13 ms·
“Users will only be able to view patents via HTTP. HTTPS will no longer work”
- dragon_greens 9y agoIs this a joke?
- _arvin 9y agoHTTPS Everywhere* * except uspto.gov Are there any other .gov sites doing this? Can anyone shed more light on this?
- robertpateii 9y ago> beginning at 12:01 a.m., Friday, April 21 and ending at 2 a.m., Friday, April 21 ET.
- diggan 9y ago> Immediately after the maintenance, users will only be able to access Public PAIR through URLs beginning with HTTP, such as http://portal.uspto.gov/pair/PublicPair http://portal.uspto.gov/pair/PublicPair. Past URLs using HTTPS to access Public Pair, such as https://portal.uspto.gov/pair/PublicPair https://portal.uspto.gov/pair/PublicPair, will no longer work. So it seems that the maintenance will turn of HTTPS, not that it's unavailable during the maintenance.
- deleted 9y ago[deleted]
- Spone 9y ago> During the maintenance period, Public PAIR will be unavailable. > Immediately after the maintenance, users will only be able to access Public PAIR through URLs beginning with HTTP,
- why-el 9y agoI don't think you read the whole thing. > Immediately after the maintenance, users will only be able to access Public PAIR through URLs beginning with HTTP, such as http://portal.uspto.gov/pair/PublicPair http://portal.uspto.gov/pair/PublicPair. Past URLs using HTTPS to access Public Pair, such as https://portal.uspto.gov/pair/PublicPair https://portal.uspto.gov/pair/PublicPair, will no longer work.
- bijection 9y agoI think that's the maintenance period, after which https won't be available. Immediately after the maintenance, users will only be able to access Public PAIR through URLs beginning with HTTP, such as http://portal.uspto.gov/pair/PublicPair http://portal.uspto.gov/pair/PublicPair. Past URLs using HTTPS to access Public Pair, such as https://portal.uspto.gov/pair/PublicPair https://portal.uspto.gov/pair/PublicPair, will no longer work.
- popey456963 9y agoWhy on Earth could they possibly feel it necessary to do this? The United States Patent Office doesn't have a complex system of sub-domains or even an EV license, if money were the object then they could just go with Let's Encrypt (not to mention the current license continues until 2018 anyway). The amount of computing power it takes to encrypt with SSL is minimal, especially if you use some of the newer systems like ECDSA and should not be of concern to a company like the Patent Office.
- drdaeman 9y agoMaybe someone sued them over some highly-innovative encryption patent they've previously granted? :) /s
- anigbrowl 9y agoYou think they have a free hand, but they don't. People who work are federal agencies are hemmed in by a thicket of rules that prevent them from just entering into an agreement with a private vendor who has not been through a qualification process. Likewise technicians and administrators are enjoined from spending money on their own initiative, eg you can't just see the problem, sign up for a renewable SSL certificate, and then shoot the bill over the accounts payable. I don't want to speculate about what's going on at the managerial/administrative level, but I notice the current administration is committed to the goal of slashing most government spending by some huge amount while simultaneously cutting taxes. It may be that the head of the USPTO got a phone call telling them not to spend a single damn penny. Now, iirc the USPTO is actually self-financing on patent application fees, but I don't think they're so independent that they can just ignore directives from higher up in the executive branch.
- lol768 9y agoThey have a valid cert in use that only expires in 2019, and it's SHA256. But when you visit over HTTPS, this happens: HTTP/1.0 302 Found Location: http://portal.uspto.gov/pair/PublicPair Server: BigIP Why would they want to do this? Seems incredibly dumb to me, huge step backwards.
- zokier 9y agoDoes TLS termination cost extra for BigIP? Maybe their license expired or something?
- doubleplusgood 9y agoTLS offload is usually extra on F5 BigIP
- Karunamon 9y agoDoes F5 do any special secret sauce that can't be replicated with an equally powerful set of hardware and a good HAProxy config? I know one of our network admins is continually complaining about how shitty their UI is...
- corrigible 9y agoNot an expert, but the last BIG-IP LTM I saw a couple of months ago didn't support TLS acceleration without a dedicated hardware module (and the accompanying license); this would usually mean upgrading to a more expensive model. Plain old TLS termination isn't license-limited as far as I know. EDIT: to answer your question, yes, you could probably do it with haproxy, but the added value in these appliances is iRules (TCL hooks for all network events, you could augment request processing etc) and vendor support.
- xorcist 9y agoF5 has some secret sauce to it but it's mostly performance related. They have a good chunk of hardware offloading, all the way up to the TLS layer. I seem to remember even the entry license includes full TLS offloading so I doubt the poster above is correct that it is a cost issue. As to if HAProxy can do the job, well, that depends. F5s are complex beasts and they can load balance application specific protocols that can be hard to find elsewhere, with the support contract that goes with it.
- cjhanks 9y agoAlso, at the bottom of the page "This page is owned by Service Desk." What does that mean? And it's legal to publish a .GOV site using Drupal?
- dangrossman 9y ago> Also, at the bottom of the page "This page is owned by Service Desk." What does that mean? It indicates what department of the USPTO manages that page of the website. All pages have a "page-owner" tag in the footer.
- chickenfries 9y agoDrupal is all over government sites. So is Wordpress. Do you expect them to be using closed source CMSs or something? (I get that Drupal is insecure, but no, it's not "illegal" to use Drupal...)
- drc0 9y ago"Drupal is insecure", why?
- shif 9y agohttps://www.cvedetails.com/product/2387/Drupal-Drupal.html?vendor_id=1367 https://www.cvedetails.com/product/2387/Drupal-Drupal.html?v...
- cjhanks 9y agoI have no idea. The US Federal Government is essentially the arbiter of all regulations and minimum standards within the United States. It's just surprising to see an opensource framework running on Apache/Coyote expected to run over HTTP.
- mdekkers 9y agoDrupal used to run Whitehouse.gov for a long time...
- chrisatumd 9y agohttps://obamawhitehouse.archives.gov/blog/2015/06/08/https-everywhere-government https://obamawhitehouse.archives.gov/blog/2015/06/08/https-e... Has this been superseded by a new policy?
- 0xcde4c3db 9y agoAn excellent question. I tried looking up the current policies, but the "IT Policy Library" [1] is provided in an iframe that doesn't load for me ("The connection to the server was reset while the page was loading."). [1] https://cio.gov/resources/it-policy-library/ https://cio.gov/resources/it-policy-library/
- konklone 9y agoThe policy is still in effect, and its supporting home page is here: https://https.cio.gov https://https.cio.gov
- vesinisa 9y agoThe USPTO databases have to be one of the most torturous services to their users in the whole of internet. The UI of both the patent and trademark search is archaic, but not in a HN way but in a really bad way. In patent search, there is no "search" box. Instead, the "quick search" forces you to specify two (and exactly two) text queries on the database columns with obligatory boolean operation.[1] Even if you happen to find an interesting patent, good luck linking to it (which should be the number one service they provide - GET individual patent documents). The page showing the patent document has a dozen cryptic query parameters in the URL, some of which relate to the search query you used to find the patent! No "make shareable link" button to be seen, either. And don't get me started on the trademark search, or Trademark Electronic Search System (TESS), as they like to call it.[2] When you navigate to the front page, you get a private session identifier - in your URL of course! And when you search for a trademark ("simple search" is intuitively known as "New User" here) and select a TM to view, you would be excused of thinking that the short URL in your browser address bar is the linkable URL of this entry. But no - it's just your session identifier along with the document's index in the results of your last search query. When you leave the trademark site or just click "Logout" (since you're a kind person - they after all ask you "logout when you are done to release system resources allocated for you"), that URL is gone in the wind. If you shared a link to that trademark to your friend, they only get this very helpful page: <H1>This search session has expired. Please start a search session again by clicking on the TRADEMARK icon, if you wish to continue</H1> So no way to link to individual TM registrations here either. 1: http://patft.uspto.gov/netahtml/PTO/search-bool.html http://patft.uspto.gov/netahtml/PTO/search-bool.html 2: http://tmsearch.uspto.gov/ http://tmsearch.uspto.gov/
- makecheck 9y agoThis would be interesting for patent research; you could legitimately say "I looked for a patent that already covers X but since you cannot guarantee the data was not modified in transit, I cannot be certain that I saw what was actually in the patents I reviewed".
- harryh 9y agoThe law doesn't work like that. Sorry.
- shif 9y agoHTTPS isn't bulletproof either, the argument could still be made with TLS
- paulddraper 9y agoYou also can't verify that the CA isn't rogue. Or that the browser vendors that trust the CA the signed the certificate aren't just puppets for our lizard overlords.
- xtreme 9y agoEven if the courts allowed this to be a valid defense, it could only protect you from willful infringement. Not having knowledge of an existing patent does not stop the other party from claiming damages. If they can prove you knew that your work infringes the patent, they can sue you for treble damages from willful infringement.
- anigbrowl 9y agoThey might allow it, but in civil litigation liability hangs upon the balance of probabilities rather than being beyond a reasonable doubt as in criminal trials. So a court might well allow it but that doesn't mean a jury would find it persuasive.
- MichaelBurge 9y agoDon't you only need to be 51% confident? As long as fewer than 50% of all HTTP requests are modified by malicious adversaries in transit, you'd still have to pay up.
- cryptarch 9y agoAnyone looking at creating an IPFS or BitTorrent mirror yet? Edit: the PDF attachment URL's are very predictable, they're the number of the patent in a weird order + a page number, e.g.: http://pdfpiw.uspto.gov/10/292/096/2.pdf http://pdfpiw.uspto.gov/10/292/096/2.pdf Back of the envelope calculations say all PDF's should only take 1 - 6 TB's (assuming 100kb to 600kb in PDF's on average). Seriously, why hasn't anyone mirrored this?
- tjalfi 9y agoThe USPTO has a bulk download option[0]. The datasets are available from ReedTech[1]. [0] https://www.uspto.gov/learning-and-resources/bulk-data-products https://www.uspto.gov/learning-and-resources/bulk-data-produ... [1] http://patents.reedtech.com/Public-PAIR.php http://patents.reedtech.com/Public-PAIR.php
- umhau 9y agoLegal issues from mirroring something that's sort-of government property? I have no idea if it is or not, but I'd guess it's some sort of grey area.
- cryptarch 9y agoAs in, fear of extra-legal persecution or fear of legal prosecution? Copyright generally doesn't stop people from copying what they want to copy. Do only BigCo's have a use for patents?
- snvzz 9y agoFun fact: HSTS https://securityheaders.io/?q=www.uspto.gov&followRedirects=on https://securityheaders.io/?q=www.uspto.gov&followRedirects=... HSTS is 1 year at the time this comment is posted. They're in for some pain.
- andygambles 9y agoRemoval of HTTPS is on http://portal.uspto.gov/ http://portal.uspto.gov/
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- Edmond 9y agoThat should be considered a non-fun fact :) They are basically going to be DOSing a huge segment of users who've previously had that header set on their browsers...they're also violating the OMB mandate that requires TLS for all government sites...it is a rather strange move, I can't imagine there is a good reason for it. EDIT If it is for portal.uspto.gov then HSTS is a non-issue but still a very bad move.
- javawizard 9y ago> EDIT If it is for portal.uspto.gov then HSTS is a non-issue but still a very bad move. Is it? I still see HSTS from portal.uspto.gov with the same age.
- shif 9y agochrome://net-internals/#hsts doesn't seem to show anything for the domain
- jaclaz 9y agoTo be picky: >Immediately after the maintenance, users will only be able to access Public PAIR through URLs beginning with HTTP, such as http://portal.uspto.gov/pair/PublicPair http://portal.uspto.gov/pair/PublicPair. Past URLs using HTTPS to access Public Pair, such as ... A URL beginning with HTTPS ALSO begins with HTTP
- lowercaseman 9y agoI see what you did there.
- Qwertious 9y agoTo be pickier, they never said that all URLs beginning with 'HTTP' would be enabled, merely that URLs beginning with something other than HTTP would be disabled, and also that URLs beginning with 'HTTPS' would be disabled. They never stated that HTTPS was part of the "doesn't begin with HTTP" group.
- odammit 9y agoThere has been a XSS vulnerability in the USPTO site since 2008 I reported. It still worked in 2014. Meatspinned quite a few coworkers using it.
- cdcarter 9y ago> Meatspinned quite a few coworkers using it. Don't do this.
- rocky1138 9y agoYeah you're right It's so obviously amateur. Lemon Party is a much better answer.
- odammit 9y agoBut meatspin had the song that let everyone else in the office know that you'd been spun. :D
- slrz 9y agoPlease provide rationale showing that the associated risks outweigh the immense fun of "meatspinning" coworkers. "Don't do this" is probably not very convincing.
- floatingatoll 9y agohttps://it.slashdot.org/story/08/06/18/2213232/man-fired-when-laptop-malware-downloaded-porn https://it.slashdot.org/story/08/06/18/2213232/man-fired-whe... Don't be the person that gets someone fired, arrested, jailed, and in lifetime legal trouble because some asshole thought it would be hilarious to display porn on their computer at work. (Yes, I'm equating "meatspinning" to malware. Argue if you like about that, but the main point stands: If you meatspin someone, you're taking a chance of ruining their entire life. Don't be That Guy.)
- nightcracker 9y ago
- deleted 9y ago[deleted]
- 15charlimitdumb 9y agoit seems like most of the pro https arguments are asserting the right to anonymous public patent inspection. it is fundamentally impossible for the uspto to provide this access* (free speech traps ahead). if you don't want data about access patterns tracked the burden is on the consumer not the provider for public resources *https://thestack.com/security/2017/04/12/netflix-found-to-leak-information-on-https-protected-videos/ https://thestack.com/security/2017/04/12/netflix-found-to-le...
- bitexploder 9y agoNever mind that HTTP can easily be man in the middled and tampered with and I have no way to ensure I am communicating to who I think I am.
- gelstudios 9y agoThis is surprising given that the .gov registrar is requiring HTTPS + HSTS for all new agency websites [1], but they specifically exclude existing domains or _renewals_. I wonder if 18f can help at all, it seems agencies must contact 18f themselves. 1: https://www.digitalgov.gov/2017/04/12/dotgov-domain-registration-program-to-provide-https-preloading-in-may/ https://www.digitalgov.gov/2017/04/12/dotgov-domain-registra...
- Eridrus 9y agoDoes anyone here actually read patent filings? I've been involved in writing a few and the result was useless drivel. Combined with the fact that there are penalties for willful infringement, I'm not sure what the benefit to reading patents in your field would be.
- mwfunk 9y agoThe patent system has evolved in a way that has practically inverted its original intents. You're exactly right, practitioners in a given field (ex: engineers in the tech industry) often avoid looking at patents, because no good can come of it. Most are too vague to be useful for licensing, but it opens one up to willful infringement claims later on.
- pbhjpbhj 9y agoIsn't failure to perform a search with due diligence an equal liability in US patent cases?
- mwfunk 9y agoIANAL, but my understanding is no. Also, software patents tend to be so vague and generic that if you were to thoroughly search for anything that you might conceivably be infringing on, you'll spend a preposterous amount of time doing so, probably find not one single thing that directly applies to what you're doing, and will probably find a few thousand that don't apply but are generic enough that some lawyer might still haul you into court in east Texas, who can then claim willful infringement because of your search. I probably couldn't even write /bin/ls without stepping close to infringing on hundreds or thousands of vague, generic IP land mines planted long ago by unscrupulous lawyers who are just waiting with bated breath for someone to stumble across them so they can drag people to east Texas or (more likely) shake them down for settlement money before it goes to court.
- maxxxxx 9y agoPatent lawyers read them and check if your work doesn't infringe. In my company that's standard procedure.
- RangerScience 9y agoIs there any way to find out who originally made the USPTO site? A contract company, government employees, etc?
- shif 9y agoThat's regressive as fuck, it's like saying that cars will no longer be allowed, only horse carriages
- paulddraper 9y agoThe gap between those two technologies is larger than you suggest. Horse carraiges: 1400 Automobiles: 1890
- anigbrowl 9y agoPretty sure horse carriages were around a lot earlier than 1400, unless you were thinking BC.
- paulddraper 9y agoEven better. I was giving the benefit of the doubt. That's around the time carraiges got suspension and were pretty much like the modern form.
- yjftsjthsd-h 9y agoHorses and cars were in use at the same time, just like HTTP and HTTPS; I'm not sure why their invention times are relevant?
- paulddraper 9y agoGunpowder and ICBMs were also in use at the same time I'm claiming the technological backstepping is not nearly as drastic as the GP implies.
- thaumasiotes 9y agoBut you listed a completely irrelevant gap. The gap of relevance is the one between automobiles and now, not the one between carriages and automobiles. If automobiles were the transport technology of 1890 and carriages were the technology of 1889, then devolving to carriages puts us back to 1889, regardless of when horses were invented.
- hackerhasid 9y agoThe answer to just about every question posed on this thread is the same: "it's the government!"
- Ben2Wilson 9y agoI want to publicly thank Binaryreap3r for their professional hacking service. Which I'm happy to recommend to you. Has your Social account been attacked by a hacker? Do you need to get back into your Facebook, Twitter, Instagram or Google+ account?, Have you lost your email or social media password and want to crack/recover it from computers?. Are you being cyber stalked and wish to find the source and stop the cyber predator?, Have you been scammed online? Do you need to locate and report the perpetrator?. Do you want to encrypt your data and protect your sensitive informations?. Any social engineering problem you may have. I know a white hat hacker that delivers!. He helped out with an issue and I think he's good what he does. Contact binaryreap3r@gmail.com or text +16155497267 for all yoiur professional hacking needs.
- 3131s 9y agoPrime example of a government function that could benefit from the open source community. If all this patent data were dumped today, in whatever format it's stored in, I guarantee we'd be seeing a bunch of cool ShowHNs within days and all of us would be better off for it.
- tyingq 9y agoNot sure if it's everything, but the USPTO provides this http://patents.reedtech.com http://patents.reedtech.com
- 3131s 9y agoDoes seem like I spoke too soon, though the above link is not everything. I downloaded it and it's a CSV file with three fields -- a patent ID (I think), a date, and some other number. This however seems to be everything: https://pairbulkdata.uspto.gov/ https://pairbulkdata.uspto.gov/ Looks like people tend to be satisfied with Google Patent as well.
- kakarot 9y agoAs far as I know, this is illegal because of this: https://obamawhitehouse.archives.gov/blog/2015/06/08/https-everywhere-government https://obamawhitehouse.archives.gov/blog/2015/06/08/https-e... Does anyone have any experience with their support system? On Monday I will be calling them in an attempt to understand why they are exempt from the HTTPS Everywhere federal directive.
- konklone 9y agoI wouldn't use the word "illegal" - it's a directive of OMB (the White House's management and budget office), not a law or a regulation or an executive order. The only true enforcers are OMB themselves. But to answer your other question, as part of the Department of Commerce, a "CFO Act" agency, USPTO would not be exempt.
- kakarot 9y agoThank you for clearing that up. Are you aware of what kind of consequences might be incurred at the expense of disobeying the OMB as a government entity?
- ac1120p 9y agoclaimparse.com
- ac1120p 9y agoclaimparse.com at least shows recent patents that have issued.
- tellor 9y agoQuite a tricky incident or a tendency ... One day, it will make you look at the problem more creatively. This is an increase in the risks of MITM - when information can be distorted or other manipulations with it are possible. But this is good as a whole. Will help create more sophisticated and safe technologies for viewing information in these networks. Fortunately, there are quite a few workarounds and opportunities that minimize all the associated risks ...
- loa_in_ 9y agoI bet 10$ that "errors" were reported by people who still run iexplore on Windows XD which doesn't support modern https.