4 ms·

> The problem is, it's almost impossible to switch completely from HTTP to HTTPS in one fell swoop—there are just too many factors that need to be tested and de

> The problem is, it's almost impossible to switch completely from HTTP to HTTPS in one fell swoop—there are just too many factors that need to be tested and debugged. Such as? Article is a bit short on facts here. > At the same time, webmasters weren't keen to begin the migration process to HTTPS because of that pesky mixed content warning, which had a tendency to spook less-experienced users of the Information Superhighway. And rightfully so! There's no difference between mixed content and HTTP only for the purposes of data security. Just yesterday I noticed that a payments website had mixed content issues and elected not to risk my personal info. This change is even better because now you really can tell your family to "just look for the lock icon".

dheera 11y ago
> Such as? Article is a bit short on facts here. * Using JavaScript to access APIs that don't support HTTPS (NextBus) * Embedding iframed content from sites that don't support HTTPS (Youku) * Using CDNs for photographs and file downloads, using your own domain, and without paying a ton of money to get them to install your certificates (Imgix, Amazon)
acqq 11y ago
> Such as? Article is a bit short on facts here. It was recently documented that some ad mechanisms for which Google gets money wouldn't work.
seanwilson 11y ago
> Such as? Article is a bit short on facts here. You need to make sure every image, CSS, JavaScript and frame link on every HTTPS page is served over HTTPS. This might not be straightforward depending on how your site works. For example, if you're using a CMS, such links might be generated by CMS code and CMS plugins that you'll have to modify, and if post editors can embed HTML content in posts all posts will have to be checked. Also, HTTPS may not be supported by third parties you rely on.
smackfu 11y ago
The Chrome blog post says: "Switching an HTTP site to HTTPS can initially result in mixed content, which is undesirable in the long term but important for debugging the migration. During this process the site may not be fully secured, but it will usually not be less secure than before."

dheera 11y ago

> Such as? Article is a bit short on facts here. * Using JavaScript to access APIs that don't support HTTPS (NextBus) * Embedding iframed content from sites that don't support HTTPS (Youku) * Using CDNs for photographs and file downloads, using your own domain, and without paying a ton of money to get them to install your certificates (Imgix, Amazon)

acqq 11y ago

> Such as? Article is a bit short on facts here. It was recently documented that some ad mechanisms for which Google gets money wouldn't work.

seanwilson 11y ago

> Such as? Article is a bit short on facts here. You need to make sure every image, CSS, JavaScript and frame link on every HTTPS page is served over HTTPS. This might not be straightforward depending on how your site works. For example, if you're using a CMS, such links might be generated by CMS code and CMS plugins that you'll have to modify, and if post editors can embed HTML content in posts all posts will have to be checked. Also, HTTPS may not be supported by third parties you rely on.

smackfu 11y ago

The Chrome blog post says: "Switching an HTTP site to HTTPS can initially result in mixed content, which is undesirable in the long term but important for debugging the migration. During this process the site may not be fully secured, but it will usually not be less secure than before."