often tried to undermine the ability of the EPA, IRS, NIH, NOAA... to do their job which then makes it seem they are ripe for disruption.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#137

Post by fmoo »

diebir wrote: post #135
fiatjaf wrote: post #71

Earlier quoted context omitted.

The bizarre practice of assigning session keys to visitors and somehow storing the page they're viewing in the server instead of in the URL is pretty common in Brazilian government, which is dominated by Java programmers.

Uhm... A server side session Web apps is pretty basic stuff: https://en.wikipedia.org/wiki/Session_(computer_science)#Ser... This existed since the Perl CGI times. "Bizarre practice", wow.

Server side sessions aren't the bizarre practice - Keeping track of navigation state on the server side is.

This is like your whole website existing as a single endpoint and making POSTs to the same URL to get to different parts of the site.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#138

Post by anticedent »

timv wrote: post #124
progval wrote: post #79

Earlier quoted context omitted.

A Java app of my university does this too. Is this a practice shared by most Java programmers? How come?

Historically it was fairly common. I wouldn't say it was standard, but it happened often enough to notice. There's a bunch of reasons that come together to cause that. During the explosion of the web, enterprises moved much of their development into web solutions using an existing workforce that had skills in different technologies - often client-server desktop-to-RDBMS tech. Java was a popular choice for these new p…

This is being conflated as a Java thing, because of a sideways remark about Brazilian programmers.

Reading other comments, it's now clear that in this instance we are dealing with a Microsoft Server. [0]

[0] https://news.ycombinator.com/item?id=14173595

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#139

Post by rsynnott »

timv wrote: post #124
progval wrote: post #79

Earlier quoted context omitted.

A Java app of my university does this too. Is this a practice shared by most Java programmers? How come?

Historically it was fairly common. I wouldn't say it was standard, but it happened often enough to notice. There's a bunch of reasons that come together to cause that. During the explosion of the web, enterprises moved much of their development into web solutions using an existing workforce that had skills in different technologies - often client-server desktop-to-RDBMS tech. Java was a popular choice for these new p…

Also, the third likely reason is that there are still a lot of Java web codebases from the mid to late 90s around; the Java runtime can still run the code, so people keep it. Perl and TCL are less likely to be convenient to run today, and more of those codebases will have been dumped.

And Java was disproportionately used for very large complex systems which would be expensive to replace, in any case.

Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”

#140

Post by anticedent »

TheDong wrote: post #131
ronsor wrote: post #30

Earlier quoted context omitted.

If you look at the url, you notice they are using CGI and Win32 EXEs

You can't know that. It could have been redeveloped in anything, but kept the original url scheme for backwards compatibility.

Oh, come now. Whether he can or cannot know such a thing is however many angels, dancing on the head of a pin.

Do you honestly believe anything this terrible went through a rewrite? I sure don't.

Post reply on HN