News for hackers. Stuff that matters.
Re:WordPress.com turns on HTTPS encryption for all websites by skeltoac on Friday April 08, 2016 @03:22PM (#11457164)
We've been working on this for quite a while and several parts of the solution deal with rewriting embedded URLs using HTTP. If you have any examples of breakage, let us know.
Re:WordPress.com turns on HTTPS encryption for all websites by CharlesW on Friday April 08, 2016 @10:27PM (#11459613)
> If you have any examples of breakage, let us know.

I believe it's breaking podcast feeds being served with WordPress.com, because iTunes doesn't support Let's Encrypt certificates.

https://www.dominicrodger.com/2016/02/29/lets-encrypt-itunes...

This may not affect a lot of customers (since WordPress.com doesn't support PowerPress for feed generation), but I know some podcasters create feeds by hand or with other apps.

This issue will cause at least some podcasts to disappear from iTunes without warning unless you can coordinate with Apple to fix it.

Re:WordPress.com turns on HTTPS encryption for all websites by barsxl on Saturday April 09, 2016 @03:18AM (#11460328)
> I believe it's breaking podcast feeds being served with WordPress.com, because iTunes doesn't support Let's Encrypt certificates.

Do you have an example? We have already implemented workarounds for iTunes. If they aren't working I would love to know the specifics so we can fix it.

Re:WordPress.com turns on HTTPS encryption for all websites by CharlesW on Saturday April 09, 2016 @09:11AM (#11461078)
> Do you have an example?

Just the confirmation from Apple's podcaster support team that iTunes doesn't support sites which use Let's Encrypt. (I don't use WordPress.com myself.)

I've just posted a request for examples in popular podcasting groups, and I'll let you know when/if I get responses.

> We have already implemented workarounds for iTunes.

Can you elaborate just a smidge? Is WordPress.com, for example, not encrypting content when it's requested by iTunes? (Thanks!)

Re:WordPress.com turns on HTTPS encryption for all websites by barsxl on Saturday April 09, 2016 @02:01PM (#11462430)
> Can you elaborate just a smidge? Is WordPress.com, for example, not encrypting content when it's requested by iTunes? (Thanks!)

Yes, we have some targeted exceptions for incompatible clients.

Re:WordPress.com turns on HTTPS encryption for all websites by nachtigall on Saturday April 09, 2016 @05:08AM (#11460583)
How do you handle that users might embed external http images in a page? Can't you somehow warn about this during editing?

Asking because that's the problem I see at my site currently (https://groni50.org). In this case I'll just upload the external images to our site. I'll also brief our users. But I wonder if something couldn't be averted/checked in the wysiwyg editor.

Re:WordPress.com turns on HTTPS encryption for all websites by toomuchtodo on Friday April 08, 2016 @03:41PM (#11457316)
Any plans to use HSTS and preloads header to default to SSL in browsers for Wordpress-hosted sites?
Re:WordPress.com turns on HTTPS encryption for all websites by barsxl on Saturday April 09, 2016 @03:19AM (#11460333)
Yes, we're working on it.