3 ms·
isn't youtube's content mostly if not all freely accessible already? the premium portion can be hosted as ssl-only, what about the rest 99% of the content that
by ausjke 11y ago
isn't youtube's content mostly if not all freely accessible already? the premium portion can be hosted as ssl-only, what about the rest 99% of the content that is public already, why do we need care about hijacking in this case?
- seanwilson 11y agoFor the extra complication of making a mixed HTTP and HTTPS site, what benefit are you gaining?
- ausjke 11y agonginx and apache can support http/https in parallel fairly easily, not much extra complication per se. the benefits are listed in a post below. I was chatting with a youtube engineer last night and she told me that she does not recall a wide discussion on disabling http fully, I thus submitted a request in youtube's forum and see how it goes.
- seanwilson 11y ago> nginx and apache can support http/https in parallel fairly easily, not much extra complication per se. the benefits are listed in a post below. There are extra complications besides the server setup. For example, it's harder to avoid mixed content errors on HTTPS pages, you couldn't just use the "secure" flag on all cookies and you need to be careful not to send passwords or session data over HTTP. Many sites have login forms on HTTP pages that then send you over to the HTTPS site for example but this isn't secure. Not saying it has no benefits, but mixing HTTP and HTTPS does have complications. > I was chatting with a youtube engineer last night and she told me that she does not recall a wide discussion on disabling http fully, I thus submitted a request in youtube's forum and see how it goes. Great, I'd be interested to know the reason as well.