4 ms·

Yes, they should do everything over HTTPS. I assure you they're moving in that direction, but they have thousands of pages and many different rendering technolo

by rgbrgb 12y ago

Yes, they should do everything over HTTPS. I assure you they're moving in that direction, but they have thousands of pages and many different rendering technologies to deal with (after 20 years, some cruft and fragmentation is par for the course). However, this article insinuates that HTTPS is enough to hide from the government. HTTPS only protects data in transit. If the big internet companies are complicit in leaking user data to the government (as Snowden showed) then HTTPS isn't going to be useful in that regard.

mkonecny 12y ago
Renderers and other "old technologies" has nothing to do with SSL. Typically you insert a reverse proxy in between the client and server to handle SSL encryption on the fly - it is completely transparent to the server stack.
- pdkl95 12y ago
  It could, in theory, be a problem if their HTML rendering software is generating a lot of absolute URLs that link back to the same host.
  - judk 12y ago
    A college intern could debug that problem. It's a non-issue.
    - rgbrgb 12y ago
      Not going to go into details but I'd guess you're underestimating the size of the codebase (and thus the complexity of certain site-wide changes) by at least two orders of magnitude. Imagine doing (and testing) a "simple change" for every project on Github for instance. This is the dark side of giving each of your dev teams freedom to pick their tools.
pdkl95 12y ago
HTTPS may be enough to hide from the trivial bulk collections, such as the infamous Folsom St. beam-splitter. If they are targeting and are willing to invest in the time/effort to MitM your HTTPS connections, they will probably find a way anyway (QUANTUM has a lot of options, etc). Now, as you say, the "cooperating agreement" trick where they just strong-arm industry with a national security letter and personal threats against the CEO to force compliance is a much bigger problem, which really needs to be addressed. ASAP. /of course, then there are the companies that are collaborators... sigh

by rgbrgb 12y ago

mkonecny 12y ago

Renderers and other "old technologies" has nothing to do with SSL. Typically you insert a reverse proxy in between the client and server to handle SSL encryption on the fly - it is completely transparent to the server stack.

pdkl95 12y ago
It could, in theory, be a problem if their HTML rendering software is generating a lot of absolute URLs that link back to the same host.
- judk 12y ago
  A college intern could debug that problem. It's a non-issue.
  - rgbrgb 12y ago
    Not going to go into details but I'd guess you're underestimating the size of the codebase (and thus the complexity of certain site-wide changes) by at least two orders of magnitude. Imagine doing (and testing) a "simple change" for every project on Github for instance. This is the dark side of giving each of your dev teams freedom to pick their tools.

pdkl95 12y ago

HTTPS may be enough to hide from the trivial bulk collections, such as the infamous Folsom St. beam-splitter. If they are targeting and are willing to invest in the time/effort to MitM your HTTPS connections, they will probably find a way anyway (QUANTUM has a lot of options, etc). Now, as you say, the "cooperating agreement" trick where they just strong-arm industry with a national security letter and personal threats against the CEO to force compliance is a much bigger problem, which really needs to be addressed. ASAP. /of course, then there are the companies that are collaborators... sigh