4 ms·
Just because it serves HTTPS on port :443 doesn't mean you should be using it. 'HTTPS Everywhere' style plugins are a broken concept.
by q3k 7y ago
Just because it serves HTTPS on port :443 doesn't mean you should be using it. 'HTTPS Everywhere' style plugins are a broken concept.
- ivanbakel 7y agoIn what way are they a broken concept? What justification is there for serving HTTPS in a way users can't expect to consume?
- tych0 7y agoIf you don't serve the same content on :80 and :443. For example, you might be running a Tor relay node which would serve the node directory list on :443 to help people bypass firewalls, but also be using it as a useful and legitimate web server in order to prevent organizations from blocking it wholesale.
- Lex-2008 7y agoSomebody might prefer using http for public stuff (reading blog posts), https for private (editing them).
- q3k 7y ago> In what way are they a broken concept? Because it's blindly following an inadequate heuristic, and not gracefully degrading if it fails - instead, you get comments like these blaming the author. Even though the author never wanted you to use HTTPS in the first place. > What justification is there for serving HTTPS in a way users can't expect to consume? Plenty of technical reasons (eg. what the sibling comments mentioned), but most importantly: there's no Internet/Web standard that I'm aware of which would prohibit me from doing so.
- 0xff00ffee 7y agocool. i like fried cheese, too.
- q3k 7y agoBut the author was following convention: serving HTTP on traffic :80, and linking to that explicitly. It's you, the user, who for some reason decided to switch to a different protocol on a different port, and expected it to work even though there was no guarantee or indication that it would.
- asudosandwich 7y agoCould be a new hobby for the author. Like https://xkcd.com/148/ https://xkcd.com/148/
- zoonosis 7y agoHTTPS Everywhere works based on rules as to which sites support https. It does not blindly redirect every request to port 443.