Live data from Hacker News

The Bureau of Meteorology website does not support connections via HTTPS

bom.gov.au

51–58 of 58 posts

Re: The Bureau of Meteorology website does not support connections via HTTPS

#51
post #32

Earlier quoted context omitted.

> If the data is public and no login or personal/sensitive data is involved why do I need https? Do you care about if the data actually comes from your weather forecasting service and was not tampered with by a third party? Then you need https as well. A different example: a podcasts website I've seen was served over http, and someone argued the same (data is public, no login). The page contained an IBAN for donation…

No need for encryted data transfer here. Proven authority would be enough

I am not familiar with the term "proven authority", but I assume what you mean is that it is enough to prove the authenticity of the data in this case. Yes, a cryptographic signature of the pages content would be enough here, but then you would still have some kind of PKI and cryptography involved and in the end https is the best supported approach for that.

Defaulting to full https also has the advantage that you don't have to re-evaulate if you should be using https in the future, when you make some changes to the functionality or content of a website.

Re: The Bureau of Meteorology website does not support connections via HTTPS

#52
Honestly, I think every third-party involved in transporting http traffic should do the public a service and replace the transmitted data with some cat images or whatever else. Every unencrypted connection should be messed with so that there cannot be accidental unencrypted transmission of sensitive data, just in case.

Re: The Bureau of Meteorology website does not support connections via HTTPS

#53

What practical difference does it make if I connect to an Australian weather forecast site via HTTP or HTTPS? Is the NZ secret police gonna MITM a rain forecast my way when it's actually gonna be a very sunny day?

Here's where people from Australian military intelligence sign-in: http://reg.bom.gov.au/defence/ You tell me why http is bad now.

My android phone was redirected to an https endpoint.

Re: The Bureau of Meteorology website does not support connections via HTTPS

#54

Earlier quoted context omitted.

Here's where people from Australian military intelligence sign-in: http://reg.bom.gov.au/defence/ You tell me why http is bad now.

My android phone was redirected to an https endpoint.

If the first request is plaintext, the request can be intercepted before you ever get the redirect, inserting a trojanised login page instead.

Re: The Bureau of Meteorology website does not support connections via HTTPS

#55

Back in 2013-15 I was fortunate enough to know some people at BoM, specifically done IT people. Their off hand comment around why BOM didn't have https was due to the amount of overhead and infrastructure changes needed to make that https change. Fast forward to 2018ish they recently created a new API, and a new website. Https://Weather.bom.gov.au with https enabled! (which I now have integrated into a raspberry pi a…

The reality is much worse.

For over a decade the BOM themselves ran ads on their website:

https://www.governmentnews.com.au/online-ads-now-permanent-f...

https://web.archive.org/web/20230605202001/http://www.bom.go...

They appear to have stopped the practice in June 2023:

https://web.archive.org/web/20230515000000*/http://www.bom.g...

Re: The Bureau of Meteorology website does not support connections via HTTPS

#56

What practical difference does it make if I connect to an Australian weather forecast site via HTTP or HTTPS? Is the NZ secret police gonna MITM a rain forecast my way when it's actually gonna be a very sunny day?

Aside from browsing history, privacy implications, some ISPs insert adverts, into the HTML - possibly opening up the user, to drive by browser exploits… The reality is, it’s not complicated to add HTTPS, as a feature, so there’s no good reason as to why it’s not implemented - aside from incompetence, or trying to save money, on staff?!

> some ISPs insert adverts, into the HTML - possibly opening up the user, to drive by browser exploits…

Just like some sites insert adverts in web pages, "possibly opening up the user, to drive by browser exploits…"

Re: The Bureau of Meteorology website does not support connections via HTTPS

#57

Back in 2013-15 I was fortunate enough to know some people at BoM, specifically done IT people. Their off hand comment around why BOM didn't have https was due to the amount of overhead and infrastructure changes needed to make that https change. Fast forward to 2018ish they recently created a new API, and a new website. Https://Weather.bom.gov.au with https enabled! (which I now have integrated into a raspberry pi a…

I am very interested in this api. How do I get at it?

AFAIK the only way to programatically obtain bom data is the awful ftp endpoint.

Re: The Bureau of Meteorology website does not support connections via HTTPS

#58

Back in 2013-15 I was fortunate enough to know some people at BoM, specifically done IT people. Their off hand comment around why BOM didn't have https was due to the amount of overhead and infrastructure changes needed to make that https change. Fast forward to 2018ish they recently created a new API, and a new website. Https://Weather.bom.gov.au with https enabled! (which I now have integrated into a raspberry pi a…

I am very interested in this api. How do I get at it? AFAIK the only way to programatically obtain bom data is the awful ftp endpoint.

- https://api.weather.bom.gov.au/v1/ - https://github.com/tonyallan/weather-au - https://pypi.org/project/weather-au/

Enjoy

Post reply on HN