10 ms·

Moving the Washington Post to HTTPS

208 points by joosters 11y ago

swagv 11y ago
Sadly, like too much engineering writing, no attention is given to the "why".
- untog 11y ago
  Isn't that pretty well established by now?
  - Someone1234 11y ago
    Yes, but there will always be die-hards who hate change. I've just given up giving a full explanation and now just point to this: http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok/ http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-f... And this: https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh If they still aren't convinced then they weren't convincible to begin with. There's other arguments too, but if the above doesn't sway them then none of the other arguments would either.
- mahouse 11y ago
  So the site takes longer to load and the users will see mixed content warnings from time to time.
nandhp 11y ago
> not only enable HTTPS on our site but also use our own custom EV certificate¹ Their certificate doesn't look EV to me. (I checked both developer. and www.)
- profmonocle 11y ago
  Odd, I'm seeing an EV cert at https://www.washingtonpost.com/ https://www.washingtonpost.com/ (though not at https://developer.washingtonpost.com/ https://developer.washingtonpost.com/)
  - cpeterso 11y ago
    It looks like they switched their certs recently. I saw the EV cert in Chrome but not Firefox, but force-reloading the page in Firefox then showed the EV cert.
- atmosx 11y ago
  Hm, just don't break it to them that the EV CA doesn't say much if you understand how fundamentally broken the CA system is.
  - Someone1234 11y ago
    I don't see what one has to do with the other. EV adds value over a domain verified certificate by claiming to verify the identity of the organisation. This is done through a background check when an EV certificate is applied for. So if an organisation uses a non-standard domain (e.g. Microsoft purchased "SpecialXBoxPromotion.net" for some holiday discount) you could still see, via EV, that that organisation controlled that domain. The CA system has a few warts, but Certificate Transparency, revocation lists, and oversight are helping combat that. But none of this helps or hurts EV as a concept either way. The real issue with EV isn't with the EV concept or EV process, it is that end users don't understand EV or why it matters.
    - __jal 11y ago
      Agreed about EV, but claiming that the CA system "has a few warts" is similar to claiming Katrina "flooded over a few houses". I consider the CA model as it exists for browsers fundamentally broken even in a world where everyone configured things perfectly and no bugs exist. It "works" today insofar as (for instance) I don't really fear using my bank, Amazon, etc. But the protection doesn't come because the CA model offers any technically strong way for you to be certain of the identity of the server on the other end. Any assurance you have is based on human factors (thus the push to EV certs - more human verification). I'm pretty sure there isn't more wide-scale cert forgery only because it is more useful to target individuals, and possibly because those who have the ability to forge, say, Google's certs have an interest in not loudly demonstrating how broken the system is. Given the number of root certs in everyone's browser right now from entities completely unknown to the users, I really don't understand how people have more confidence than I do.
      - thetmkay 11y ago
        I'm not going to disagree with you on the CA system (I'd have to understand it more), but aside from being a product of CAs, what is the issue with EV? EV's biggest problem is DV certificate: it's hard to communicate the nuance between "controls Amazon.com" and "controls Amazon". EV's were a positive step forward, especially with the introduction of the CA/B Forum, as after Let's Encrypt DVs only value is as an encryption mechanism (i.e. not as security, see phishing). Those "human factors" are unavoidable - identity is a "human factor". The integrity of EV is down to the integrity of the CA who are regulated (now) by a strict set of guidelines. So the set of CAs who can administer EVs are a much smaller subset of CAs who can give out DVs.
- ejcx 11y ago
  Their cert used to be an EV cert. I remember this because the address bar looked absurd as an EV cert "The Washington Post" plus the extra iconography associated with an EV cert. It took up a quarter of my URL bar on a small screen macbook. It looks like they are using instart logic, and are on the same cert as a bunch of their other enterprise customers now.
  - exelius 11y ago
    > It looks like they are using instart logic, and are on the same cert as a bunch of their other enterprise customers now. Which is a great way to know who Instant Logic's customers are, if you're in the CDN business and looking for customers to poach...
  - thetmkay 11y ago
    FYI they had that because EV Certs are tied to the official company name, so if you want a more 'colloquial' name, there's a special field called something like 'doing business as'. Then the displayed green bar says: > Official Business Name (Colloquial Business Name) Which in the case of two very long names...
kremmer21 11y ago
Is this supposed to be an impressive project? Because if it is, I feel sorry for the developers working there.
- pfg 11y ago
  Deploying HTTPS on a site with tons of legacy components, third-party dependencies and a lot of ad networks is definitely no small feat. There's a reason why most news sites are still HTTP-only.
  - benten10 11y ago
    Agreed! Fun/difficult projects aren't always the 'latest and cutting edge' ones. You can have impressive/difficult challenges SPECIALLY while getting legacy components to work with more recent technology, even though the task itself may seem 'simple' for more uhh, inexperienced, developers.
  - kevan 11y ago
    Similar story with ecommerce sites. Even Amazon still runs most of their shop experience over HTTP. From a technical perspective, switching a simple site to HTTPS-only isn't that hard. Fix mixed content warnings, update urls, etc. Ecommerce sites often use dozens of third-party vendors for things like analytics, ads, and recommendations. Making sure all of your dependencies support HTTPS can be a logistical nightmare.
cpeterso 11y ago
Are there any ad networks that are 100% HTTPS? HTTPS ads would work in both HTTP and HTTPS content pages, but HTTP ads may cause mixed content problems. Are the ad networks worried about HTTPS latency? Or are they just lazy? :)
- ceocoder 11y ago
  AFAIK DoubleClick AdX moved to 100% SSL in June[1]. [1] https://support.google.com/adxbuyer/answer/3016708?hl=en https://support.google.com/adxbuyer/answer/3016708?hl=en
- manigandham 11y ago
  Yes - we are: https://instinctive.io https://instinctive.io A real modern ad network focused on clean, static, seamless ads. We're also probably the fastest ad network around, and soon to be one of the most privacy conscious as well. Most typical ad networks aren't actually that capable even though the industry is called "adtech". They're built using the same copy/paste software with outsourced teams and no attention to detail other than how to jam the biggest and loudest ad on a page. Needless to say, that model isn't working anymore.
joosters 11y ago
Why aren't big online publishers more concerned about the junk that the ad networks are attaching onto their sites? If an expert like Google can't even ensure that ads don't auto play or include sound effects, what hope is there that they can protect against malware and other dangerous content leaking in?
- jonknee 11y ago
  It's a concern, but it also pays the bills. You can easily concern yourself out of business.
- untog 11y ago
  Why aren't big online publishers more concerned about the junk that the ad networks If an expert like Google can't even ensure that ads don't auto play The latter answers the former. They are concerned, but there is basically nothing they can do about it if they want to continue to earn money.
  - frik 11y ago
    Google would have the power to blacklist bad players. And the should really do something about it. Bad ads drive people to using adblockers.
  - rwallace 11y ago
    What changed? Many years ago, ads were very bad. Then Google got into the business and enforced clean, tasteful ads and things were good for quite some time. But then they started deteriorating again, worse every year until I finally installed adblock early this year. Did something cause the power balance to swing back away from Google or something? If so, what?
jakobdabo 11y ago
Let's hope WP becomes a trend-setter among news websites in this direction. The only other one (that I know of) is RT. SSLLabs grades WP's HTTPS support "A" [1]. I can see that they don't set HSTS headers and there's no OCSP stapling. Also, their cookies are not set as "secure". [1] - https://www.ssllabs.com/ssltest/analyze.html?d=www.washingtonpost.com&s=192.33.31.56&hideResults=on https://www.ssllabs.com/ssltest/analyze.html?d=www.washingto...
foldor 11y ago
As an aside, did the font on this page bother anyone else? The lowercase "w" in particular just kept confusing me into thinking it was a word in italics and my mind kept stressing it. I looked it up, and the font-family is "Ubuntu".
ilostmykeys 11y ago
Security on the web is broke. Here is what to do about it: http://okturtles.com http://okturtles.com
- scient 11y ago
  groan Not another site claiming blockchains are the solution for everything, please! I've yet to see an actual useful blockchain usage outside of payments.
MaxScheiber 11y ago
Does anyone else have the following issue with the footnote hotlinking on this blog post? When I click the "return" icon on a footnote to jump to the point in the text where the footnote is, I end up several lines below where I should. The sentence with the footnote is concealed by the black WaPo header bar. I can replicate this behavior in Chrome on Ubuntu, Chrome on El Capitan, and Safari on El Capitan.
n0us 11y ago
The Washington Post and the New York Times both seem to have excellent engineering teams and both of their websites are in my opinion some of the best news sites that I've seen on the web. (Vox is also very nice in my opinion though they do not have ssl support apparently) I would gladly pay a netflix-like subscription that gives me a "pass" to top news sites with no advertising. I just don't want to manage a dozen subscriptions to sites and it's difficult to choose between the different options that they offer like "tablet, web, paper" "web, paper" "tablet only" etc. Just take the difficulty away and give me access to the content in whatever format I want, with an addon fee for print delivery.
- acdha 11y ago
  One problem is that the traditional print model is heavily subsidized by advertising – for both the Washington Post and New York Times, it's actually cheaper to get a print subscription which comes with free all-device digital access than it is to buy any combination of digital for more than a single device. (If the ecological cost of all of that unread paper bothers you, you can put in long-duration vacation stops or, in the case of the NYT, have your paper copy sent to a school instead)
  - thetmkay 11y ago
    I personally don't see print media going extinct (books certainly didn't) but I'd hypothesise that availability and convenience is more important than price for the average NYT reader.
    - acdha 11y ago
      I think this is complicated by perceived fairness: normal people do not view different formats as separate products and even people who aren't particularly price sensitive will bristle at something which they see as unfair. Since there's no way to buy an ad-free copy of the NYT, all of their existing customers have been trained to think of the fair price as what a paper subscription costs with little thought about how much of that is subsidized by advertisers. Even high-income people are sensitive to these effects – Doc Searls wrote about a similar problem where the New Yorker's intro pricing made him feel like he was being ripped off, even though I'm certain the cost isn't a noticeable financial issue for him: https://blogs.law.harvard.edu/doc/2015/05/23/dear-magazines-please-quit-screwing-veteran-subscribers/ https://blogs.law.harvard.edu/doc/2015/05/23/dear-magazines-...
darksoul 11y ago
What's fascinating is how fast the washington post is, and how you get different image types depending on the browser you use. Off to check out that CDN provider they use.
deleted 11y ago
[deleted]
esaym 11y ago
I am not sure how I feel about the general HTTPS-ization of the web. I've used squid (http://www.squid-cache.org/ http://www.squid-cache.org/) and dansguardian (http://dansguardian.org/ http://dansguardian.org/) for nearly 15 years now. It greatly speeds up my web and keeps smut away from my family. Yet it is becoming more and more useless everyday because of HTTPS. I used to be able to quickly fly through google maps because most of the images were in cache, even with only 1mbs internet. Then it went HTTPS only. So I started using mapquest, then it too did the same. Bing maps still allows some non HTTPS images, so I now use that sometimes. I can see how some sites might want to be more private in nature. But news and maps websites I am not seeing the point.
- mattmanser 11y ago
  I listened to an interesting opinion on the BBC the other day that the internet wasn't fit for purpose and that no sane parent should ever allow their child on it at all[1]. Her argument is that we don't expect parents to police their children all the time in real life, shop owners have legal responsibilities to stop children accessing inappropriate products, children are stopped from purchasing alcohol in bars, etc. and yet on the internet somehow it's the parent's responsibility all the time all of a sudden. And if your child is with other people, those restrictions may be totally waived. The problem is, it is trivial for a child to access incredibly disturbing and PTSD inducing material that is accessible to any child with ease, beheadings, murders, the most vile and disturbing porn you couldn't even imagine, all two clicks of a button away from your 11 year old. She definitely has a point. I'm not sure what the solution is as I love the internet being open, but a huge proportion of the planet is made up of children and they can go watch ISIS behead someone or a woman shit in the mouth of a man whenever their classmate dares them. [1] http://www.bbc.co.uk/programmes/p039wy7f http://www.bbc.co.uk/programmes/p039wy7f
  - esaym 11y ago
    Yes, it is an issue. And worse, the web has become something so important that you can't just outright deny all access to it. Yet it is still akin to dropping your child off on the wrong side of town unattended and simply "hoping for the best". The old saying used to just be "have the family computer in a public room (living room,ect) and don't allow private access". But with every phone, tv, game console, alarm clock, whatever, all having their own web browsers, the only way to truly filter is from the single source of the ISP connection. 7 years ago I had an idea to make web filtering routers and ethernet bridges. But even then it was becoming too hard to reliably do. And I didn't want to market something for family protection that I couldn't 100% reliably guarantee works. And most recently, a somewhat home constrained neighbor that lived by me wanted me to secure his internet "the way mine is". He was tired of fighting porn addictions. I set him up the best I could, but within a year I had gotten word that he had convinced another friend/relative to buy him a smart phone with unlimited internet access...
autotune 11y ago
> Today, more than 99% of our traffic is redirected to HTTPS. So what are the .9% of traffic that aren't? Web crawler bots?
- Buge 11y ago
  I was thinking it was requests to certain pages that weren't redirected, not requests from certain users. Maybe some pages don't work on https due to mixed content and stuff like that.
fiatjaf 11y ago
I thought they used Wordpress.
frik 11y ago
Could you reduce the 114 requests and the 7.77s page load? Do you really need 6 analytics and 15 3rd party services? Chrome DevTools timing said: 2.71s Scripting; 636ms Rendering; 210ms Painting WashingtonPost.com crashes my iPad Safari, see: https://news.ycombinator.com/item?id=10697235 https://news.ycombinator.com/item?id=10697235
- popcornarsonist 11y ago
  This is almost certainly the ads that they're talking about in this post. They don't really have any control over what kind of trackers are included in 3rd party ads. I would wager that if you reload the site at different times of the day, you'll get different numbers. It's a sad reality of the advertising world—the people building the ads simply don't care, and the ad networks can't (or won't) do good QA.
  - manigandham 11y ago
    It's a lot more complicated than that. Yes there are lots of ad networks that are crappy and don't have good QA but lots of this is down to the buyers themselves. The big clients and agencies who do ad buys have thousands of requirements including 3rd party verification, tracking, conversion pixels, etc. We run one of the fastest ad networks available with everything optimized to the fewest network requests, yet a single campaign from someone like ATT will mean a dozen other tags that needed to be loaded if we run their ads. It's a lack of trust, standards and actually technical understanding that's hurting this industry the most.

208 points by joosters 11y ago

swagv 11y ago

Sadly, like too much engineering writing, no attention is given to the "why".

untog 11y ago
Isn't that pretty well established by now?
- Someone1234 11y ago
  Yes, but there will always be die-hards who hate change. I've just given up giving a full explanation and now just point to this: http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok/ http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-f... And this: https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh If they still aren't convinced then they weren't convincible to begin with. There's other arguments too, but if the above doesn't sway them then none of the other arguments would either.
mahouse 11y ago
So the site takes longer to load and the users will see mixed content warnings from time to time.

nandhp 11y ago

> not only enable HTTPS on our site but also use our own custom EV certificate¹ Their certificate doesn't look EV to me. (I checked both developer. and www.)

profmonocle 11y ago
Odd, I'm seeing an EV cert at https://www.washingtonpost.com/ https://www.washingtonpost.com/ (though not at https://developer.washingtonpost.com/ https://developer.washingtonpost.com/)
- cpeterso 11y ago
  It looks like they switched their certs recently. I saw the EV cert in Chrome but not Firefox, but force-reloading the page in Firefox then showed the EV cert.
atmosx 11y ago
Hm, just don't break it to them that the EV CA doesn't say much if you understand how fundamentally broken the CA system is.
- Someone1234 11y ago
  I don't see what one has to do with the other. EV adds value over a domain verified certificate by claiming to verify the identity of the organisation. This is done through a background check when an EV certificate is applied for. So if an organisation uses a non-standard domain (e.g. Microsoft purchased "SpecialXBoxPromotion.net" for some holiday discount) you could still see, via EV, that that organisation controlled that domain. The CA system has a few warts, but Certificate Transparency, revocation lists, and oversight are helping combat that. But none of this helps or hurts EV as a concept either way. The real issue with EV isn't with the EV concept or EV process, it is that end users don't understand EV or why it matters.
  - __jal 11y ago
    Agreed about EV, but claiming that the CA system "has a few warts" is similar to claiming Katrina "flooded over a few houses". I consider the CA model as it exists for browsers fundamentally broken even in a world where everyone configured things perfectly and no bugs exist. It "works" today insofar as (for instance) I don't really fear using my bank, Amazon, etc. But the protection doesn't come because the CA model offers any technically strong way for you to be certain of the identity of the server on the other end. Any assurance you have is based on human factors (thus the push to EV certs - more human verification). I'm pretty sure there isn't more wide-scale cert forgery only because it is more useful to target individuals, and possibly because those who have the ability to forge, say, Google's certs have an interest in not loudly demonstrating how broken the system is. Given the number of root certs in everyone's browser right now from entities completely unknown to the users, I really don't understand how people have more confidence than I do.
    - thetmkay 11y ago
      I'm not going to disagree with you on the CA system (I'd have to understand it more), but aside from being a product of CAs, what is the issue with EV? EV's biggest problem is DV certificate: it's hard to communicate the nuance between "controls Amazon.com" and "controls Amazon". EV's were a positive step forward, especially with the introduction of the CA/B Forum, as after Let's Encrypt DVs only value is as an encryption mechanism (i.e. not as security, see phishing). Those "human factors" are unavoidable - identity is a "human factor". The integrity of EV is down to the integrity of the CA who are regulated (now) by a strict set of guidelines. So the set of CAs who can administer EVs are a much smaller subset of CAs who can give out DVs.
ejcx 11y ago
Their cert used to be an EV cert. I remember this because the address bar looked absurd as an EV cert "The Washington Post" plus the extra iconography associated with an EV cert. It took up a quarter of my URL bar on a small screen macbook. It looks like they are using instart logic, and are on the same cert as a bunch of their other enterprise customers now.
- exelius 11y ago
  > It looks like they are using instart logic, and are on the same cert as a bunch of their other enterprise customers now. Which is a great way to know who Instant Logic's customers are, if you're in the CDN business and looking for customers to poach...
- thetmkay 11y ago
  FYI they had that because EV Certs are tied to the official company name, so if you want a more 'colloquial' name, there's a special field called something like 'doing business as'. Then the displayed green bar says: > Official Business Name (Colloquial Business Name) Which in the case of two very long names...

kremmer21 11y ago

Is this supposed to be an impressive project? Because if it is, I feel sorry for the developers working there.

pfg 11y ago
Deploying HTTPS on a site with tons of legacy components, third-party dependencies and a lot of ad networks is definitely no small feat. There's a reason why most news sites are still HTTP-only.
- benten10 11y ago
  Agreed! Fun/difficult projects aren't always the 'latest and cutting edge' ones. You can have impressive/difficult challenges SPECIALLY while getting legacy components to work with more recent technology, even though the task itself may seem 'simple' for more uhh, inexperienced, developers.
- kevan 11y ago
  Similar story with ecommerce sites. Even Amazon still runs most of their shop experience over HTTP. From a technical perspective, switching a simple site to HTTPS-only isn't that hard. Fix mixed content warnings, update urls, etc. Ecommerce sites often use dozens of third-party vendors for things like analytics, ads, and recommendations. Making sure all of your dependencies support HTTPS can be a logistical nightmare.

cpeterso 11y ago

Are there any ad networks that are 100% HTTPS? HTTPS ads would work in both HTTP and HTTPS content pages, but HTTP ads may cause mixed content problems. Are the ad networks worried about HTTPS latency? Or are they just lazy? :)

ceocoder 11y ago
AFAIK DoubleClick AdX moved to 100% SSL in June[1]. [1] https://support.google.com/adxbuyer/answer/3016708?hl=en https://support.google.com/adxbuyer/answer/3016708?hl=en
manigandham 11y ago
Yes - we are: https://instinctive.io https://instinctive.io A real modern ad network focused on clean, static, seamless ads. We're also probably the fastest ad network around, and soon to be one of the most privacy conscious as well. Most typical ad networks aren't actually that capable even though the industry is called "adtech". They're built using the same copy/paste software with outsourced teams and no attention to detail other than how to jam the biggest and loudest ad on a page. Needless to say, that model isn't working anymore.

joosters 11y ago

Why aren't big online publishers more concerned about the junk that the ad networks are attaching onto their sites? If an expert like Google can't even ensure that ads don't auto play or include sound effects, what hope is there that they can protect against malware and other dangerous content leaking in?

jonknee 11y ago
It's a concern, but it also pays the bills. You can easily concern yourself out of business.
untog 11y ago
Why aren't big online publishers more concerned about the junk that the ad networks If an expert like Google can't even ensure that ads don't auto play The latter answers the former. They are concerned, but there is basically nothing they can do about it if they want to continue to earn money.
- frik 11y ago
  Google would have the power to blacklist bad players. And the should really do something about it. Bad ads drive people to using adblockers.
- rwallace 11y ago
  What changed? Many years ago, ads were very bad. Then Google got into the business and enforced clean, tasteful ads and things were good for quite some time. But then they started deteriorating again, worse every year until I finally installed adblock early this year. Did something cause the power balance to swing back away from Google or something? If so, what?

jakobdabo 11y ago

Let's hope WP becomes a trend-setter among news websites in this direction. The only other one (that I know of) is RT. SSLLabs grades WP's HTTPS support "A" [1]. I can see that they don't set HSTS headers and there's no OCSP stapling. Also, their cookies are not set as "secure". [1] - https://www.ssllabs.com/ssltest/analyze.html?d=www.washingtonpost.com&s=192.33.31.56&hideResults=on https://www.ssllabs.com/ssltest/analyze.html?d=www.washingto...

foldor 11y ago

As an aside, did the font on this page bother anyone else? The lowercase "w" in particular just kept confusing me into thinking it was a word in italics and my mind kept stressing it. I looked it up, and the font-family is "Ubuntu".

ilostmykeys 11y ago

Security on the web is broke. Here is what to do about it: http://okturtles.com http://okturtles.com

scient 11y ago
groan Not another site claiming blockchains are the solution for everything, please! I've yet to see an actual useful blockchain usage outside of payments.

MaxScheiber 11y ago

Does anyone else have the following issue with the footnote hotlinking on this blog post? When I click the "return" icon on a footnote to jump to the point in the text where the footnote is, I end up several lines below where I should. The sentence with the footnote is concealed by the black WaPo header bar. I can replicate this behavior in Chrome on Ubuntu, Chrome on El Capitan, and Safari on El Capitan.

n0us 11y ago

The Washington Post and the New York Times both seem to have excellent engineering teams and both of their websites are in my opinion some of the best news sites that I've seen on the web. (Vox is also very nice in my opinion though they do not have ssl support apparently) I would gladly pay a netflix-like subscription that gives me a "pass" to top news sites with no advertising. I just don't want to manage a dozen subscriptions to sites and it's difficult to choose between the different options that they offer like "tablet, web, paper" "web, paper" "tablet only" etc. Just take the difficulty away and give me access to the content in whatever format I want, with an addon fee for print delivery.

acdha 11y ago
One problem is that the traditional print model is heavily subsidized by advertising – for both the Washington Post and New York Times, it's actually cheaper to get a print subscription which comes with free all-device digital access than it is to buy any combination of digital for more than a single device. (If the ecological cost of all of that unread paper bothers you, you can put in long-duration vacation stops or, in the case of the NYT, have your paper copy sent to a school instead)
- thetmkay 11y ago
  I personally don't see print media going extinct (books certainly didn't) but I'd hypothesise that availability and convenience is more important than price for the average NYT reader.
  - acdha 11y ago
    I think this is complicated by perceived fairness: normal people do not view different formats as separate products and even people who aren't particularly price sensitive will bristle at something which they see as unfair. Since there's no way to buy an ad-free copy of the NYT, all of their existing customers have been trained to think of the fair price as what a paper subscription costs with little thought about how much of that is subsidized by advertisers. Even high-income people are sensitive to these effects – Doc Searls wrote about a similar problem where the New Yorker's intro pricing made him feel like he was being ripped off, even though I'm certain the cost isn't a noticeable financial issue for him: https://blogs.law.harvard.edu/doc/2015/05/23/dear-magazines-please-quit-screwing-veteran-subscribers/ https://blogs.law.harvard.edu/doc/2015/05/23/dear-magazines-...

darksoul 11y ago

What's fascinating is how fast the washington post is, and how you get different image types depending on the browser you use. Off to check out that CDN provider they use.

deleted 11y ago

[deleted]

esaym 11y ago

I am not sure how I feel about the general HTTPS-ization of the web. I've used squid (http://www.squid-cache.org/ http://www.squid-cache.org/) and dansguardian (http://dansguardian.org/ http://dansguardian.org/) for nearly 15 years now. It greatly speeds up my web and keeps smut away from my family. Yet it is becoming more and more useless everyday because of HTTPS. I used to be able to quickly fly through google maps because most of the images were in cache, even with only 1mbs internet. Then it went HTTPS only. So I started using mapquest, then it too did the same. Bing maps still allows some non HTTPS images, so I now use that sometimes. I can see how some sites might want to be more private in nature. But news and maps websites I am not seeing the point.

mattmanser 11y ago
I listened to an interesting opinion on the BBC the other day that the internet wasn't fit for purpose and that no sane parent should ever allow their child on it at all[1]. Her argument is that we don't expect parents to police their children all the time in real life, shop owners have legal responsibilities to stop children accessing inappropriate products, children are stopped from purchasing alcohol in bars, etc. and yet on the internet somehow it's the parent's responsibility all the time all of a sudden. And if your child is with other people, those restrictions may be totally waived. The problem is, it is trivial for a child to access incredibly disturbing and PTSD inducing material that is accessible to any child with ease, beheadings, murders, the most vile and disturbing porn you couldn't even imagine, all two clicks of a button away from your 11 year old. She definitely has a point. I'm not sure what the solution is as I love the internet being open, but a huge proportion of the planet is made up of children and they can go watch ISIS behead someone or a woman shit in the mouth of a man whenever their classmate dares them. [1] http://www.bbc.co.uk/programmes/p039wy7f http://www.bbc.co.uk/programmes/p039wy7f
- esaym 11y ago
  Yes, it is an issue. And worse, the web has become something so important that you can't just outright deny all access to it. Yet it is still akin to dropping your child off on the wrong side of town unattended and simply "hoping for the best". The old saying used to just be "have the family computer in a public room (living room,ect) and don't allow private access". But with every phone, tv, game console, alarm clock, whatever, all having their own web browsers, the only way to truly filter is from the single source of the ISP connection. 7 years ago I had an idea to make web filtering routers and ethernet bridges. But even then it was becoming too hard to reliably do. And I didn't want to market something for family protection that I couldn't 100% reliably guarantee works. And most recently, a somewhat home constrained neighbor that lived by me wanted me to secure his internet "the way mine is". He was tired of fighting porn addictions. I set him up the best I could, but within a year I had gotten word that he had convinced another friend/relative to buy him a smart phone with unlimited internet access...

autotune 11y ago

> Today, more than 99% of our traffic is redirected to HTTPS. So what are the .9% of traffic that aren't? Web crawler bots?

Buge 11y ago
I was thinking it was requests to certain pages that weren't redirected, not requests from certain users. Maybe some pages don't work on https due to mixed content and stuff like that.

fiatjaf 11y ago

I thought they used Wordpress.

frik 11y ago

Could you reduce the 114 requests and the 7.77s page load? Do you really need 6 analytics and 15 3rd party services? Chrome DevTools timing said: 2.71s Scripting; 636ms Rendering; 210ms Painting WashingtonPost.com crashes my iPad Safari, see: https://news.ycombinator.com/item?id=10697235 https://news.ycombinator.com/item?id=10697235

popcornarsonist 11y ago
This is almost certainly the ads that they're talking about in this post. They don't really have any control over what kind of trackers are included in 3rd party ads. I would wager that if you reload the site at different times of the day, you'll get different numbers. It's a sad reality of the advertising world—the people building the ads simply don't care, and the ad networks can't (or won't) do good QA.
- manigandham 11y ago
  It's a lot more complicated than that. Yes there are lots of ad networks that are crappy and don't have good QA but lots of this is down to the buyers themselves. The big clients and agencies who do ad buys have thousands of requirements including 3rd party verification, tracking, conversion pixels, etc. We run one of the fastest ad networks available with everything optimized to the fewest network requests, yet a single campaign from someone like ATT will mean a dozen other tags that needed to be loaded if we run their ads. It's a lack of trust, standards and actually technical understanding that's hurting this industry the most.