Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS on Stack Overflow: The End of a Long Road

nickcraver.com

Post reply on HN
Print view View original

71–80 of 183 posts

Re: HTTPS on Stack Overflow: The End of a Long Road

#71

Post by sp332 »

ry_ry wrote: post #41
shortimer wrote: post #27

Earlier quoted context omitted.

At our place, we put a redirect on the front end networking device that detected if a browser couldn't support more modern encryption protocols, and sent them to an HTTP information page (instead of to the application itself) if so. This allowed us to update the core app to force newer protocols, while still providing some sort of UX for those left behind. We used Piwik to track the hits on the redirect page to get a…

We did a similar thing, but folded it into unsupported and deprecated - unsupported browsers will get an HTML page extolling the virtues of updating your browser once a decade, whilst deprecated browsers (basically IE10 at the time tbh) were treated to a popup explaining that whilst the site probably works just fine, their browser wasnt fully upto date and the experience might suffer. Eventually, and I doubt we had a…

IE11 is the most recent version of IE, it's not like it's old or unsupported. And it has way more compatibility tweaks than Edge, so lots of people haven't switched.

Re: HTTPS on Stack Overflow: The End of a Long Road

#73

Post by prdonahue »

tomschlick wrote: post #9
baby wrote: post #8

Earlier quoted context omitted.

TLS kills this kind of "cool" features which is kind of sad :( Unless you can afford wildcard certs. What's the argument behind LetsEncrypt not doing that? Extended Validation stuff?

Probably their agreements with their partner CAs. Given that those partners sell wildcards themselves...

Their "Let’s Encrypt Authority X3" intermediate is signed by their own root (ISRG Root X1). See https://letsencrypt.org/certificates/.

Re: HTTPS on Stack Overflow: The End of a Long Road

#74

Post by revelation »

HalfwayToDice wrote: post #46
y4mi wrote: post #45

Earlier quoted context omitted.

Some people don't spy on their customers and don't have these kinds of information available for analyses They're admittedly few though and their moral high ground is debatable considering that there are self hosted FOSS alternatives around nowadays

Calling aggregate anonymous analytics "spying on your customers" is absurd nonsense.

Just like those anonymous taxi fare statistics, no one ever extracted meaning from those..

Re: HTTPS on Stack Overflow: The End of a Long Road

#75

Post by dismantlethesun »

revelation wrote: post #74
HalfwayToDice wrote: post #46

Earlier quoted context omitted.

Calling aggregate anonymous analytics "spying on your customers" is absurd nonsense.

Just like those anonymous taxi fare statistics, no one ever extracted meaning from those ..

The whole point is to extract meaning from analysis but not spy on personal information. Knowing which clients support what kind of SSL isn't personal, it is part of the request transaction.

Re: HTTPS on Stack Overflow: The End of a Long Road

#77

Post by obstacle1 »

jasonkostempski wrote: post #68
HalfwayToDice wrote: post #46

Earlier quoted context omitted.

Calling aggregate anonymous analytics "spying on your customers" is absurd nonsense.

Declaring "absurd nonsense" isn't an argument.

In this case, the absurdity and nonsensical character of the 'spying' claim is fairly self-evident.

When a client voluntarily makes a request to a server, it presents a bunch of information for the server to see and consume. This information is not meant to be kept secret from the server. Among such pieces of information can be some about the characteristics of the user agent, including OS. It is disingenuous at best to call collecting such voluntarily-presented and clearly-transmitted data as "spying" on a user.

A basic requirement for spying is for a collecting party to be obtaining information that can be reasonably considered confidential or restricted. Details about the system from which you send a request are by definition of the protocol not confidential or restricted to the recipient of your request. It is not reasonable to expect a server to not look at or use information you present to it. Therefore, it isn't "spying" for the recipient to consume the information. The information might be used in ways some people(e.g., OP) don't like, but that does not make obtaining the information "spying".

Re: HTTPS on Stack Overflow: The End of a Long Road

#78

Post by indexerror »

teraflop wrote: post #58
dzdt wrote: post #49

Stack Exchange is no longer available from my workplace due to this change. We have a strict no-posting-code-fragments policy, and SE was viewed as too risky to allow without some restriction in place to make it read only. Before HTTPS, the IT department had worked out such a read-only restriction by blocking the SE login with firewall rules. But with HTTPS that kludge is no longer possible, so the site is blocked.

Leaving aside all the reasons why this policy is super dumb (which I'm sure others will cover quite adequately), I guess your IT department can't figure out how to create their own CA certificate and do SSL interception?

Certainly doable but this should not be done.

Re: HTTPS on Stack Overflow: The End of a Long Road

#79

Post by jcrawfordor »

teraflop wrote: post #58
dzdt wrote: post #49

Stack Exchange is no longer available from my workplace due to this change. We have a strict no-posting-code-fragments policy, and SE was viewed as too risky to allow without some restriction in place to make it read only. Before HTTPS, the IT department had worked out such a read-only restriction by blocking the SE login with firewall rules. But with HTTPS that kludge is no longer possible, so the site is blocked.

Leaving aside all the reasons why this policy is super dumb (which I'm sure others will cover quite adequately), I guess your IT department can't figure out how to create their own CA certificate and do SSL interception?

Yeah, I'm amazed and concerned that you have a security team so paranoid that they would make SuperUser read-only but apparently lack the ability to perform SSL interception. Considering the huge value the latter has in any kind of post-compromise scenario and, increasingly, to prevent compromise in the first place... there needs to be a real discussion about getting priorities in order.

Re: HTTPS on Stack Overflow: The End of a Long Road

#80

Post by cortesoft »

jasonkostempski wrote: post #68
HalfwayToDice wrote: post #46

Earlier quoted context omitted.

Calling aggregate anonymous analytics "spying on your customers" is absurd nonsense.

Declaring "absurd nonsense" isn't an argument.

You don't need an argument against absurd nonsense.
Post reply on HN