News for hackers. Stuff that matters.
Re:WordPress.com turns on HTTPS encryption for all websites by kyledrake on Friday April 08, 2016 @03:14PM (#11457095)
Not to say this is a bad thing, but I'm sure Wordpress just broke a lot of links on their user's sites. For example, any embedded images from other servers not using HTTPS means that they won't load anymore due to browser policies, essentially breaking the links. It also means that any embedded images/videos/etc. will only work if the remote server has HTTPS. Again, not a bad thing, but it's pretty painful to have to deal with this with a lot of users that aren't experts on HTTP, and I'm sure it's a similar story at Wordpress.

I can flip the switch for default HTTPS on Neocities in a day. The hard part is figuring out how to not break user's sites in that process. Ideas welcome.

Re:WordPress.com turns on HTTPS encryption for all websites by skeltoac on Friday April 08, 2016 @03:22PM (#11457164)
We've been working on this for quite a while and several parts of the solution deal with rewriting embedded URLs using HTTP. If you have any examples of breakage, let us know.
Re:WordPress.com turns on HTTPS encryption for all websites by CharlesW on Friday April 08, 2016 @10:27PM (#11459613)
> If you have any examples of breakage, let us know.

I believe it's breaking podcast feeds being served with WordPress.com, because iTunes doesn't support Let's Encrypt certificates.

https://www.dominicrodger.com/2016/02/29/lets-encrypt-itunes...

This may not affect a lot of customers (since WordPress.com doesn't support PowerPress for feed generation), but I know some podcasters create feeds by hand or with other apps.

This issue will cause at least some podcasts to disappear from iTunes without warning unless you can coordinate with Apple to fix it.

Re:WordPress.com turns on HTTPS encryption for all websites by barsxl on Saturday April 09, 2016 @03:18AM (#11460328)
> I believe it's breaking podcast feeds being served with WordPress.com, because iTunes doesn't support Let's Encrypt certificates.

Do you have an example? We have already implemented workarounds for iTunes. If they aren't working I would love to know the specifics so we can fix it.

Re:WordPress.com turns on HTTPS encryption for all websites by CharlesW on Saturday April 09, 2016 @09:11AM (#11461078)
> Do you have an example?

Just the confirmation from Apple's podcaster support team that iTunes doesn't support sites which use Let's Encrypt. (I don't use WordPress.com myself.)

I've just posted a request for examples in popular podcasting groups, and I'll let you know when/if I get responses.

> We have already implemented workarounds for iTunes.

Can you elaborate just a smidge? Is WordPress.com, for example, not encrypting content when it's requested by iTunes? (Thanks!)

Re:WordPress.com turns on HTTPS encryption for all websites by barsxl on Saturday April 09, 2016 @02:01PM (#11462430)
> Can you elaborate just a smidge? Is WordPress.com, for example, not encrypting content when it's requested by iTunes? (Thanks!)

Yes, we have some targeted exceptions for incompatible clients.

Re:WordPress.com turns on HTTPS encryption for all websites by nachtigall on Saturday April 09, 2016 @05:08AM (#11460583)
How do you handle that users might embed external http images in a page? Can't you somehow warn about this during editing?

Asking because that's the problem I see at my site currently (https://groni50.org). In this case I'll just upload the external images to our site. I'll also brief our users. But I wonder if something couldn't be averted/checked in the wysiwyg editor.

Re:WordPress.com turns on HTTPS encryption for all websites by toomuchtodo on Friday April 08, 2016 @03:41PM (#11457316)
Any plans to use HSTS and preloads header to default to SSL in browsers for Wordpress-hosted sites?
Re:WordPress.com turns on HTTPS encryption for all websites by barsxl on Saturday April 09, 2016 @03:19AM (#11460333)
Yes, we're working on it.
Re:WordPress.com turns on HTTPS encryption for all websites by pfg on Friday April 08, 2016 @03:28PM (#11457215)
I'm not sure if WordPress is actually doing this, but they might be using something like camo[1] to transparently rewrite any http:// URLs to an image proxy running on SSL.

This gets harder to implement correctly depending on what kind of content you allow on your sites (i.e. does your CMS only permit sanitized HTML, or are users allowed to do basically anything?), so it's not a perfect solution for everyone, but it might work here.

[1]: https://github.com/atmos/camo

Re:WordPress.com turns on HTTPS encryption for all websites by barsxl on Saturday April 09, 2016 @03:22AM (#11460337)
Photon[0] does exactly this (and more!) and is free to use as part of Jetpack[1]

0. http://developer.wordpress.com/docs/photon/ 1. https://wordpress.org/plugins/jetpack/

Re:WordPress.com turns on HTTPS encryption for all websites by stock_toaster on Friday April 08, 2016 @07:48PM (#11459039)
And if node isn't your thing, there is a work-a-like[1] written in Go.

Disclosure: I am the author of go-camo.

[1]: https://github.com/cactus/go-camo

Re:WordPress.com turns on HTTPS encryption for all websites by pred_ on Friday April 08, 2016 @04:36PM (#11457717)
Depending a bit on which browser we are talking about, passive mixed content (such as images) will typically be allowed through on default settings, while only active mixed content is blocked.
Re:WordPress.com turns on HTTPS encryption for all websites by sargas on Friday April 08, 2016 @04:10PM (#11457518)
> but I'm sure Wordpress just broke a lot of links on their user's sites.

Growing pains. I think that will at least make people on the web more aware of the HTTPS "revolution".

Re:WordPress.com turns on HTTPS encryption for all websites by chippy on Friday April 08, 2016 @07:17PM (#11458896)
I'm not that clear as to the severity of the issue, but are you saying that "yes, it is severe, but there nothing you can do about it"? Because thats the price we pay in getting a more secure browsing experience?

Just wonderding about the metaphor of "growing pains". In humans its somethng that happens and for some its painful but has to happen, for others it isn't painful, but the process that makes the pain happens goes on regardless. Is this an accurate metaphor in this example?