Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS on Stack Overflow: The End of a Long Road

nickcraver.com

Post reply on HN
Print view View original

21–30 of 183 posts

Re: HTTPS on Stack Overflow: The End of a Long Road

#21

Post by vbernat »

tomschlick wrote: post #10

Just a reminder, HTTPS isn't enough. Be sure to turn the other security knobs with headers... https://securityheaders.io/?q=https%3A%2F%2Fstackoverflow.co...

Many headers presented here are questionable. X-Frame-Options should be replaced by CSP frame-ancestors. X-XSS-Protection: 1 is the default since a long time for browsers supporting it and Chrome blocks by default since two releases. Referrer-Policy is a matter of choice. It's a useful information for the target site as long as the referrer doesn't contain sensitive information. IMO, most sites shouldn't set this header.

Re: HTTPS on Stack Overflow: The End of a Long Road

#22

Post by DamonHD »

lmm wrote: post #4

> The password to our data center is pickles. I didn’t think anyone would read this far and it seemed like a good place to store it. You ought to have more confidence in your writing. BRB stealing all your servers.

Only if you get there first. And it may in fact be pickles2.

Re: HTTPS on Stack Overflow: The End of a Long Road

#23

Post by ghvknvgvh »

DamonHD wrote: post #22
lmm wrote: post #4

> The password to our data center is pickles. I didn’t think anyone would read this far and it seemed like a good place to store it. You ought to have more confidence in your writing. BRB stealing all your servers.

Only if you get there first. And it may in fact be pickles2.

This guy works at Slashdot by the way. Nothing worth stealing in their servers, methinks.

Re: HTTPS on Stack Overflow: The End of a Long Road

#24

Post by DamonHD »

Nick-Craver wrote: post #19
TorKlingberg wrote: post #15

Earlier quoted context omitted.

I feel like TLS certificates are fundamentally misdesigned there. It should be possible to have a wildcard certificate that matches all subdomains under a domain, no matter how many layers deep.

Well if it wasn't for someone buying .com back in the day, we probably could have them. Oh and then buying . .com after browsers banned that one, which led to RFC 6125 rule clarifications and restrictions.

Hey, I'm pretty sure that the first real domain name hack was sex.net, which as the proud owner of ex.net [PS: or was it sexnet.com, as we also have exnet.com?] caused some upset for a while, though mainly to disappointed one-handed typists I believe... B^>

BTW, did I blink and miss the "It really is all faster over HTTP/2, even given TLS" bit? My testing for my tiny lightweight sites close to their users (the opposite of what you're dealing with) is that HTTP/2 is slightly slower overall. Even with Cloudflare's advantages such as good DNS. And with the pain of cert management...

http://m.earth.org.uk/note-on-carbon-cost-of-CDN.html

Anyhow, thanks for the warts-n-all.

Re: HTTPS on Stack Overflow: The End of a Long Road

#25

Post by Ajedi32 »

janwillemb wrote: post #11

Wow, I didn't expect this ("switching" to HTTPS) to be so hard.

It very much depends on the complexity and scale of your site. StackOverflow is a bit of an extreme case.

For example, if instead of having hundreds of domains serving millions of users with tons of user-generated content you're just serving static content from a single server on a small site, the entire process for you might actually be as simple as just running `certbot-auto` on the production server.

I suspect the difficulty of switching for most sites will fall somewhere between these two extremes.

Re: HTTPS on Stack Overflow: The End of a Long Road

#26

Post by gatlinnewhouse »

mrunkel wrote: post #7

At $previous_job we once turned on HTTPS for our entire customer website and online store, only to have our customer support team be bombarded by phone calls claiming that our "website was down." After much teeth gnashing and research, we determined that a large segment of our user base was still using WinXP and the encryption protocols we offered weren't available to them. We didn't think this would be a problem bec…

> We didn't think this would be a problem because the current version of the software wasn't compatible with WinXP any longer.

> There was some debate internally whether the better fix was to including the legacy encryption protocols or just leave the HTTP version of the site running and use Strict-Transport-Security to move capable browsers to HTTPS.

Where can I read about this? Is there any way to display a special "Your browser is outdated" page for the users on WinXP?

Sorry if these seem like basic questions. I am just curious and would like to hear some expert advice.

Re: HTTPS on Stack Overflow: The End of a Long Road

#27

Post by shortimer »

gatlinnewhouse wrote: post #26
mrunkel wrote: post #7

At $previous_job we once turned on HTTPS for our entire customer website and online store, only to have our customer support team be bombarded by phone calls claiming that our "website was down." After much teeth gnashing and research, we determined that a large segment of our user base was still using WinXP and the encryption protocols we offered weren't available to them. We didn't think this would be a problem bec…

> We didn't think this would be a problem because the current version of the software wasn't compatible with WinXP any longer. > There was some debate internally whether the better fix was to including the legacy encryption protocols or just leave the HTTP version of the site running and use Strict-Transport-Security to move capable browsers to HTTPS. Where can I read about this? Is there any way to display a special…

At our place, we put a redirect on the front end networking device that detected if a browser couldn't support more modern encryption protocols, and sent them to an HTTP information page (instead of to the application itself) if so. This allowed us to update the core app to force newer protocols, while still providing some sort of UX for those left behind. We used Piwik to track the hits on the redirect page to get a sense for how many users were left behind.

Re: HTTPS on Stack Overflow: The End of a Long Road

#29

Post by hdhzy »

vbernat wrote: post #21
tomschlick wrote: post #10

Just a reminder, HTTPS isn't enough. Be sure to turn the other security knobs with headers... https://securityheaders.io/?q=https%3A%2F%2Fstackoverflow.co...

Many headers presented here are questionable. X-Frame-Options should be replaced by CSP frame-ancestors. X-XSS-Protection: 1 is the default since a long time for browsers supporting it and Chrome blocks by default since two releases. Referrer-Policy is a matter of choice. It's a useful information for the target site as long as the referrer doesn't contain sensitive information. IMO, most sites shouldn't set this hea…

> X-XSS-Protection: 1 is the default since a long time for browsers supporting it and Chrome blocks by default since two releases.

Do you have references to back this up?

> Referrer-Policy is a matter of choice. It's a useful information for the target site as long as the referrer doesn't contain sensitive information. IMO, most sites shouldn't set this header.

Exactly. I think its primary use is when the original site's URL contains user supplied input like Google Search page.

Re: HTTPS on Stack Overflow: The End of a Long Road

#30

Post by hdhzy »

mixmastamyk wrote: post #13
tomschlick wrote: post #10

Just a reminder, HTTPS isn't enough. Be sure to turn the other security knobs with headers... https://securityheaders.io/?q=https%3A%2F%2Fstackoverflow.co...

Helpful site, but all these headers will slow down a site that doesn't need them. Too bad they aren't defaults. Hopefully http2 mitigates that enough.

Http2 compresses headers so it they are not changing the amount of overhead is negligible (see HPACK).
Post reply on HN