4 ms·

It's 2019, what excuse does Baidu have to not support https for these scripts?

by FDSGSG 7y ago

deleted 7y ago
[deleted]
CrazyStat 7y ago
None whatsoever.
- NedIsakoff 7y ago
  Probably because the government asked them not to.
nradov 7y ago
It's not a matter of excuses. Baidu, like almost all large Chinese companies, is effectively an arm of the Chinese Communist Party. They will do as they're told.
- FDSGSG 7y ago
  Which is exactly why Baidu should face the same consequences as other malware distributors. (i.e. safebrowsing block, dnsbl listings and so on)
  - nradov 7y ago
    Be careful what you wish for. Ironically the Chinese government would probably prefer it if Western companies and governments cut off a lot of Chinese traffic. It would give them political cover for their own blocking activities and allow them to plausibly claim that everyone is doing it.
icandoit 7y ago
If you are pro-interrupt-private-transactions then you are in no hurry to push https on everyone.
missblit 7y ago
Baidu will serve the script over HTTPS (though firefox complained about a bad certificate), the issue is that it will also serve it over HTTP, and some 3rd party pages request the HTTP version.
- ryanlol 7y ago
  No browser will load the script from within a <script> tag because of the bad certificate, serving the script with a bad certificate achieves nothing.
  - simias 7y ago
    The whole point is that the pages being modified are served over HTTP, there's no certificate there, good or bad.
    - ryanlol 7y ago
      The whole point is that you couldn’t use the script over HTTPS even if you really wanted to.
      - simias 7y ago
        Oh okay I see what you mean now, sorry for the misunderstanding.
discordance 7y ago
Remember that all internet related companies that operate in China have mandatory stewardship from the CCP. One reason may be that http makes it easier for surveillance or injection.
simias 7y ago
As far as I can tell many CDNs will gladly serve their scripts over HTTP if requested: http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.mi... I don't know if what's the reasoning behind that.
- kortilla 7y ago
  IIRC there was a time when a browser (maybe IE 6?) would generate a mixed content warning when you would try to load https resources in a http served page.
- FDSGSG 7y ago
  When visited over HTTP that CDN sets "Alt-Svc: h3-23=":443"; ma=86400", telling the browser that (encrypted) HTTP3/QUIC is available. If you ever manage to load that CDN over HTTPS/QUIC it sets a HSTS header so all further pageloads will go over HTTPS.

It's 2019, what excuse does Baidu have to not support https for these scripts?

by FDSGSG 7y ago

It's 2019, what excuse does Baidu have to not support https for these scripts?

deleted 7y ago

[deleted]

CrazyStat 7y ago

None whatsoever.

NedIsakoff 7y ago
Probably because the government asked them not to.

nradov 7y ago

It's not a matter of excuses. Baidu, like almost all large Chinese companies, is effectively an arm of the Chinese Communist Party. They will do as they're told.

FDSGSG 7y ago
Which is exactly why Baidu should face the same consequences as other malware distributors. (i.e. safebrowsing block, dnsbl listings and so on)
- nradov 7y ago
  Be careful what you wish for. Ironically the Chinese government would probably prefer it if Western companies and governments cut off a lot of Chinese traffic. It would give them political cover for their own blocking activities and allow them to plausibly claim that everyone is doing it.

icandoit 7y ago

If you are pro-interrupt-private-transactions then you are in no hurry to push https on everyone.

missblit 7y ago

Baidu will serve the script over HTTPS (though firefox complained about a bad certificate), the issue is that it will also serve it over HTTP, and some 3rd party pages request the HTTP version.

ryanlol 7y ago
No browser will load the script from within a <script> tag because of the bad certificate, serving the script with a bad certificate achieves nothing.
- simias 7y ago
  The whole point is that the pages being modified are served over HTTP, there's no certificate there, good or bad.
  - ryanlol 7y ago
    The whole point is that you couldn’t use the script over HTTPS even if you really wanted to.
    - simias 7y ago
      Oh okay I see what you mean now, sorry for the misunderstanding.

discordance 7y ago

Remember that all internet related companies that operate in China have mandatory stewardship from the CCP. One reason may be that http makes it easier for surveillance or injection.

simias 7y ago

As far as I can tell many CDNs will gladly serve their scripts over HTTP if requested: http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.mi... I don't know if what's the reasoning behind that.

kortilla 7y ago
IIRC there was a time when a browser (maybe IE 6?) would generate a mixed content warning when you would try to load https resources in a http served page.
FDSGSG 7y ago
When visited over HTTP that CDN sets "Alt-Svc: h3-23=":443"; ma=86400", telling the browser that (encrypted) HTTP3/QUIC is available. If you ever manage to load that CDN over HTTPS/QUIC it sets a HSTS header so all further pageloads will go over HTTPS.