Enabling Secure HTTP for BBC Online
bbc.co.uk
Enabling Secure HTTP for BBC Online
1–10 of 63 posts
Re: Enabling Secure HTTP for BBC Online
#2Apologies if I'm being naive, but how does it take 3 architects a whole year to upgrade a family of websites to HTTPS? The BBC are way behind the times here, although the article alludes to issues with suppliers.
Re: Enabling Secure HTTP for BBC Online
#3> The CPU overhead of TLS encryption has historically been significant. We’ve done a lot of work behind the scenes to improve both the software and hardware layers to minimise the load impact of TLS whilst also improving security.
I thought that it hasn't been significant overhead for a while now?
related: https://www.maxcdn.com/blog/ssl-performance-myth/ https://istlsfastyet.com/
Re: Enabling Secure HTTP for BBC Online
#4Apologies if I'm being naive, but how does it take 3 architects a whole year to upgrade a family of websites to HTTPS? The BBC are way behind the times here, although the article alludes to issues with suppliers.
Well, every 3rd party scripts e.g. for tracking you are using needs to be on https too. CDN and all webservers needs to serve traffic over https. You need a secure way to update cecrtificates across the whole network. Of course if you run single website it's simple but when you have hundrets of servers and multiple 3rd party tools it might get tricky.
Re: Enabling Secure HTTP for BBC Online
#5> HTTPS has been around since 1996
A blog post about spending several years updating to a protocol that's been around for 2 decades and has been standard for full sites for years. This makes me feel like anyone who has an account on BBC should be afraid of their security practices. Calling a plaintext password leak from BBC right now.
EDIT: People are taking this comment more seriously than I intended. I don't actually think you should distrust BBC's security practices because of this, but I do feel that major websites should have side-wide SSL by now. It is clear that a lot of people below me disagree with that, that's okay, I'm glad I spawned a debate here.
Re: Enabling Secure HTTP for BBC Online
#6Apologies if I'm being naive, but how does it take 3 architects a whole year to upgrade a family of websites to HTTPS? The BBC are way behind the times here, although the article alludes to issues with suppliers.
That's roughly the response time for Comodo customer support.
Re: Enabling Secure HTTP for BBC Online
#7It was gutsy (and insightful) of them to publish to the world their upgrade experience. I wish people would be a little more positive about that instead of pointing out how much they suck.
Re: Enabling Secure HTTP for BBC Online
#8Apologies if I'm being naive, but how does it take 3 architects a whole year to upgrade a family of websites to HTTPS? The BBC are way behind the times here, although the article alludes to issues with suppliers.
There are probably a million different websites and applications hitting their HTTP endpoint, and likewise for scripts and assets embedded in their webpages hitting third party non-HTTPS endpoints. If you just start serving your existing HTML and APIs on HTTPS, lots of stuff will break.
They probably have more websites and hostnames than you'd realize, as well. Take a look at a site like https://dnsdumpster.com/ and search for bbc.co.uk
Re: Enabling Secure HTTP for BBC Online
#9> HTTPS has been around since 1996 A blog post about spending several years updating to a protocol that's been around for 2 decades and has been standard for full sites for years. This makes me feel like anyone who has an account on BBC should be afraid of their security practices. Calling a plaintext password leak from BBC right now. EDIT: People are taking this comment more seriously than I intended. I don't actual…
Calling FUD on your comment.
It hasn't been "standard on full sites for years", and still isn't now. Only recently with the 'HTTPS everywhere' move has the idea that public sites with no authentication should support HTTPS. And even now, that's not a universally supported opinion, because of its effect on caching.
The BBC has used HTTPS on pages with forms that submit secure data, as has been the historic standard.
Moving a site as massive as the BBC, which spans multiple domains and subdomains and has millions of pages is a big task. Note how you can still see news articles from the late 90s at the same URL. So, yeah, I can understand why writing a blog post about it is worthwhile.
Re: Enabling Secure HTTP for BBC Online
#10Apologies if I'm being naive, but how does it take 3 architects a whole year to upgrade a family of websites to HTTPS? The BBC are way behind the times here, although the article alludes to issues with suppliers.
There were four major bullet points on the challenges. I imagine they also have other things to do and need to spend time persuading people to make changes elsewhere in the org.