Still Why No HTTPS?

#1

Post by andimm » Tue, Dec 17, 2019, 7:18 AM UTC

Still Why No HTTPS?
troyhunt.com

Re: Still Why No HTTPS?

#2

Post by wojciechpolak » Tue, Dec 17, 2019, 8:18 AM UTC

"gnu.org" is on the list marked as a Chinese website...

Re: Still Why No HTTPS?

#3

Post by cassianoleal » Tue, Dec 17, 2019, 8:26 AM UTC

I mostly have port 80 egress traffic blocked on Little Snitch. The web is painful to use like that but gives you an idea of the sorry state of websites.

A lot of websites just don't serve over HTTPS, or serve them with domains whose CN or SAN don't match the host.

Many that do support https have links that downgrade you back to http on the same domain.

Re: Still Why No HTTPS?

#4

Post by WilliamEdward » Tue, Dec 17, 2019, 8:27 AM UTC

Some websites adamantly insist they did not need HTTPS because they are purely static.

https://www.troyhunt.com/heres-why-your-static-website-needs...

The same website to my surprise has an article on why this is faulty reasoning.

Re: Still Why No HTTPS?

#5

Post by veb » Tue, Dec 17, 2019, 8:33 AM UTC

I don't get it. With Lets Encrypt, it's like one or two lines to get everything set up.

I'm guessing people aren't as lucky as I am to be running on newer machines and such.

I mean it even edits your nginx files to redirect http to https if you agree. It's not hard.

Re: Still Why No HTTPS?

#6

Post by onion-soup » Tue, Dec 17, 2019, 8:34 AM UTC

veb wrote: post #5

I don't get it. With Lets Encrypt, it's like one or two lines to get everything set up. I'm guessing people aren't as lucky as I am to be running on newer machines and such. I mean it even edits your nginx files to redirect http to https if you agree. It's not hard.

Nope, it is not straight-forward and still a confusing process.

Re: Still Why No HTTPS?

#7

Post by onion-soup » Tue, Dec 17, 2019, 8:34 AM UTC

Because it's always pain in the ass to set it up and then renew?

Re: Still Why No HTTPS?

#8

Post by WilliamEdward » Tue, Dec 17, 2019, 8:36 AM UTC

veb wrote: post #5

I don't get it. With Lets Encrypt, it's like one or two lines to get everything set up. I'm guessing people aren't as lucky as I am to be running on newer machines and such. I mean it even edits your nginx files to redirect http to https if you agree. It's not hard.

I'm fine with people who think it's too hard...

What i cannot stand is people who can do it, but refuse to out of laziness. Or because they want their content to be insecure on purpose.

This applies mostly to big orgs, so indie devs can have some leeway if it's too hard to implement.

Re: Still Why No HTTPS?

#9

Post by chungy » Tue, Dec 17, 2019, 8:38 AM UTC

onion-soup wrote: post #6

veb wrote: post #5

I don't get it. With Lets Encrypt, it's like one or two lines to get everything set up. I'm guessing people aren't as lucky as I am to be running on newer machines and such. I mean it even edits your nginx files to redirect http to https if you agree. It's not hard.

Nope, it is not straight-forward and still a confusing process.

Instructions are here: https://certbot.eff.org/

I don't know how it could possibly be any simpler.

Re: Still Why No HTTPS?

#10

Post by k33l0r » Tue, Dec 17, 2019, 8:44 AM UTC

wojciechpolak wrote: post #2

"gnu.org" is on the list marked as a Chinese website...

There are some other confusing ones as well.

nature.com is marked as Chinese, as are nginx.org and ntp.org.

example.com is Indian in the list as is the now defunct dmoz.org.

I don't understand the methodology behind the country assignments at all…