3 ms·
Continued: Results: out of 1112 plain HTTP links, 642 are available over HTTPS; out of those 642 entries, 143 redirect to HTTPS, 307 serve identical response f
by oefrha 6y ago
Continued:
Results: out of 1112 plain HTTP links, 642 are available over HTTPS; out of those 642 entries, 143 redirect to HTTPS, 307 serve identical response from the HTTPS version, and 178 serve almost identical response (using the <=1% content length difference criterion); the remaining 14 entries with slightly wider Content-Length gaps tend to be visually identical too upon manual inspection. So we can pretty safely claim that more than half of the submitted plain HTTP links can be HTTPS instead. (We can't be 100% confident without further inspection though, since a page that responds over HTTPS just fine might have mixed content issues that prevent it from working at full capacity.)
Detailed results are available at [4].
By the way, I also tried to match the plain HTTP links against HTTPS Everywhere's rulesets[5], but coverage is rather poor since the rulesets are user-contributed; I only got around ten matches out of the 1112 links.
At the end of the day I can't say this little analysis is in any way useful... Let's just hope more people submit HTTPS when possible. I did notice that certain HN darlings, e.g. pg's blog, are still on plain HTTP without HTTPS counterparts. Also, the "Legal" and "Apply to YC" links in the footer are plain HTTP links; apparently haven't been touched in ages.
[0] https://pastebin.com/raw/qxVjjEyA https://pastebin.com/raw/qxVjjEyA links.csv.00
[1] https://pastebin.com/raw/3ZWgTJqh https://pastebin.com/raw/3ZWgTJqh links.csv.01
[2] https://pastebin.com/raw/jxRjwfwT https://pastebin.com/raw/jxRjwfwT links.csv.02
[3] https://pastebin.com/raw/bpsq9DZG https://pastebin.com/raw/bpsq9DZG analyzer.py
[4] https://pastebin.com/raw/hkzZ0m5f https://pastebin.com/raw/hkzZ0m5f upgradability.csv
[5] https://github.com/EFForg/https-everywhere/tree/master/src/chrome/content/rules https://github.com/EFForg/https-everywhere/tree/master/src/c...
(Sorry about the pastebin.com links. I don't want to have this HN account associated to my real world identity, including my GitHub account and personal sites, so I had to use a non-ephemeral anonymous file host. The raw data file containing all aggregated links is too large for an anonymous paste, so it was split up into three pastes; the data analysis script automatically downloads all of them and assembles them into a single file.)
- woodruffw 6y ago> By the way, I also tried to match the plain HTTP links against HTTPS Everywhere's rulesets[5], but coverage is rather poor since the rulesets are user-contributed; I only got around ten matches out of the 1112 links. FWIW, you can tell HTTPS Everywhere to operate in "Encrypt All Sites Eligible" (EASE) mode, which unconditionally attempts to upgrade to HTTPS and errors out (with a prompt) if the connection fails.
- oefrha 6y agoI know, that doesn’t help with this particular analysis though. I basically did just that separately.