3 ms·

Anyone else surprised that the download links are plain HTTP without SSL? I know it's a page that in the past I would have typically not worried about securing

Anyone else surprised that the download links are plain HTTP without SSL? I know it's a page that in the past I would have typically not worried about securing - but nowadays it's SSL everything or else your browser yells at you.

mrtksn 11mo ago
The page look like zero effort given anyway, like one of the free templates you can find.
ronbenton 11mo ago
Yeah, this is bad. The page almost seems like someone’s pet project that didn’t have any explicit funding and they got bored or left Netflix in 2020. I’m not sure how that would explain the lack of SSL cert except for just general lack of thoroughness.
- reddalo 11mo ago
  > The page almost seems like someone’s pet project that didn’t have any explicit funding It probably is, given that it's just a static page hosted on blogger.com
- gregoryl 11mo ago
  From the names mentioned in the most recent blog post, they left late 2022.
- therealdrag0 11mo ago
  Why is it bad tho?
robingchan 11mo ago
this is hosted on s3 which doesn't support HTTPS, that said - if they used cloudfront in front of this bucket, they could save $$$ and have a SSL
- 8organicbits 11mo ago
  S3 absolutely supports HTTPS. I think they set their bucket policy to forbid HTTPS. The whole thing is odd. https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-HTTP-HTTPS https://docs.aws.amazon.com/AmazonS3/latest/userguide/exampl...
  - robingchan 11mo ago
    so, isn’t this using the s3 static website hosting feature - (im assuming due to the dir listing) which i dont believe does support https
uyzstvqs 11mo ago
I'm surprised they didn't use BitTorrent, with these HTTP links as web seeds. That'd make the most sense.
- alex_duf 11mo ago
  Politically it would be an interesting choice for Netflix to encourage people to use their BitTorrent clients.. But technically, you're right.
  - abustamam 11mo ago
    I didn't even know Netflix had a bit torrent client!
maxmcd 11mo ago
Quite surprising. It does seem like you can get an https download with aws s3 cp --no-sign-request s3://download.opencontent.netflix.com/sparks/creative-commons-attribution-4-intl-public-license.txt . Which is hitting the bucket path route at: https://s3.amazonaws.com/download.opencontent.netflix.com/sparks/creative-commons-attribution-4-intl-public-license.txt https://s3.amazonaws.com/download.opencontent.netflix.com/sp... "aws s3 ls" similarly requests: https://s3.amazonaws.com/download.opencontent.netflix.com?list-type=2&prefix=sparks%2F&delimiter=%2F&encoding-type=url https://s3.amazonaws.com/download.opencontent.netflix.com?li...

mrtksn 11mo ago

The page look like zero effort given anyway, like one of the free templates you can find.

ronbenton 11mo ago

Yeah, this is bad. The page almost seems like someone’s pet project that didn’t have any explicit funding and they got bored or left Netflix in 2020. I’m not sure how that would explain the lack of SSL cert except for just general lack of thoroughness.

reddalo 11mo ago
> The page almost seems like someone’s pet project that didn’t have any explicit funding It probably is, given that it's just a static page hosted on blogger.com
gregoryl 11mo ago
From the names mentioned in the most recent blog post, they left late 2022.
therealdrag0 11mo ago
Why is it bad tho?

robingchan 11mo ago

this is hosted on s3 which doesn't support HTTPS, that said - if they used cloudfront in front of this bucket, they could save $$$ and have a SSL

8organicbits 11mo ago
S3 absolutely supports HTTPS. I think they set their bucket policy to forbid HTTPS. The whole thing is odd. https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-HTTP-HTTPS https://docs.aws.amazon.com/AmazonS3/latest/userguide/exampl...
- robingchan 11mo ago
  so, isn’t this using the s3 static website hosting feature - (im assuming due to the dir listing) which i dont believe does support https

uyzstvqs 11mo ago

I'm surprised they didn't use BitTorrent, with these HTTP links as web seeds. That'd make the most sense.

alex_duf 11mo ago
Politically it would be an interesting choice for Netflix to encourage people to use their BitTorrent clients.. But technically, you're right.
- abustamam 11mo ago
  I didn't even know Netflix had a bit torrent client!

maxmcd 11mo ago

Quite surprising. It does seem like you can get an https download with aws s3 cp --no-sign-request s3://download.opencontent.netflix.com/sparks/creative-commons-attribution-4-intl-public-license.txt . Which is hitting the bucket path route at: https://s3.amazonaws.com/download.opencontent.netflix.com/sparks/creative-commons-attribution-4-intl-public-license.txt https://s3.amazonaws.com/download.opencontent.netflix.com/sp... "aws s3 ls" similarly requests: https://s3.amazonaws.com/download.opencontent.netflix.com?list-type=2&prefix=sparks%2F&delimiter=%2F&encoding-type=url https://s3.amazonaws.com/download.opencontent.netflix.com?li...