5 ms·

You and maybe the 3 other people that might also notice if a site is serving different pages for http vs https. If it's accessible in the browser its already pa

You and maybe the 3 other people that might also notice if a site is serving different pages for http vs https. If it's accessible in the browser its already part of the world wide web so what information is it even conveying?

chrisseaton 6y ago
> so what information is it even conveying? I feel like I'm going in circles. They're two different web pages. Possibly with entirely different information. Possibly run by entirely different people. Possibly with entirely different trust levels and threats. It conveys which of the two web pages I'm looking at. How is that not useful information?
- andromeduck 6y ago
  All WWW was supposed to mean was HTTP accessible. Now that every domain why should a user using a http* browser have to specify that they intend to access it via http* when they have no other choice? Either the server responds or it doesn't. www.foo.com and foo.com both return http traffic then they are both part of the world wide web. The specific of how you've decided to run your site or serve your pages is irrelevant. You may serve a page depending on if the http request came over port 80 or some other port or via http or https or at this time or that time or other.
  - chrisseaton 6y ago
    I don't think you get it. www.example.com and example.com might be two different websites. If you want the content at www.example.com and you go to example.com, then may not get the content that you wanted. One might be a shop selling shoes and the other might be a shop selling hats. If you want a hat and you go to the one selling shoes then you're going to be disappointed. 'www.' doesn't 'mean was HTTP accessible'. You can make any system HTTP accessible, or not if you want to. It doesn't matter how you or I set up our websites, or whether you or I think it's a good idea to have different websites at these addresses, it matters how other people set up their websites and if they choose to do this or not. Some do! Therefore the user needs the information.
    - Dylan16807 6y ago
      Anything might be two different websites. You could send different websites based on what port the request comes from. But doing so would be bad and wrong, and showing the user the outgoing port is definitely not necessary.
      - chrisseaton 6y ago
        > You could send different websites based on what port the request comes from. But that's you controlling that, as the person running the website. When it's the user controlling it, by setting which domain to visit, that's in their control, so they need to see it in their UI. If you're going to reduce to the absurdity of 'anyone could serve anything from anywhere' then why show a domain at all? ebay.com could serve me the content of google.com, so let's not bother with domain names? Is that your argument?
        Dylan16807 6y ago
        The person controlling the website is responsible for making www and non-www show the same thing, as well as making http and https show the same thing. (Redirects are fine.) A user's ability to affect something doesn't automatically mean it's their responsibility. I'm not making an argument about what should be shown right now, I just think your argument, based on what "might be different", is pretty flawed.
        chrisseaton 6y ago
        > The person controlling the website is responsible for making www and non-www show the same thing, as well as making http and https show the same thing. (Redirects are fine.) But there's no standard that requires this, that I'm aware of. Chrome are acting like there is, but I believe there isn't.
        Dylan16807 6y ago
        There's no standard that says you have to deliver the same data to anyone as far as I'm aware. It's still an absolute abomination if http and https are different sites, for example.

chrisseaton 6y ago

> so what information is it even conveying? I feel like I'm going in circles. They're two different web pages. Possibly with entirely different information. Possibly run by entirely different people. Possibly with entirely different trust levels and threats. It conveys which of the two web pages I'm looking at. How is that not useful information?

andromeduck 6y ago
All WWW was supposed to mean was HTTP accessible. Now that every domain why should a user using a http* browser have to specify that they intend to access it via http* when they have no other choice? Either the server responds or it doesn't. www.foo.com and foo.com both return http traffic then they are both part of the world wide web. The specific of how you've decided to run your site or serve your pages is irrelevant. You may serve a page depending on if the http request came over port 80 or some other port or via http or https or at this time or that time or other.
- chrisseaton 6y ago
  I don't think you get it. www.example.com and example.com might be two different websites. If you want the content at www.example.com and you go to example.com, then may not get the content that you wanted. One might be a shop selling shoes and the other might be a shop selling hats. If you want a hat and you go to the one selling shoes then you're going to be disappointed. 'www.' doesn't 'mean was HTTP accessible'. You can make any system HTTP accessible, or not if you want to. It doesn't matter how you or I set up our websites, or whether you or I think it's a good idea to have different websites at these addresses, it matters how other people set up their websites and if they choose to do this or not. Some do! Therefore the user needs the information.
  - Dylan16807 6y ago
    Anything might be two different websites. You could send different websites based on what port the request comes from. But doing so would be bad and wrong, and showing the user the outgoing port is definitely not necessary.
    - chrisseaton 6y ago
      > You could send different websites based on what port the request comes from. But that's you controlling that, as the person running the website. When it's the user controlling it, by setting which domain to visit, that's in their control, so they need to see it in their UI. If you're going to reduce to the absurdity of 'anyone could serve anything from anywhere' then why show a domain at all? ebay.com could serve me the content of google.com, so let's not bother with domain names? Is that your argument?
      - Dylan16807 6y ago
        The person controlling the website is responsible for making www and non-www show the same thing, as well as making http and https show the same thing. (Redirects are fine.) A user's ability to affect something doesn't automatically mean it's their responsibility. I'm not making an argument about what should be shown right now, I just think your argument, based on what "might be different", is pretty flawed.
        chrisseaton 6y ago
        > The person controlling the website is responsible for making www and non-www show the same thing, as well as making http and https show the same thing. (Redirects are fine.) But there's no standard that requires this, that I'm aware of. Chrome are acting like there is, but I believe there isn't.
        Dylan16807 6y ago
        There's no standard that says you have to deliver the same data to anyone as far as I'm aware. It's still an absolute abomination if http and https are different sites, for example.