4 ms·

Why isn't openssh.com served over https ? You'd think it would be, given where it comes from, who those people are and what it is. (tone: I'm just surprised)

by erelde 10y ago

diggan 10y ago
https works as well: https://www.openssh.com/txt/release-7.4 https://www.openssh.com/txt/release-7.4 Maybe submitter here on HN just put http. Would be better if it did the redirect automatically though.
- erelde 10y ago
  Yes it would certainly be better :) Thank you, I didn't think to manually check as I assumed it would have redirected me.
  - Tepix 10y ago
    It does redirect for me, thanks to HTTPS everywhere ;-)
- aargh_aargh 10y ago
  Observation: their CA is Let's Encrypt
- MrRadar 10y ago
  Their TLS configuration is very strict. Only TLS 1.2 with only ECDHE + ChaCha20 or AES-GCM cipher suites. A lot of clients can't talk to it (including IE 11 on Windows 7 and 8), so it makes sense that they still offer non-encrypted connections: https://www.ssllabs.com/ssltest/analyze.html?d=openssh.com https://www.ssllabs.com/ssltest/analyze.html?d=openssh.com.
rahrahrah 10y ago
It would be if you were using HTTPS Everywhere.
- erelde 10y ago
  Weird thing is, I am in fact using it... But their server should also redirect normal users. EDIT: ah no, different computers. On my personal computers I have it, not on my workplace computer. (and my point remains, they should redirect traffic)
  - bandrami 10y ago
    No, they should either serve the URL requested or refuse to do so. There are networks that do not allow TLS traffic, and clients that do not support it.
  - rahrahrah 10y ago
    You should use HTTPS Everywhere everywhere.
Esau 10y ago
Not directed at you personally - but I wish people would stop fetishizing https. Not everything needs to be encrypted.
- quesera 10y ago
  Everything needs to be encrypted.
- aaronmdjones 10y ago
  HTTPS is about more than just confidentiality (encryption), though. There's also authentication (the party serving the traffic to you is the party you asked for) and integrity (the traffic has not been modified since it was sent). This prevents all kinds of undesirable behaviour; like your ISP injecting JavaScript ads into the webpages you view. Confidentiality is just a nice little side-benefit.

Why isn't openssh.com served over https ? You'd think it would be, given where it comes from, who those people are and what it is. (tone: I'm just surprised)

by erelde 10y ago

Why isn't openssh.com served over https ? You'd think it would be, given where it comes from, who those people are and what it is. (tone: I'm just surprised)

diggan 10y ago

https works as well: https://www.openssh.com/txt/release-7.4 https://www.openssh.com/txt/release-7.4 Maybe submitter here on HN just put http. Would be better if it did the redirect automatically though.

erelde 10y ago
Yes it would certainly be better :) Thank you, I didn't think to manually check as I assumed it would have redirected me.
- Tepix 10y ago
  It does redirect for me, thanks to HTTPS everywhere ;-)
aargh_aargh 10y ago
Observation: their CA is Let's Encrypt
MrRadar 10y ago
Their TLS configuration is very strict. Only TLS 1.2 with only ECDHE + ChaCha20 or AES-GCM cipher suites. A lot of clients can't talk to it (including IE 11 on Windows 7 and 8), so it makes sense that they still offer non-encrypted connections: https://www.ssllabs.com/ssltest/analyze.html?d=openssh.com https://www.ssllabs.com/ssltest/analyze.html?d=openssh.com.

rahrahrah 10y ago

It would be if you were using HTTPS Everywhere.

erelde 10y ago
Weird thing is, I am in fact using it... But their server should also redirect normal users. EDIT: ah no, different computers. On my personal computers I have it, not on my workplace computer. (and my point remains, they should redirect traffic)
- bandrami 10y ago
  No, they should either serve the URL requested or refuse to do so. There are networks that do not allow TLS traffic, and clients that do not support it.
- rahrahrah 10y ago
  You should use HTTPS Everywhere everywhere.

Esau 10y ago

Not directed at you personally - but I wish people would stop fetishizing https. Not everything needs to be encrypted.

quesera 10y ago
Everything needs to be encrypted.
aaronmdjones 10y ago
HTTPS is about more than just confidentiality (encryption), though. There's also authentication (the party serving the traffic to you is the party you asked for) and integrity (the traffic has not been modified since it was sent). This prevents all kinds of undesirable behaviour; like your ISP injecting JavaScript ads into the webpages you view. Confidentiality is just a nice little side-benefit.