15 ms·
HTTPS on NYTimes.com
- fanpuns 10y agoOh no, this was my go-to site whenever I had to login to public wifi and https wouldn't redirect :(
- joatmon-snoo 10y agohttp://example.com http://example.com is my go-to for those.
- jacobevelyn 10y agoThat is a much better suggestion, thanks.
- kelnos 10y agoHeh, I use http://foo.com http://foo.com
- jacobevelyn 10y agoI'm glad someone else has a go-to site for this. I use my university alma mater's website.
- tblyler 10y agohttp://neverssl.com/ http://neverssl.com/ my friend.
- jacobevelyn 10y agoThanks! Never knew this site existed.
- tux3 10y agoI use http://plop.org http://plop.org, a whole four characters shorter!
- rosstex 10y agoBut is that guaranteed to never use SSL?
- akoster 10y agoI like that one. My domains for this purpose are: http://i.net/ http://i.net/ and http://ip4.me/ http://ip4.me/ (or http://ip6.me http://ip6.me, if you know you have IPv6 connectivity)
- snug 10y agohttp://cnn.com http://cnn.com for me :)
- djsumdog 10y agoOr if you need to use paid wi-fi for free, you can always use https://github.com/yarrick/iodine https://github.com/yarrick/iodine
- oldopsguy 10y agopretty funny is that i use nytimes for exactly the same reason, wonder how many others are using it this way :)
- manacit 10y agoThat's what I use http://http.rip http://http.rip for :D
- nathancahill 10y agoHah, I use http://httpbin.org http://httpbin.org.
- CPLX 10y agoI've been using 1.1.1.1 for years. It's easy to type and seems to call up interstitial screens fast, especially the NYC subway wifi portal, where seconds count. Of course this thread makes me wonder if I've been doing it wrong.
- shakna 10y ago1.1.1.1 is assigned to APNIC Labs in Australia. It isn't always reachable for their own reasons. Using 1.1.1.1 makes a http request, which lets the captive portal take over, so good job, but you are actually hitting a group that actually exists, and what if they suddenly launch a HTST site on that IP? It might break your method.
- empath75 10y agohttp://apple.com http://apple.com will probably always work since that's what ios uses when you join a network. I think specifically this url: http://www.apple.com/library/test/success.html http://www.apple.com/library/test/success.html
- __derek__ 10y agoIt's http://captive.apple.com/ http://captive.apple.com/. That's always my go-to.
- rocky1138 10y agocbc.ca. You can do it with one hand.
- hx87 10y agoIncluding the period?
- rocky1138 10y agono
- akubera 10y agoActually, it shouldn't matter. A trailing dot in a hostname signifies a fully-qualified domain name, rather than a relative domain name. Without the dot the router's dns service could technically return 'cbc.ca.some.othersite.net.' as the FQDN. For those interested, learn more at: http://www.dns-sd.org/trailingdotsindomainnames.html http://www.dns-sd.org/trailingdotsindomainnames.html https://en.wikipedia.org/wiki/Fully_qualified_domain_name https://en.wikipedia.org/wiki/Fully_qualified_domain_name
- kelnos 10y agoThey meant the period in the middle (as in, "can you type the full thing, including the period in the middle, with one hand?"). I read it the same way as you did, initially.
- rocky1138 10y agoI did, too, and I was the original replyer (is that a word?). But, if you visit cbc.ca once, you can do it with one hand in the future as it's the first option in the autocomplete dropdown.
- c0nsumer 10y agohttp://dingleberrypie.com http://dingleberrypie.com, my personal test domain.
- fennecfoxen 10y agoYou can't use a respectable site for that sort of a redirect! Use a tabloid like drudgereport.com ;)
- artursapek 10y ago...wow I never understood that this was why that happens
- rosstex 10y agoI totally had to figure this out for myself to use the Wi-Fi on a Southwest flight. Man, I thought I was clever!
- dschep 10y agoI use bing.com for that :D
- geofft 10y agoThe options I use are the ones the browsers themselves use: http://gstatic.com http://gstatic.com (Chrome uses http://gstatic.com/generate_204 http://gstatic.com/generate_204 , which returns a 204 No Content) http://www.msftncsi.com http://www.msftncsi.com (Windows, desktop and mobile, uses http://www.msftncsi.com/ncsi.txt http://www.msftncsi.com/ncsi.txt. NCSI is "Network Connectivity Status Indicator") http://captive.apple.com http://captive.apple.com (macOS / iOS) because those are likely to be extraordinarily well-maintained and reliable. Unfortunately sometimes some captive portals allow just this one site through and not the others. Looking at you, United WiFi, which whitelists gstatic.com, but fortunately not msftncsi.com.
- 2bluesc 10y agoI just run `curl -v http://google.com` http://google.com` in my termainl and click the redirect link. No risk of caching that way.
- robotmlg 10y agoRelevant xkcd: https://xkcd.com/1172/ https://xkcd.com/1172/
- cr3ative 10y agohttp://purple.com http://purple.com - also useful for seeing if someone's internet is working over the phone or not. "Go to purple.com and tell me what you see". Is the answer "purple"? Hooray!
- deleted 10y ago[deleted]
- toomanybeersies 10y agoIt's nice to see more news media moving towards using HTTPS. NYTimes now joins a small club, alongside the Guardian and the Washington Post. Here's a dev blog post on the WaPo moving to https: https://developer.washingtonpost.com/pb/blog/post/2015/12/10/moving-the-washington-post-to-https/ https://developer.washingtonpost.com/pb/blog/post/2015/12/10... And one on the Guardian moving to https: https://www.theguardian.com/info/developer-blog/2016/nov/29/the-guardian-has-moved-to-https https://www.theguardian.com/info/developer-blog/2016/nov/29/...
- redcastle 10y agoGoogle Chrome is supposed to soon start flashing a "not secure" warning on HTTP sites that have password forms [0]. That's probably at least one motivation for these publisher moves to HTTPS [0] https://security.googleblog.com/2016/09/moving-towards-more-secure-web.html https://security.googleblog.com/2016/09/moving-towards-more-...
- yukinon 10y agoFirefox 51 is slated to have this as well. https://bugzilla.mozilla.org/show_bug.cgi?id=1319119 https://bugzilla.mozilla.org/show_bug.cgi?id=1319119
- swiley 10y agoI could have sworn firefox already did this, or maybe that ws just elinks...
- nine_k 10y agoIn current stable Firefox, you have to manually enable `security.insecure_password.ui.enabled` for that. The change is to set it on by default.
- mparlane 10y agoWhat happens with local LAN machines, like the admin webpage for your wireless access point? It's not like they can go HTTPS?
- hackuser 10y agoA good step forward. Does the NY Times itself track what its users read? Does it provide that information to others? If so, this change amounts to not protecting user privacy as much as insisting that only the NYT can monetize their users' privacy.
- eugeniub 10y agoI don't see how anyone can monetize user privacy without NYT's permission, with or without HTTPS. All of the monetization methods, ad trackers on NYT pages, browser fingerprinting, malware on your computer, etc works with or without HTTPS.
- hackuser 10y agoWithout HTTPS, whoever owns the LAN you use, its ISP, and various intermediary networks can easily track everything that appears in your web browser by reading the same traffic your browser reads.
- acdha 10y agoThis is more than a hypothetical concern, too: back in 2011 a number of ISPs came under fire for hijaacking certain search keywords[1], Comcast has injected ads into hotspot traffic[2], and Andreas Gal has alleged that smaller search engines were buying aggregate Google search result data from ISPs trying to improve their result quality[3]. All of that is impossible with HTTPS. 1. https://www.eff.org/deeplinks/2011/07/widespread-search-hijacking-in-the-us https://www.eff.org/deeplinks/2011/07/widespread-search-hija... 2. http://arstechnica.com/tech-policy/2014/09/why-comcasts-javascript-ad-injections-threaten-security-net-neutrality/ http://arstechnica.com/tech-policy/2014/09/why-comcasts-java... 3. https://andreasgal.com/2015/03/30/data-is-at-the-heart-of-search-but-who-has-access-to-it/ https://andreasgal.com/2015/03/30/data-is-at-the-heart-of-se...
- hackuser 10y agoThanks. And even those issues underplay the magnitude of the problem. Look up Deep Packet Inspection, for example. It doesn't take much to read and record the content, and nothing stops them from doing it in the U.S. (AFAIK).
- hamhamed 10y agoAbout time
- thampiman 10y agoHow is this news worth upvoting though?
- bsdetector 10y agoContext is the key. They say HTTPS is complex to enable and imply they've been working on it for up to two years. And they finally get it done nine days before Trump. Some people and organizations are panicking, either about his behavior or that net neutrality is out the window or about some boogeyman. That's why this story is relevant, now, because it's an indication that NYT may feel the internet will soon be a much more hostile environment.
- artursapek 10y agoJudging by the certificate issue date, they've been working on this since September. Congrats on shipping!
- mtkd 10y agoThey mention it has been a complex undertaking and not complete yet - does anyone know why they can't just sit a traffic manager in front of everything with SSL offloading? Also does anyone know what the new personalisation features are that they mention being able to offer now HTTPS in place?
- hannob 10y agoThird party content. You have ad providers that won't agree to you delivering their content. They want to keep control over that (which is by the way a huge security risk on its own, but that's the state of things).
- kaspm 10y agoThis is likely an organizational, rather than a technical problem. Having worked for large media organizations, often different parts of the site are different deployable applications that share only a hardware device or small nginx or haproxy layer if they're on the same subdomain. It may be that in order to enable SSL on all parts of nytimes.com you need to affect ssl termination at a higher layer on a number of different servers/deploy locations which requires time and testing. It's also possible that terminating the SSL and then passing through unsecured traffic lower in the stack is not ideal due to where the different parts of the site are hosted - e.g. passing traffic unsecured back and forth between private DC and public cloud. Note: All speculation based on having implemented SSL migrations at large media companies.
- Ajedi32 10y ago> Also does anyone know what the new personalisation features are that they mention being able to offer now HTTPS in place? Not sure what features the NYT is referencing specifically, but Chrome has certain features [like the Geolocation API][1] disabled for pages loaded over HTTP. See [Deprecating Powerful Features on Insecure Origins][2]. [1]: https://developers.google.com/web/updates/2016/04/geolocation-on-secure-contexts-only https://developers.google.com/web/updates/2016/04/geolocatio... [2]: https://www.chromium.org/Home/chromium-security/deprecating-powerful-features-on-insecure-origins https://www.chromium.org/Home/chromium-security/deprecating-...
- 10y ago
- schoen 10y agoA nice farewell gift for Chris Soghoian's time at ACLU (during which he constantly tried to get news organizations, law firms, and government agencies to use HTTPS and STARTTLS).
- caconym_ 10y agoThe thing the NYT needs to fix (as of earlier last year) is the fact that you can't cancel your subscription without calling them (which is not the case for signing up). I spent 20 minutes[1] on the phone telling them that yes, I really did want to cancel. It was a worse experience than dealing with Comcast, not least because I felt bad for the poor woman who obviously had some financial incentive to get me to stay on with them. [1] This number is approximate. Could have been less, could have been more; it was a while ago. edit: I feel kinda bad now that this is the top comment in a thread about something positive the NYT did; if anyone tells me that they've since added online unsubscribe, I will change this comment accordingly.
- CountSessine 10y agoVery interesting. That's good to know - thank you. I was going to get a subscription for the first time starting in February. I'll have to reconsider that.
- caconym_ 10y agoIt left a bad taste in my mouth, for sure. Like I said, that was earlier last[1] year; I make no guarantee that it has not changed for the better. [1] Actually I said "earlier this year", which is incorrect as of Jan 1.
- oculusthrift 10y agocan confirm it still requires a call. its worked on me because i dont want to deal with it and keep putting it off.
- Someone1234 10y agoThat's what companies fail to consider when they deploy these "retention strategies." Every roadblock you put between me and cancelling is ALSO a roadblock between me and resubscription in the future. I've subscribed and cancelled Hulu+ three or four times when there was a lull in the content. But I'd have no hesitation in signing up again because I remember how hassle free it was to cancel. Contrast that against LogMeIn which has the same strategy as NYT by the sounds of it (call to cancel, takes 15+ minutes). When I needed LogMeIn for a new project, I looked around for alternatives instead because I remembered how big of a hassle it was to cancel. Ultimately LogMeIn didn't get my repeat business, not due to the financial cost, but the hassle cost of them. Plus of course word of mouth like this is hugely damaging for these strategies. I won't be getting a NYT subscription now.
- TheOneTrueKyle 10y agoWent through a frustrating process when switching to https on my baking blog so I imagine that frustration scales with size.
- cesarb 10y agoInterestingly, Certificate Patrol warned me that the certificate at that site changed from a "Domain Validation" to an "Organization Validation" certificate from the same CA. Why did they do that change, and what would be the advantage for them of an OV instead of a DV certificate?
- Someone1234 10y agoOV are considered more secure than DV due to the higher registration requirements[0]. Additionally a DV certificate is good for a single domain, OV certificates are good for all of that organisation's domains. For example the NYT's certificate is valid for: DNS Name=nytimes.com DNS Name=*.blogs.nytimes.com DNS Name=*.blogs.stg.nytimes.com DNS Name=*.dev.nytimes.com DNS Name=*.nyt.com DNS Name=*.nytimes.com DNS Name=*.stg.nytimes.com This simplifies deployment significantly. [0] https://www.ssl.com/article/dv-ov-and-ev-certificates/ https://www.ssl.com/article/dv-ov-and-ev-certificates/
- hannob 10y ago> OV are considered more secure than DV due to the higher registration requirements[0] Nonsense. OV is no more secure than DV, just more expensive.
- Klathmon 10y agoTo be fair, it's more secure in the sense that someone who gets access to their domain name service can't generate their own OV cert without more access. They could however create their own DV cert. So while it uses the same technology, if you see an OC cert you can be more sure that it's the actual organization and not a cert that just proves that the domain is the domain.
- konklone 10y agoBut unless clients or humans do anything in response to the extra OV information, or in response to a lack of the extra OV information, that information has no security value. No browsers do anything with OV data unless humans manually take action to examine the certificate. So I'm comfortable saying they offer negligible security value.
- snug 10y agoI wonder what the reason for HTTPS only for "Articles published in 2014 and later"
- stephancoral 10y agoThey are served from the newer CMS
- r3bl 10y agoYeah, one would think that it's an easy job, but media organizations tend to have different projects, CMSs, designs, sometimes even (sub)domains for different things. Media websites are constantly-evolving beasts, with a small tech team trying to hack shit up to make them work, and killing older content is never even an option. At the end, with a limited amount of (mostly human) resources, you kind of have to draw the line somewhere and introduce the change, otherwise you will end up postponing it for possibly months.
- berry_sortoro 10y agoNo need, who would like to read the Lügenpresse securely anyway. People must be really uninformed to even pay for their own propaganda and then get a Comcast like experience like described below when wanting to cancel. And of course a comodo cert, the worst incompetent thing you can get. https://www.youtube.com/watch?v=pDmj_xe7EIQ https://www.youtube.com/watch?v=pDmj_xe7EIQ. I would prefer Letsencrypt over anything and not at all because its free.
- acdha 10y agoWe don't need neo-nazis on HN: http://www.economist.com/news/europe/21710866-1848-1939-history-pernicious-word-americas-alt-right-learns-speak-nazi http://www.economist.com/news/europe/21710866-1848-1939-hist...
- berry_sortoro 10y agoSo I am a Neo-Nazi for using a the word Lügenpresse for press the lies and lies over and over again? And of course you link another fake news article claiming this word has roots on Nazi Germany when in fact this is a lie, its roots are in fact from earlier. But why care and do some actual research when you can just read political correct MSM Lügenpresse? This guild by association BS does not work on people who can actually think for themselves. Because certain people in history used a word, does not mean everybody who uses it again is also part of this group/believe/mindset/... . But that of course how you political correct people tick. In your minds you create this tainted words nobody should dare to touch ever again because god beware someone evil used them brefore. Your creating a mind prison for yourselves its ridiculous! Is HN a save space for PCs? I will find out sooner then later I guess.
- skibble 10y ago'Are you a neo-Nazi?' No-one here knows, but you certainly sound like one. The swastika carries a very potent and toxic meaning today that it didn't until the last century or so. If you think symbolism and language are namby pamby liberal constructs with no inherent meaning, I'd encourage you to spray paint one on your house or have one tattooed on your forehead and see if the people you encounter as a result share your disdain for 'political correctness'. I doubt you are a neo-Nazi. But words have meaning, and while this may just be an abstract game of righteous keyboard warfare to you, perhaps if you have an issue with the objectivity or accuracy of the media it would be best to say that plainly. Code words and innuendo directed at other members of your clique won't convince anyone and may well offend people with a better grasp on history (though that was likely your intention).
- peterwwillis 10y agoThey were hacked in 1998 by "H4ck1ng F0r G1rl13z", by Adrian Lamo in 2012, by the Syrian Electronic Army in 2013, and claimed Russia attempted to hack them 5 months ago (and in the same breath said they have no evidence of this). Glad their security team is on the ball with this new-fangled encryption thingy.
- bonyt 10y ago"I'm all in favor of news sites using HTTPS, but I assume they're also going to pad all their articles to a uniform length?" Source: https://twitter.com/matthew_d_green/status/535043126248095744 https://twitter.com/matthew_d_green/status/53504312624809574...
- Klathmon 10y agoThis isn't an "all or nothing" situation. Enabling HTTPS is a benefit even if it's not perfect. The integrity and authentication it provides are alone a MASSIVE benefit (especially for a news site). Now you'll know that your news is coming from their servers, and nobody else is tampering with it. Then taking into account that it does provide confidentiality, you get rid of "dragnet" style data gathering and inspection. You'd need to be targeted by someone who not only has a lot of time, but also is very up to date on the pages of NYT and their sizes to be able to track your article by its size. No matter what, it's still harder than it was before to snoop on what you are doing. It's a net gain in just about every single way.
- jczhang 10y ago"Now you'll know that your news is coming from their servers, and nobody else is tampering with it." I'm a HTTPS noob, can you explain how or why someone would tamper it on normal HTTP? Who would care to target me and what are the chances that NYT has been tampered with ever before?
- grzm 10y agoI'll leave the "how" to any of the many resources out there that describe how HTTPS works. As to why, there's probably low likelihood that someone is tampering with your connection to the NYT. It's good practice, however, and is (largely) transparent to the user. My house may not have ever been broken into before, and likely not going to be broken into in the future, though I still lock my door.
- EvilTerran 10y agoTo take an example that's already happened... How? By being the user's ISP. Why? To inject adverts. What are the chances it affected nytimes.com? Almost certain. Behold: http://arstechnica.com/tech-policy/2014/09/why-comcasts-javascript-ad-injections-threaten-security-net-neutrality/ http://arstechnica.com/tech-policy/2014/09/why-comcasts-java... - and that's not the only case of it.
- CptJamesCook 10y agoIf only we could get adult websites to do the same.
- angry-hacker 10y agoEporner.com did it recently. I'm not sure if they are the first or how big they are compared to pornhub etc., but I happened to notice other day because they asked feedback on their frontpage about https.
- paradite 10y agoI'm curious of what's the technologies that are only available with https mentioned in the post. Service workers?
- tompic823 10y agoHTTP/2 only supports HTTPS, which means HTTP connections don't benefit from HTTP/2's speed improvements. In addition, recent versions of Chrome only allow use of the location API by sites served over HTTPS. These are just two immediate examples that come to mind, but more exist.
- BuuQu9hu 10y agoFinally. Redirecting from https to http is quite annoying.
- steambap 10y agoGood to see they are using HTTPS.