4 ms·

For an institution that claims to be an engineering leader, there's no real excuse for not having TLS everywhere with proper redirects today. It can prevent ISP

For an institution that claims to be an engineering leader, there's no real excuse for not having TLS everywhere with proper redirects today. It can prevent ISPs from seeing what you get or injecting their own code into webpages.

shadowgovt 7y ago
Are either of those a risk that's practically worth guarding against for this information? Engineering leaders generally have the skill of choosing the right solution for the problem at hand.
- somehnguy 7y ago
  Yes. It isn't about the actual information. It is about ensuring that the page is not modified in transit aka nobody (including your ISP) injected code into it. Wouldn't matter if the page simply contained 'hello world', https should be used.
- krick 7y ago
  Yes, it is worth it, and, no, this particular engineering leader displays no such skill here. It was somewhat debatable several years ago, when the whole "switch to https" movement just started growing traction, and, yes, there are some questionable moments, as with FTP. But today TLS-by-default is pretty much a standard practice for any public web-page like this, there's no trade off to make here, and it can be argued it undermines my privacy as a visitor, since instead of just revealing that I'm visiting mit.edu to the network, I have no choice but to reveal what page I'm visiting and what I'm reading there. Furthermore, the network owner may decide to serve me any bullshit instead of this very important official MIT statement, and I will have no way of knowing that.
  - shadowgovt 7y ago
    Https works to retrieve the page if one is concerned about that.
- alias_neo 7y ago
  The problem is a matter of trust. The information therein is potentially bad for their reputation, and not "signing on the dotted line" leaves scope for them to come out in the future and say "that's not actually what we said, must have been MitMd" (for example). An institution of this calibre should be considered viable to pull off something this obtuse to your average person, and thus should not be given the benefit of the doubt. This is just one of many possible effects including SEO penelties amongst others.
  - shadowgovt 7y ago
    That risk doesn't make any sense when they can also just edit the page content on their end. Are we taking seriously the risk MIT would try and blame editing their own page on some kind of MITM that successfully masked true page content a) consistently b) for 100% of readers c) applied at an attack location in the network that someone had access to that isn't the same someone as controls the TLS-verified content hosting? This smells like rhinoceros-repellent levels of paranoia.
    - alias_neo 7y ago
      I'm not seriously suggesting this is likely, im just presenting a hypothetical scenario, and it doesn't need to be plausible in order for it to be used as a narrative. Do it properly, remove any doubt, secure your (one's) website so people _know_ the information came from you.
takeda 7y ago
Reminds me of that attitude where goto is always evil.

shadowgovt 7y ago

Are either of those a risk that's practically worth guarding against for this information? Engineering leaders generally have the skill of choosing the right solution for the problem at hand.

somehnguy 7y ago
Yes. It isn't about the actual information. It is about ensuring that the page is not modified in transit aka nobody (including your ISP) injected code into it. Wouldn't matter if the page simply contained 'hello world', https should be used.
krick 7y ago
Yes, it is worth it, and, no, this particular engineering leader displays no such skill here. It was somewhat debatable several years ago, when the whole "switch to https" movement just started growing traction, and, yes, there are some questionable moments, as with FTP. But today TLS-by-default is pretty much a standard practice for any public web-page like this, there's no trade off to make here, and it can be argued it undermines my privacy as a visitor, since instead of just revealing that I'm visiting mit.edu to the network, I have no choice but to reveal what page I'm visiting and what I'm reading there. Furthermore, the network owner may decide to serve me any bullshit instead of this very important official MIT statement, and I will have no way of knowing that.
- shadowgovt 7y ago
  Https works to retrieve the page if one is concerned about that.
alias_neo 7y ago
The problem is a matter of trust. The information therein is potentially bad for their reputation, and not "signing on the dotted line" leaves scope for them to come out in the future and say "that's not actually what we said, must have been MitMd" (for example). An institution of this calibre should be considered viable to pull off something this obtuse to your average person, and thus should not be given the benefit of the doubt. This is just one of many possible effects including SEO penelties amongst others.
- shadowgovt 7y ago
  That risk doesn't make any sense when they can also just edit the page content on their end. Are we taking seriously the risk MIT would try and blame editing their own page on some kind of MITM that successfully masked true page content a) consistently b) for 100% of readers c) applied at an attack location in the network that someone had access to that isn't the same someone as controls the TLS-verified content hosting? This smells like rhinoceros-repellent levels of paranoia.
  - alias_neo 7y ago
    I'm not seriously suggesting this is likely, im just presenting a hypothetical scenario, and it doesn't need to be plausible in order for it to be used as a narrative. Do it properly, remove any doubt, secure your (one's) website so people _know_ the information came from you.

takeda 7y ago

Reminds me of that attitude where goto is always evil.