HTTPS on Stack Overflow: The End of a Long Road
nickcraver.com
HTTPS on Stack Overflow: The End of a Long Road
1–10 of 183 posts
Re: HTTPS on Stack Overflow: The End of a Long Road
#2This is incredibly detailed; in short, CDNs, cookies/authentication , tons of subdomains, and 3rd-party/user-generated content make it a pain to move onto HTTPS.
I was chatting with a non-engineer friend about why it's hard to estimate how long tasks often take, and this seems like a prime illustration: the dependencies are endless.
I also love the Easter egg:
"The password to our data center is pickles. I didn’t think anyone would read this far and it seemed like a good place to store it."
Re: HTTPS on Stack Overflow: The End of a Long Road
#3[deleted]
Re: HTTPS on Stack Overflow: The End of a Long Road
#4> The password to our data center is pickles. I didn’t think anyone would read this far and it seemed like a good place to store it.
You ought to have more confidence in your writing. BRB stealing all your servers.
Re: HTTPS on Stack Overflow: The End of a Long Road
#5Note to self: Use subdirectories, not subdomains in the future
Re: HTTPS on Stack Overflow: The End of a Long Road
#6Your blog posts are always an interesting read
Re: HTTPS on Stack Overflow: The End of a Long Road
#7At $previous_job we once turned on HTTPS for our entire customer website and online store, only to have our customer support team be bombarded by phone calls claiming that our "website was down."
After much teeth gnashing and research, we determined that a large segment of our user base was still using WinXP and the encryption protocols we offered weren't available to them.
We didn't think this would be a problem because the current version of the software wasn't compatible with WinXP any longer.
There was some debate internally whether the better fix was to including the legacy encryption protocols or just leave the HTTP version of the site running and use Strict-Transport-Security to move capable browsers to HTTPS.
In the end we had to include the legacy protocols so those customers could use our online store.
Re: HTTPS on Stack Overflow: The End of a Long Road
#8Note to self: Use subdirectories, not subdomains in the future
TLS kills this kind of "cool" features which is kind of sad :( Unless you can afford wildcard certs.
What's the argument behind LetsEncrypt not doing that? Extended Validation stuff?
Re: HTTPS on Stack Overflow: The End of a Long Road
#9Note to self: Use subdirectories, not subdomains in the future
TLS kills this kind of "cool" features which is kind of sad :( Unless you can afford wildcard certs. What's the argument behind LetsEncrypt not doing that? Extended Validation stuff?
Probably their agreements with their partner CAs. Given that those partners sell wildcards themselves...
Re: HTTPS on Stack Overflow: The End of a Long Road
#10Just a reminder, HTTPS isn't enough. Be sure to turn the other security knobs with headers...
https://securityheaders.io/?q=https%3A%2F%2Fstackoverflow.co...