3 ms·
> entering the characters http://www.longbets.org/601 http://www.longbets.org/601 into the address bar of a web browser or command line tool (like curl) The pa
by JoshTriplett 2mo ago
> entering the characters http://www.longbets.org/601 http://www.longbets.org/601 into the address bar of a web browser or command line tool (like curl)
The part of this that's most likely to fail at some point is the "http://".
- ywain 2mo agoThe detailed terms of the bet include this: > A 301 redirect from www.longbets.org/601 to a different URL containing that text would also fulfill those conditions. I assume this would cover the HTTP->HTTPS redirect scenario.
- kijin 2mo agoI think the parent is referring to the possibility that one day, browsers might put up a blanket security warning for HTTP URLs instead of following redirects. Or they might try to be a little too clever with HTTPS upgrades. In particular, the automatic upgrade feature in modern browsers is based on several heuristics rather than explicit configuration like HSTS, so there's always a bit of room for breakage there. For example, they don't even check if the server returns a 301 redirect, which can be problematic if the server wants to redirect to HTTPS on a different host/port or make some changes to the path.
- tredre3 2mo ago> Or they might try to be a little too clever with HTTPS upgrades. They're not going to get any cleverer than they are now. In October we'll finally be done with heuristics or central databses of https-first websites used by the various browsers or the half a dozen of headers that you must dance around to get the upgrade to work securely and reliably. They will just default to https first. https://blog.google/security/https-by-defau/ https://blog.google/security/https-by-defau/ Yes this is about Chrome, but all others will follow.
- JoshTriplett 2mo agoPersonally, if I were interpreting the bet, and that browser behavior had been changed before the day of the bet, I'd interpret that as failure, because the browser didn't show an HTML page, it showed a warning dialogue. And in any case, at some point after browsers start doing that, I will be unsurprised if some further conditions prevail that provide reason for web servers to stop listening on http at all.
- oofbey 2mo agoYeah that was a clever bit of foresight there.
- ludwik 2mo agoIn my mind, the part that is most likely to fail is "return an HTML document that still contains the following text." Nowadays, more and more "HTML documents" do not contain any content at all, just some JavaScript that is responsible for then fetching and displaying the content.
- bombcar 2mo agoI used to be someone, man, I was a dreamer, a programmer, a man! Now I'm a human slave copying text from web browsers to chat windows to get around JS rendering bullshit.
- someguyiguess 2mo agoOne of those things is true
- andai 2mo agoThe preferred term is meat proxy ;)
- TeMPOraL 2mo agoThat depends on which side of the JS rendering bullshit you're sitting. If you're on the serving side, yes. But I do the same as GP, just on the receiving side. That is, reaching out for help to baby eldritch entity, because that's healthier for my mind than dealing directly with the unspeakable horrors that half the websites are today. The industry has lost its collective mind in pursue of profit and control, and that was long before the thousand-mask wearing shoggoths became our daily consorts.
- andai 2mo agoI like your funny words, magic man.
- TeMPOraL 2mo agoYou two have just spelled out a very specific bet. Care to put a wager on it? :)