3 ms·

I hope Reddit can use HTTPS for its whole site soon. People use pseudonyms and multiple accounts on Reddit for a reason: freedom of expression. Yet NSA can easi

I hope Reddit can use HTTPS for its whole site soon. People use pseudonyms and multiple accounts on Reddit for a reason: freedom of expression. Yet NSA can easily collect all that data and mine it and search through it automatically, because they're tapping the Internet cables, which means all unencrypted data is theirs to own (and abuse).

okasaki 13y ago
The NSA probably isn't thwarted by TLS. I imagine that they have direct access to datacenters.
jedberg 13y ago
https everywhere for reddit is actually a tricky proposition. Mainly because the browsers have yet to be designed to handle an all https website that embeds content from other sites. We tried running reddit in all https mode, but you get a lot of mixed content warnings, which makes for an awful user experience. There are also a lot of edge cases of the opposite case where people embed reddit on their site.
- dmunoz 13y ago
  I'm likely ignorant of some of the external content, but what about forcing https-only users through a view that avoids external content? I already have reddit setup to not show thumbnails and never expand video links inline. It would be a reasonable trade off to me if the only other option is http only. It's nice to hear there were attempts at having an all https mode. I have long been bummed that reddit is http only, for a variety of reasons.
  - jedberg 13y ago
    I just checked it out again and it looks like the situation is improved now that Youtube is http (the biggest source of external embedded content). That being said, there is still a significant monetary cost, not in terms of servers, but in terms of the fact that Akamai, the CDN for reddit, charges an arm and a leg for SSL support.
- tehwebguy 13y ago
  Exactly! reddit going https only would be a serious push for other websites to go https only, "Want to be embeddable? Go https."
- kmfrk 13y ago
  I recall GitHub redirecting external media through their own servers to deal with MCW, but I can't find the link to the blog post. I assume you've tried this, but what made that infeasible?
kmfrk 13y ago
https://pay.reddit.com https://pay.reddit.com. Don't know why HTTPS Everywhere hasn't included it. It's such a pain to type by hand.
- schoen 13y ago
  We used to include it and the Reddit admins asked us to stop for the time being. Source: I was one of the recipients of the request.
- leekleak 13y ago
  https://pay.reddit.com https://pay.reddit.com is still included in HTTPS Everywhere ruleset, but as an experimental rule. Navigate to reddit.com, click the HTTPS Everywhere extension icon, and you can manually enable it.

okasaki 13y ago

The NSA probably isn't thwarted by TLS. I imagine that they have direct access to datacenters.

jedberg 13y ago

https everywhere for reddit is actually a tricky proposition. Mainly because the browsers have yet to be designed to handle an all https website that embeds content from other sites. We tried running reddit in all https mode, but you get a lot of mixed content warnings, which makes for an awful user experience. There are also a lot of edge cases of the opposite case where people embed reddit on their site.

dmunoz 13y ago
I'm likely ignorant of some of the external content, but what about forcing https-only users through a view that avoids external content? I already have reddit setup to not show thumbnails and never expand video links inline. It would be a reasonable trade off to me if the only other option is http only. It's nice to hear there were attempts at having an all https mode. I have long been bummed that reddit is http only, for a variety of reasons.
- jedberg 13y ago
  I just checked it out again and it looks like the situation is improved now that Youtube is http (the biggest source of external embedded content). That being said, there is still a significant monetary cost, not in terms of servers, but in terms of the fact that Akamai, the CDN for reddit, charges an arm and a leg for SSL support.
tehwebguy 13y ago
Exactly! reddit going https only would be a serious push for other websites to go https only, "Want to be embeddable? Go https."
kmfrk 13y ago
I recall GitHub redirecting external media through their own servers to deal with MCW, but I can't find the link to the blog post. I assume you've tried this, but what made that infeasible?

kmfrk 13y ago

https://pay.reddit.com https://pay.reddit.com. Don't know why HTTPS Everywhere hasn't included it. It's such a pain to type by hand.

schoen 13y ago
We used to include it and the Reddit admins asked us to stop for the time being. Source: I was one of the recipients of the request.
leekleak 13y ago
https://pay.reddit.com https://pay.reddit.com is still included in HTTPS Everywhere ruleset, but as an experimental rule. Navigate to reddit.com, click the HTTPS Everywhere extension icon, and you can manually enable it.