4 ms·

Can someone tell me why this might have been required? What are the situations which might prompt a developer to make their users use http instead of https?

gosukiwi 10y ago
Money :p
nitrogen 10y ago
What are the situations which might prompt a developer to make their users use http instead of https? Tracking detailed referrer information from social media, etc. I don't agree with this goal, but it is something that's very important to people running sites with significant social traffic.
Benjamin_Dobell 10y ago
Caching. Mind you, I don't know if that's the case here; it certainly doesn't seem like caching should be a large priority for this sort of content.
blowski 10y ago
At a guess, it was built years ago by an agency selected on the basis of anything other than technical competence. As a result it probably has thousands of hard coded HTTP links and an oddly configured out of date web server. Given the 'encryption is only used by terrorists' climate, spending the time and money to make it work for https sounds like a hard sell. No sources, but I have done some work in UK public sector and that kind of story would match.
- SFJulie 10y ago
  Well it does the job, and if it aint broken why fix it?
  - unepipe 10y ago
    It creates an easy vector for MITM attacks - could be done by nefarious parties on US citizens traveling in other countries for example.
    - SFJulie 10y ago
      So looking who are your senators is putting you at risk? Isn't it a tad paranoid?
  - unepipe 10y ago
    It creates an easy vector for MITM attacks - could be done by nefarious parties on US citizens traveling in other countries for example.
shmapf 10y ago
Just a wild guess, but if there are non secure assets in the page, this would result in a browser warning, arguably more suspicious looking than this for average users. As a quick and dirty workaround they may have done this?
- akira2501 10y ago
  Interestingly, some of the subdomains like https://www.budget.senate.gov/ https://www.budget.senate.gov/ use the same certificate and do allow you to load their pages with mixed sources. If this was the idea, it was done fairly shoddy.. more than a few sites in the 'Alternative Name' field will still load.
retube 10y ago
Legacy site/infrastructure that hasn't (or can't) be upgraded?
acdha 10y ago
Think of the government as a particular large, stratified enterprise IT shop with some weighty policy/legal requirements driving some of the internal barriers. I'm imagining that it went something like this: the group which owns the public web servers decides to start using HTTPS and slogs through renegotiating their CDN contract, purchasing and installing an EV certificate, etc. As they go through compatibility testing, someone finds a problem. Maybe that's a bunch of legacy HTML which triggers mixed-content warnings, maybe that's a problem with some creaky old legacy application which expects HTTP and doesn't follow redirects or chokes on modern cipher suites, etc. Since they can no longer say that switching won't break anything, someone pauses the project until they can fix the problems. Maybe someone suggests using a rewriting proxy to fix it but the people who own the server it'd need to run on are worried about performance/security. Maybe the legacy app is something licensed from a vendor who wants $$$ for a major upgrade rather than just making this one change. Maybe that requires a change in next year's budget because they've already allocated all of the money they're legally allowed to spend on that class of work. It could be as simple as budget: they're using Akamai and it's likely that the contract they originally signed didn't include HTTPS, and at least in the past adding it was a non-trivial price increase. I could easily believe that this could be as simple as either a test pending a new contract or that a section of the website (or a subdomain) uses HTTPS but they added a general redirect to avoid paying the higher HTTPS rates for traffic which doesn't require it.

gosukiwi 10y ago

Money :p

nitrogen 10y ago

What are the situations which might prompt a developer to make their users use http instead of https? Tracking detailed referrer information from social media, etc. I don't agree with this goal, but it is something that's very important to people running sites with significant social traffic.

Benjamin_Dobell 10y ago

Caching. Mind you, I don't know if that's the case here; it certainly doesn't seem like caching should be a large priority for this sort of content.

blowski 10y ago

At a guess, it was built years ago by an agency selected on the basis of anything other than technical competence. As a result it probably has thousands of hard coded HTTP links and an oddly configured out of date web server. Given the 'encryption is only used by terrorists' climate, spending the time and money to make it work for https sounds like a hard sell. No sources, but I have done some work in UK public sector and that kind of story would match.

SFJulie 10y ago
Well it does the job, and if it aint broken why fix it?
- unepipe 10y ago
  It creates an easy vector for MITM attacks - could be done by nefarious parties on US citizens traveling in other countries for example.
  - SFJulie 10y ago
    So looking who are your senators is putting you at risk? Isn't it a tad paranoid?
- unepipe 10y ago
  It creates an easy vector for MITM attacks - could be done by nefarious parties on US citizens traveling in other countries for example.

shmapf 10y ago

Just a wild guess, but if there are non secure assets in the page, this would result in a browser warning, arguably more suspicious looking than this for average users. As a quick and dirty workaround they may have done this?

akira2501 10y ago
Interestingly, some of the subdomains like https://www.budget.senate.gov/ https://www.budget.senate.gov/ use the same certificate and do allow you to load their pages with mixed sources. If this was the idea, it was done fairly shoddy.. more than a few sites in the 'Alternative Name' field will still load.

retube 10y ago

Legacy site/infrastructure that hasn't (or can't) be upgraded?

acdha 10y ago

Think of the government as a particular large, stratified enterprise IT shop with some weighty policy/legal requirements driving some of the internal barriers. I'm imagining that it went something like this: the group which owns the public web servers decides to start using HTTPS and slogs through renegotiating their CDN contract, purchasing and installing an EV certificate, etc. As they go through compatibility testing, someone finds a problem. Maybe that's a bunch of legacy HTML which triggers mixed-content warnings, maybe that's a problem with some creaky old legacy application which expects HTTP and doesn't follow redirects or chokes on modern cipher suites, etc. Since they can no longer say that switching won't break anything, someone pauses the project until they can fix the problems. Maybe someone suggests using a rewriting proxy to fix it but the people who own the server it'd need to run on are worried about performance/security. Maybe the legacy app is something licensed from a vendor who wants $$$ for a major upgrade rather than just making this one change. Maybe that requires a change in next year's budget because they've already allocated all of the money they're legally allowed to spend on that class of work. It could be as simple as budget: they're using Akamai and it's likely that the contract they originally signed didn't include HTTPS, and at least in the past adding it was a non-trivial price increase. I could easily believe that this could be as simple as either a test pending a new contract or that a section of the website (or a subdomain) uses HTTPS but they added a general redirect to avoid paying the higher HTTPS rates for traffic which doesn't require it.