5 ms·

Hi, BBC employee here (although not in News). Basically, we're working on it. The main issue is that by making a page HTTPS only, that all content also needs to

Hi, BBC employee here (although not in News). Basically, we're working on it. The main issue is that by making a page HTTPS only, that all content also needs to be HTTPS too. We're working with our CDN providers to enable that (not only for new content, but for our archive too), and we also have to support a much longer tail of browsers and SSL configurations than other sites (China being an important market for us, and anecdotally I've heard we still get >1% IE7 from China, presumably from pirated XP machines) which makes it more complicated. It's not really an excuse, but there are people working very hard at enabling TLS without breaking the site for others. Other parts of the BBC website are available over HTTPS, hence the redirects that are in place. Similarly, we can't use HSTS as that applies to the whole domain.

lol768 9y ago
> Similarly, we can't use HSTS as that applies to the whole domain Is this a problem for e.g. account.bbc.com though? I can't see how that can impact bbc.com/bbc.co.uk if the header is set on the subdomain only. I remember it used to be that e.g. news was accessed via news.bbc.co.uk but this seems to have been changed more recently to be accessible at /news. As you note, this makes HSTS a no-go because of all the other products on the same domain need to support HTTPS. This makes me wonder why this change was made in the first place. It would also seemingly mean that (without e.g. https://w3c.github.io/webappsec-suborigins/ https://w3c.github.io/webappsec-suborigins/) an XSS in one product means an XSS everywhere. I'm sympathetic re. the SSL configurations you need to deal with and it's reassuring that this is being worked on.
- cnorthwood 9y ago
  Ah true, I'm not close enough with the detail of some of the subdomains to know what's going on there. A few years ago a decision was made that the BBC site should be all under www.bbc.co.uk, I believe this was mostly for marketing purposes, but also to simplify our internal routing for the site. news.bbc.co.uk was previously separate as News had it's own infrastructure separate from other parts of the BBC, but that's been rationalised now (leaking subdomains for technical reasons was something we frown upon).
- whatismyip 9y ago
  You're right, it's not a problem for account.bbc.com, which off the back off your parent comment I've raised pull requests to get HSTS added. To answer why that subdomain exists: firstly cookie compartmentalisation allows us to set particularly sensitive cookies off to a separate domain, as well as allowing us to do different arrangements for traffic management separate from www.
rythie 9y ago
Slightly off topic, but can you please allow fallback when there is no Flash. The player works, but you have to hack you user-agent string to get it. I don't have Flash in Firefox and the BBC news is only site, that I visit regularly, for which this is an issue.
- cnorthwood 9y ago
  This is again something we're working on, a lot of it matters which video you're trying to watch. Because of reasons* some videos get transcoded into codecs that don't play in all browsers, hence Flash by default on News. In the mean time, you can opt in to the HTML5 by default trial: http://www.bbc.co.uk/html5 http://www.bbc.co.uk/html5
sjwright 9y ago
I think you'll find that the vast majority of old browsers coming from China are in fact robots/spiders hard-coded with MSIE user agent strings.

lol768 9y ago

> Similarly, we can't use HSTS as that applies to the whole domain Is this a problem for e.g. account.bbc.com though? I can't see how that can impact bbc.com/bbc.co.uk if the header is set on the subdomain only. I remember it used to be that e.g. news was accessed via news.bbc.co.uk but this seems to have been changed more recently to be accessible at /news. As you note, this makes HSTS a no-go because of all the other products on the same domain need to support HTTPS. This makes me wonder why this change was made in the first place. It would also seemingly mean that (without e.g. https://w3c.github.io/webappsec-suborigins/ https://w3c.github.io/webappsec-suborigins/) an XSS in one product means an XSS everywhere. I'm sympathetic re. the SSL configurations you need to deal with and it's reassuring that this is being worked on.

cnorthwood 9y ago
Ah true, I'm not close enough with the detail of some of the subdomains to know what's going on there. A few years ago a decision was made that the BBC site should be all under www.bbc.co.uk, I believe this was mostly for marketing purposes, but also to simplify our internal routing for the site. news.bbc.co.uk was previously separate as News had it's own infrastructure separate from other parts of the BBC, but that's been rationalised now (leaking subdomains for technical reasons was something we frown upon).
whatismyip 9y ago
You're right, it's not a problem for account.bbc.com, which off the back off your parent comment I've raised pull requests to get HSTS added. To answer why that subdomain exists: firstly cookie compartmentalisation allows us to set particularly sensitive cookies off to a separate domain, as well as allowing us to do different arrangements for traffic management separate from www.

rythie 9y ago

Slightly off topic, but can you please allow fallback when there is no Flash. The player works, but you have to hack you user-agent string to get it. I don't have Flash in Firefox and the BBC news is only site, that I visit regularly, for which this is an issue.

cnorthwood 9y ago
This is again something we're working on, a lot of it matters which video you're trying to watch. Because of reasons* some videos get transcoded into codecs that don't play in all browsers, hence Flash by default on News. In the mean time, you can opt in to the HTML5 by default trial: http://www.bbc.co.uk/html5 http://www.bbc.co.uk/html5

sjwright 9y ago

I think you'll find that the vast majority of old browsers coming from China are in fact robots/spiders hard-coded with MSIE user agent strings.