Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bing doesn't support SSL

bing.com

Post reply on HN
Print view View original

131–140 of 163 posts

Re: Bing doesn't support SSL

#131

Post by ljd »

olegbl wrote: post #128

Neither does Hulu. https://hulu.com/ Amazon redirects to HTTP: https://www.amazon.com/ Netflix redirects to HTTP: https://netflix.com/ Etc... Etc... Etc... Why pick on Bing?

I understand Hulu and Netflix but I have a hard time understanding why Amazon wouldn't support SSL. It does put a heavier processing load on web servers but you would think that if someone wants to encrypt their shopping traffic Amazon would be open to accommodating that.

It is not, by any means, trivial to find out what products someone is looking to buy and could be the basis of a social engineering hack.

Re: Bing doesn't support SSL

#132

Post by homosaur »

azernik wrote: post #101
highwind wrote: post #95

Earlier quoted context omitted.

Yeah. I remember TL;DR meant wall of text, kinda same way RTFM was used. It was a response to something not a tag to indicate what you were doing. How things change so fast on the Internet.

The new meaning is a lot more useful (in the sense that I find lots of opportunities to use it).

Agreed, I still have insults a plenty in my quiver.

Re: Bing doesn't support SSL

#133

Post by dragontamer »

highwind wrote: post #95
JonnieCache wrote: post #92

Earlier quoted context omitted.

Who else remembers when it used to be an insult? I preferred it that way.

Yeah. I remember TL;DR meant wall of text, kinda same way RTFM was used. It was a response to something not a tag to indicate what you were doing. How things change so fast on the Internet.

TL;DR: You prefer the old way of doing things.

Re: Bing doesn't support SSL

#134

Post by couchmonster »

dominicgs wrote: post #14
Ricapar wrote: post #3

Looks like someone pushed the wrong SSL cert to production: www.bing.com uses an invalid security certificate. The certificate is only valid for the following names: a248.e.akamai.net , *.akamaihd.net , *.akamaihd-staging.net (Error code: ssl_error_bad_cert_domain)

Australian Ebay ( https://www.ebay.com.au/ ) has had the same problem for months, although I appear to get no response for https://www.ebay.com , so I'm not sure what their policy is on SSL access to the homepage. I expect that Microsoft will fix Bing much more quickly.

It's been this way since 2009... http://revealingerrors.com/akamai_ssl

Re: Bing doesn't support SSL

#135

Post by l0c0b0x »

This just means that there is no redirect on www.bing.com via SSL. Bing.com (ssl) has a proper re-direct to non-ssl www.bing.com.

Most-likely an oversight, but it does suggest ssl isn't supported.

Re: Bing doesn't support SSL

#136

Post by rprospero »

freehunter wrote: post #122
ajross wrote: post #119

Earlier quoted context omitted.

Arrgh. Sorry, but this is an absolutely classic example of why "security professionals" get laughed at by engineers. This requirements analysis is just completely backwards. In the example in question (which frankly isn't very interesting, I can come up with hundreds of scenarios like this) I have a git archive I need to share with someone on an ad-hoc basis. For whatever reason, I'd like to do it securely, so it nee…

To answer your question, yes outbound and inbound SSH is blocked except through our secure gateways. Every security organization at every company will have procedures in place for bypassing the official policy on an ad-hoc basis. There's always going to be a one-off situation that requires a different set of rules on a limited time basis, and there are many ways of dealing with these exceptions. On a broad basis, tho…

It's true that there's always a procedure in place for bypassing the official policy as needed. However, it often comes down to a question of whether its faster to follow this procedure or to simply undermine the security. I've repeatedly seen people solve the problem of handling unsigned certificates by simply moving back to pure HTTP. This is a great security hole than the unsigned certs ever were, but it's perfectly valid with their security policy.

I can actually take your key analogy into true story territory. I worked at an office where a manager had to be gone for a month. He had the only key and the policy to get a new key wouldn't get one to us for weeks. It was also against policy for him to give the key to someone else while he was gone. The solution was to simply leave all the doors unlocked while he was gone.

I understand the need for security. I understand that security is your job and that you don't want to compromise for mediocre security. However, when you won't compromise, we don't get great security. We get no security.

Re: Bing doesn't support SSL

#137

Post by lelandbatey »

NelsonMinar wrote: post #77

Bing is important. It's a good search engine, comparable to Google's quality and size. And it's the only competition Google has in the US and most of Europe. (Sites like DuckDuckGo and Yahoo pass queries on to Bing). Dumb errors like this SSL problem are embarassing, but the larger frustration is how despite years of having a good product, they have so little market traction.

I didn't know that DuckDuckGo and Yahoo pass their queries onto Bing. Does anyone else have any information on that, it sounds really interesting.

Re: Bing doesn't support SSL

#138

Post by TallGuyShort »

sixothree wrote: post #90
NelsonMinar wrote: post #77

Bing is important. It's a good search engine, comparable to Google's quality and size. And it's the only competition Google has in the US and most of Europe. (Sites like DuckDuckGo and Yahoo pass queries on to Bing). Dumb errors like this SSL problem are embarassing, but the larger frustration is how despite years of having a good product, they have so little market traction.

I think it's as simple as having chosen an awful name. Bing is physically difficult to pronounce and it evokes no meaning whatsoever.

Do you really the pronunciation difficulty and lack of meaning is so significantly different than "Google" was when it launched? It's more vocalized, yes, but only a single syllable for Google's two, and relatively noone actually think of "googolplex" when talking about Google. The sound "bing", I think, conveys speediness, which they took advantage of with the slogan "Bing and decide". It's a quick, sharp sound - as should be your searches.

Re: Bing doesn't support SSL

#139

Post by dhruvbird »

rhplus wrote: post #97
casca wrote: post #2

TL;DR: bing SSL certificate is wrong. https://bing.com : subject=/CN=*.bing.com https://www.bing.com : subject=/C=US/O=Akamai Technologies, Inc./CN=a248.e.akamai.net

TL;DR: Bing doesn't support SSL on www.bing.com and has never publicized it as a supported feature. The submitter had to manually type https://www.bing.com into the address bar to generate this 'error'. Bing does support SSL on ssl.bing.com and publishes various links on that sub-domain, such as https://ssl.bing.com/webmaster/home/mysites The fact that the https://www.bing.com redirects to the HTTP version should be…

Why don't they just support the thing that is most reasonably expected and not surprise n00bs like me.

Re: Bing doesn't support SSL

#140

Post by freehunter »

rprospero wrote: post #136
freehunter wrote: post #122

Earlier quoted context omitted.

To answer your question, yes outbound and inbound SSH is blocked except through our secure gateways. Every security organization at every company will have procedures in place for bypassing the official policy on an ad-hoc basis. There's always going to be a one-off situation that requires a different set of rules on a limited time basis, and there are many ways of dealing with these exceptions. On a broad basis, tho…

It's true that there's always a procedure in place for bypassing the official policy as needed. However, it often comes down to a question of whether its faster to follow this procedure or to simply undermine the security. I've repeatedly seen people solve the problem of handling unsigned certificates by simply moving back to pure HTTP. This is a great security hole than the unsigned certs ever were, but it's perfect…

Completely understood. I can't speak for other companies, but mine has a very strict policy and also many ways to accommodate exceptions to this policy provided the employee has a valid reason for needing an exception.

I agree that strict policies with no recourse for exceptions is a bad thing. I don't know of anyone who would stand up under that kind draconian stance.

Post reply on HN