Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS on Stack Overflow: The End of a Long Road

nickcraver.com

Post reply on HN
Print view View original

121–130 of 183 posts

Re: HTTPS on Stack Overflow: The End of a Long Road

#121

Post by jjawssd »

y4mi wrote: post #45
mattmanser wrote: post #39

Earlier quoted context omitted.

I know it's hindsight and all that, but why didn't you check your website analytics first? Seems a fairly massive assumption that should have taken 10 seconds to check.

Some people don't spy on their customers and don't have these kinds of information available for analyses They're admittedly few though and their moral high ground is debatable considering that there are self hosted FOSS alternatives around nowadays

Are you implying that analyzing server logs to gather aggregate user agent statistics is "spying on [your] customers?"

Because that is untrue.

Re: HTTPS on Stack Overflow: The End of a Long Road

#122

Post by Spooky23 »

teraflop wrote: post #58
dzdt wrote: post #49

Stack Exchange is no longer available from my workplace due to this change. We have a strict no-posting-code-fragments policy, and SE was viewed as too risky to allow without some restriction in place to make it read only. Before HTTPS, the IT department had worked out such a read-only restriction by blocking the SE login with firewall rules. But with HTTPS that kludge is no longer possible, so the site is blocked.

Leaving aside all the reasons why this policy is super dumb (which I'm sure others will cover quite adequately), I guess your IT department can't figure out how to create their own CA certificate and do SSL interception?

I disagree about the dumbness.

People do incredibly stupid things. I've seen customer data dumps on web forums.

Re: HTTPS on Stack Overflow: The End of a Long Road

#123

Post by profmonocle »

jfroma wrote: post #111
mrunkel wrote: post #7

At $previous_job we once turned on HTTPS for our entire customer website and online store, only to have our customer support team be bombarded by phone calls claiming that our "website was down." After much teeth gnashing and research, we determined that a large segment of our user base was still using WinXP and the encryption protocols we offered weren't available to them. We didn't think this would be a problem bec…

The other problem with Windows XP and https is SNI. You cant serve more than one domain with different ssl certificates from the same IP address, you either use SANs or different IP addresses. This does not only affect IE on XP but every browser.

> https://twitter.com/David_Leavitt/status/866790014717497345

IIRC, Chrome and Firefox for XP support SNI because they bundle their own TLS libraries, rather than using a system library.

Re: HTTPS on Stack Overflow: The End of a Long Road

#124

Post by linkregister »

astrodust wrote: post #90
boyter wrote: post #69

Earlier quoted context omitted.

Same thing happened to me at a workplace once. They blocked StackOverflow, GitHub, Bitbucket, Sourceforge, CodePlex and Google Code. I told them all estimates go up by 2 years since we would need to reimplement everything. It ended up being unblocked a week later.

I don't know how you'd get anything done since there are answers on Stack Overflow that solve problems that otherwise would involve hours to days of fussing to come up with the same non-intuitive solution. All roads lead to Stack Overflow these days for progrmaming problems.

For every answered question, there are probably 20 unanswered ones. Almost none of my embedded programming questions got answered.

Edit: my estimate is wildly off. It's basically the opposite of what I said.

Re: HTTPS on Stack Overflow: The End of a Long Road

#125

Post by int_19h »

astrodust wrote: post #93
baby wrote: post #8

Earlier quoted context omitted.

TLS kills this kind of "cool" features which is kind of sad :( Unless you can afford wildcard certs. What's the argument behind LetsEncrypt not doing that? Extended Validation stuff?

They cost like $199 or less. It's an anoying tax, but they do offer a lot of options, so they're often worth it.

Way less than that. I've got a wildcard SSL cert for my domain for $60, although that was an add-on to the domain itself and hosting, purchased from the provider of the latter.

Re: HTTPS on Stack Overflow: The End of a Long Road

#126

Post by Nick-Craver »

linkregister wrote: post #124
astrodust wrote: post #90

Earlier quoted context omitted.

I don't know how you'd get anything done since there are answers on Stack Overflow that solve problems that otherwise would involve hours to days of fussing to come up with the same non-intuitive solution. All roads lead to Stack Overflow these days for progrmaming problems.

For every answered question, there are probably 20 unanswered ones. Almost none of my embedded programming questions got answered. Edit: my estimate is wildly off. It's basically the opposite of what I said.

12,095,709 questions have an answer, 7,506,004 of those have an accepted answer, and 1,813,270 aren't yet answered.

I'd say your 1:20 ratio is just a little bit off :)

Re: HTTPS on Stack Overflow: The End of a Long Road

#127

Post by jameskegel »

y4mi wrote: post #45
mattmanser wrote: post #39

Earlier quoted context omitted.

I know it's hindsight and all that, but why didn't you check your website analytics first? Seems a fairly massive assumption that should have taken 10 seconds to check.

Some people don't spy on their customers and don't have these kinds of information available for analyses They're admittedly few though and their moral high ground is debatable considering that there are self hosted FOSS alternatives around nowadays

Out of all the grey comments, this one does not deserve to be greyed out.

Re: HTTPS on Stack Overflow: The End of a Long Road

#128

Post by linkregister »

Nick-Craver wrote: post #126
linkregister wrote: post #124

Earlier quoted context omitted.

For every answered question, there are probably 20 unanswered ones. Almost none of my embedded programming questions got answered. Edit: my estimate is wildly off. It's basically the opposite of what I said.

12,095,709 questions have an answer, 7,506,004 of those have an accepted answer, and 1,813,270 aren't yet answered. I'd say your 1:20 ratio is just a little bit off :)

Thanks for the correction! I am asking pretty niche questions.

Re: HTTPS on Stack Overflow: The End of a Long Road

#129

Post by make3 »

boyter wrote: post #69
dzdt wrote: post #49

Stack Exchange is no longer available from my workplace due to this change. We have a strict no-posting-code-fragments policy, and SE was viewed as too risky to allow without some restriction in place to make it read only. Before HTTPS, the IT department had worked out such a read-only restriction by blocking the SE login with firewall rules. But with HTTPS that kludge is no longer possible, so the site is blocked.

Same thing happened to me at a workplace once. They blocked StackOverflow, GitHub, Bitbucket, Sourceforge, CodePlex and Google Code. I told them all estimates go up by 2 years since we would need to reimplement everything. It ended up being unblocked a week later.

This sounds beyond absurd to me. Do they also block usb ports to prevent you from copying everything on a usb drive or external harddrive, or phone? Do they lock/solder you machines shut to prevent you from taking out a hard drive / plugging in a new one and then taking it out? Do they prevent you from .. printing the code? In what parallel world do they exist that they think this would make a difference

Re: HTTPS on Stack Overflow: The End of a Long Road

#130

Post by [deleted] »

cortesoft wrote: post #100
baby wrote: post #84

Earlier quoted context omitted.

I'm not sure I understand the question. If you own something.com then you automatically own any possible subdomains.

The Let's Encrypt process is about validating control of the content on a domain, not about OWNERSHIP of the domain. To get a cert, you just have to be able to update a file at a Let's Encrypt specified location on the domain. This is only proving that you are in control of the website for that specific domain, not that you are in control of the DNS for the entire domain and all subdomains. Of course if I own a domai…

[deleted]
Post reply on HN