Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS on Stack Overflow: The End of a Long Road

nickcraver.com

Post reply on HN
Print view View original

101–110 of 183 posts

Re: HTTPS on Stack Overflow: The End of a Long Road

#101

Post by skyisblue »

irrational wrote: post #32
janwillemb wrote: post #11

Wow, I didn't expect this ("switching" to HTTPS) to be so hard.

Yeah, we've been working on this for about a year (not continually, but as we have time to try to work through the problems). We do use subdomains though, so that is part of the problem. We keep feeling like we are getting close, but then we run into another issue. It's like a rabbit hole that has no bottom.

> We keep feeling like we are getting close, but then we run into another issue. It's like a rabbit hole that has no bottom.

That's exactly what we experienced migrating a bunch of sites to https. There were so many things that we didn't anticipate.

Re: HTTPS on Stack Overflow: The End of a Long Road

#102

Post by jlgaddis »

johncolanduoni wrote: post #57
y4mi wrote: post #45

Earlier quoted context omitted.

Some people don't spy on their customers and don't have these kinds of information available for analyses They're admittedly few though and their moral high ground is debatable considering that there are self hosted FOSS alternatives around nowadays

Mere server-side logging can pick out something like this via User-Agent. Is it spying to count the number of times a request with "Windows NT 5.1" is sent to your server?

Mere server-side logging can include the negotiated encryption parameters (but doesn't by default, IIRC).

Re: HTTPS on Stack Overflow: The End of a Long Road

#103

Post by jontro »

Nick-Craver wrote: post #99
jontro wrote: post #72

Regarding the section "Mistakes: APIs and .internal" Why wouldn't they use split horizon DNS for this? Seems like the perfect use case

Split horizon would point you at the same data center, rather than the writeable one. So that's more of a .local than a .internal. We discussed this, but ultimately the AD version we're on (pre-2016 Geo-DNS) it's not actually supported the way you'd need, and it's a nightmare to debug. We'd consider it for a .local, when the support it properly there in 2016. Even subnet prioritization is busted internally, so that's…

Interesting, thanks!

Re: HTTPS on Stack Overflow: The End of a Long Road

#104

Post by kentt »

dzdt wrote: post #49

Stack Exchange is no longer available from my workplace due to this change. We have a strict no-posting-code-fragments policy, and SE was viewed as too risky to allow without some restriction in place to make it read only. Before HTTPS, the IT department had worked out such a read-only restriction by blocking the SE login with firewall rules. But with HTTPS that kludge is no longer possible, so the site is blocked.

Banning SE really doesn't go far enough then does it? Perhaps any site with a text box should be forbidden.

Re: HTTPS on Stack Overflow: The End of a Long Road

#105

Post by Nick-Craver »

astrodust wrote: post #94
tomschlick wrote: post #37

Side question: any plans for IPv6?

Given the scale of Stack Overflow, you'd think they could set up AAAA records that point to a proper TLS 1.3+ server and leave the peasants on IPv4 going to one that's more...accommodating.

We could - but the network side isn't the problem. There's a lot of logging, user banning, etc. pieces that need IPv6 love first. We just haven't had the time yet.

There are network bits we'd have to evaluate heavily as well, e.g. firewall rules - basically the very limited benefits don't make it a priority, yet. When things change there, we'll do it.

Re: HTTPS on Stack Overflow: The End of a Long Road

#106

Post by technion »

mrunkel wrote: post #7

At $previous_job we once turned on HTTPS for our entire customer website and online store, only to have our customer support team be bombarded by phone calls claiming that our "website was down." After much teeth gnashing and research, we determined that a large segment of our user base was still using WinXP and the encryption protocols we offered weren't available to them. We didn't think this would be a problem bec…

The frustrating point about a similar experience was...

You can support HTTP and the occasional knowledgeable person will suggest you should upgrade. Or you can force TLS with SSLv3 enabled, and suddenly you'll hit a flood of people letting you know you're about to be hacked, based on online scanners. Often complete with requests for a bug bounty.

Re: HTTPS on Stack Overflow: The End of a Long Road

#107

Post by BinaryIdiot »

indexerror wrote: post #78
teraflop wrote: post #58

Earlier quoted context omitted.

Leaving aside all the reasons why this policy is super dumb (which I'm sure others will cover quite adequately), I guess your IT department can't figure out how to create their own CA certificate and do SSL interception?

Certainly doable but this should not be done.

There are many enterprise "solutions" that basically do this "out of the box". Yeah it shouldn't be done and a lot of employees are likely unaware that IT can see all of their SSL traffic but it's a big business.

Re: HTTPS on Stack Overflow: The End of a Long Road

#108

Post by BinaryIdiot »

dzdt wrote: post #49

Stack Exchange is no longer available from my workplace due to this change. We have a strict no-posting-code-fragments policy, and SE was viewed as too risky to allow without some restriction in place to make it read only. Before HTTPS, the IT department had worked out such a read-only restriction by blocking the SE login with firewall rules. But with HTTPS that kludge is no longer possible, so the site is blocked.

Damn, that's even more strict than when I worked in the IC as a government contractor. I don't know how you'd get anything done, realistically.

Re: HTTPS on Stack Overflow: The End of a Long Road

#109

Post by nimchimpsky »

mathattack wrote: post #70
Shoop wrote: post #53

Earlier quoted context omitted.

What sort of company do you work at? Why can't everyone just be told not to post code?

In many places (banks) there are legal reasons for this.

I've worked at three big banks (in three different countries actually). We've always had access to stackoverflow.

Re: HTTPS on Stack Overflow: The End of a Long Road

#110

Post by thaumasiotes »

cortesoft wrote: post #80
jasonkostempski wrote: post #68

Earlier quoted context omitted.

Declaring "absurd nonsense" isn't an argument.

You don't need an argument against absurd nonsense.

Better men than you have been beaten by absurd nonsense that shouldn't have needed to be argued against. ;)
Post reply on HN