HTTPS on Stack Overflow: The End of a Long Road • Hacker News Board

Re: HTTPS on Stack Overflow: The End of a Long Road

#131

Post by techolic » Tue, May 23, 2017, 3:06 AM UTC

nfriedly wrote: post #55

dzdt wrote: post #49

Stack Exchange is no longer available from my workplace due to this change. We have a strict no-posting-code-fragments policy, and SE was viewed as too risky to allow without some restriction in place to make it read only. Before HTTPS, the IT department had worked out such a read-only restriction by blocking the SE login with firewall rules. But with HTTPS that kludge is no longer possible, so the site is blocked.

You should try this link from home: https://stackoverflow.com/jobs

Many banks have very strict IT policies on posting things on internet, and they have valid business reasons for that. Not saying you meant that, but it's not like they're some dark, silly workplaces that people should get away from asap.

Re: HTTPS on Stack Overflow: The End of a Long Road

#132

Post by darklajid » Tue, May 23, 2017, 3:28 AM UTC

techolic wrote: post #131

nfriedly wrote: post #55

Earlier quoted context omitted.

You should try this link from home: https://stackoverflow.com/jobs

Many banks have very strict IT policies on posting things on internet, and they have valid business reasons for that. Not saying you meant that, but it's not like they're some dark, silly workplaces that people should get away from asap.

No, the reasons for the policy might be sound.

The enforcement is stupid (both the previous hack and now the block). For me this actually would be a sign that the workplace isn't quite the right fit for me, if the basic assumption is that I ignore the policies anyway - because that's what this seems to indicate?

Re: HTTPS on Stack Overflow: The End of a Long Road

#133

Post by [deleted] » Tue, May 23, 2017, 4:09 AM UTC

mrunkel wrote: post #7

At $previous_job we once turned on HTTPS for our entire customer website and online store, only to have our customer support team be bombarded by phone calls claiming that our "website was down." After much teeth gnashing and research, we determined that a large segment of our user base was still using WinXP and the encryption protocols we offered weren't available to them. We didn't think this would be a problem bec…

[deleted]

Re: HTTPS on Stack Overflow: The End of a Long Road

#134

Post by kavok » Tue, May 23, 2017, 4:10 AM UTC

make3 wrote: post #129

boyter wrote: post #69

Earlier quoted context omitted.

Same thing happened to me at a workplace once. They blocked StackOverflow, GitHub, Bitbucket, Sourceforge, CodePlex and Google Code. I told them all estimates go up by 2 years since we would need to reimplement everything. It ended up being unblocked a week later.

This sounds beyond absurd to me. Do they also block usb ports to prevent you from copying everything on a usb drive or external harddrive, or phone? Do they lock/solder you machines shut to prevent you from taking out a hard drive / plugging in a new one and then taking it out? Do they prevent you from .. printing the code? In what parallel world do they exist that they think this would make a difference

I've worked in financial software and they do block USB ports for any storage device. They block SD card slots too. All work was done on a VM that could only be accessed from the company network and was remotely hosted.

Re: HTTPS on Stack Overflow: The End of a Long Road

#135

Post by knodi123 » Tue, May 23, 2017, 4:25 AM UTC

dzdt wrote: post #49

Stack Exchange is no longer available from my workplace due to this change. We have a strict no-posting-code-fragments policy, and SE was viewed as too risky to allow without some restriction in place to make it read only. Before HTTPS, the IT department had worked out such a read-only restriction by blocking the SE login with firewall rules. But with HTTPS that kludge is no longer possible, so the site is blocked.

Why don't they just recompile chromium without support for the textarea element, make that the only officially permitted browser, and call it a day? :-)

Re: HTTPS on Stack Overflow: The End of a Long Road

#136

Post by kingbirdy » Tue, May 23, 2017, 4:48 AM UTC

make3 wrote: post #129

boyter wrote: post #69

Earlier quoted context omitted.

Same thing happened to me at a workplace once. They blocked StackOverflow, GitHub, Bitbucket, Sourceforge, CodePlex and Google Code. I told them all estimates go up by 2 years since we would need to reimplement everything. It ended up being unblocked a week later.

This sounds beyond absurd to me. Do they also block usb ports to prevent you from copying everything on a usb drive or external harddrive, or phone? Do they lock/solder you machines shut to prevent you from taking out a hard drive / plugging in a new one and then taking it out? Do they prevent you from .. printing the code? In what parallel world do they exist that they think this would make a difference

As someone who works at a finance related company: yes. No USB storage is allowed, all cloud hosting sites are blocked (not SO, thankfully, they're more worried about us stealing SSNs and other PII than code), and all printers are logged and have drivers that detect if you're printing PII and censor it by default (or so I've been told, I don't really feel the need to test that).

A friend works at an investment firm, and has similar restrictions as the above commenter mentioned (no SO, no USB, no printing, etc), as well as pulling his phone out while at his desk or around any other computer being an immediate fireable offense.

Re: HTTPS on Stack Overflow: The End of a Long Road

#137

Post by mathattack » Tue, May 23, 2017, 4:55 AM UTC

scott00 wrote: post #85

mathattack wrote: post #70

Earlier quoted context omitted.

In many places (banks) there are legal reasons for this.

Can you elaborate on this?

IP protection. In a prior life I saw someone fired for mailing a model to a home account. Pasting code to a public website would violate similar protocols.

Re: HTTPS on Stack Overflow: The End of a Long Road

#138

Post by Pherdnut » Tue, May 23, 2017, 5:12 AM UTC

astrodust wrote: post #89

HalfwayToDice wrote: post #46

Earlier quoted context omitted.

Calling aggregate anonymous analytics "spying on your customers" is absurd nonsense.

It's "spying" when you're gathering data they didn't consent to give, like mining through their contacts, scanning running processes or uploading unrelated content from their computer. The browser User-Agent string is hardly classified information.

Yeah, this is more like the used car dealership noticing that a lot of their clientele drives Toyotas. SPIES!

Re: HTTPS on Stack Overflow: The End of a Long Road

#139

Post by johncolanduoni » Tue, May 23, 2017, 5:20 AM UTC

jlgaddis wrote: post #102

johncolanduoni wrote: post #57

Earlier quoted context omitted.

Mere server-side logging can pick out something like this via User-Agent. Is it spying to count the number of times a request with "Windows NT 5.1" is sent to your server?

Mere server-side logging can include the negotiated encryption parameters (but doesn't by default, IIRC).

Yes, of the connection the server is party to. It's bad security to record them, but how is it spying?

Re: HTTPS on Stack Overflow: The End of a Long Road

#140

Post by knodi123 » Tue, May 23, 2017, 5:34 AM UTC

DamonHD wrote: post #24

Nick-Craver wrote: post #19

Earlier quoted context omitted.

Well if it wasn't for someone buying .com back in the day, we probably could have them. Oh and then buying . .com after browsers banned that one, which led to RFC 6125 rule clarifications and restrictions.

Hey, I'm pretty sure that the first real domain name hack was sex.net, which as the proud owner of ex.net [PS: or was it sexnet.com, as we also have exnet.com?] caused some upset for a while, though mainly to disappointed one-handed typists I believe... B^> BTW, did I blink and miss the "It really is all faster over HTTP/2, even given TLS" bit? My testing for my tiny lightweight sites close to their users (the opposi…

> which as the proud owner of ex.net

haha, that page is a priceless timecapsule:

Use the Java applet below to search ExNet's main Web pages.

When the ``Status'' indicator stops flashing and says ``Idle'', type key words in the ``Search for:'' box.

The ``Results:'' box will show you the documents that matched your key words, the best matches coming first in the list. Click on any line in the ``Results:'' box, and that document should appear in a new browser window in a few seconds. When you are finished with that document, you can close it without killing your browser.