Reminds me of the Australian Bureau of Meteorology (BoM). They have a web presence, in glorious HTTP like it's still the 1990s and everyone uses NetScape Navigator:

    http://www.bom.gov.au/

They've been called out about the lack of HTTPS on their site in the media several times. In 2022, it's just shameful.

Maybe there's a technical reason, you're about to say. Maybe they have an enormous load on their systems and they can't afford the overhead of TLS? Or something?

Get a load of this: https://www.bom.gov.au/ works!

It shows a full-page error message -- via correctly configured HTTPS -- that says:

    The Bureau of Meteorology website does not currently support connections via HTTPS.

    You will shortly be redirected to http://www.bom.gov.au.

What kills me is that you if you use F12 network tools to have a look at their site, you'll notice that they're behind the Akamai CDN, which 100.000% certainly supports HTTPS and probably serves little else in this day and age... except for the Australian Bureau of Meteorology and other backwards organisations.

Their excuse for this was that there already was an ongoing project by some consultancy (Accenture or Deloitte, I can't remember) to uplift their site. Years later that seems to have gone nowhere despite tens of millions of dollars spent.

Australian organisations seem to love this kind of thing. Still clinging on to the old system for dear life while burning a huge pile of money that doesn't actually deliver any improvements and gets abandoned after years...

As someone who worked on a Deloitte government project in Aus, they'd have got a better product (or anything at all for that matter) for way less money by just hiring a small dev team internally. Instead, it was outsourced, and they were offered a bloated Sitecore .NET monstrosity. The project had completely stagnated before the pandemic, and then that was the final nail that got it abandoned.

They (the ministers at least) know this, this is working as intended under our previous Liberal governments.

FYI: https://weather.bom.gov.au/ supports HTTPS and is pretty much a "modern" drop-in for the top-level.

I think by "modern" you mean that it makes my browser stutter when scrolling from what appears to be layer upon layer of transparent divs?

Also, I can't select a location manually, it forces the use of GPS location finding. Even if you bookmark a specific location and then load it in a new tab, it'll immediately prompt to use your location. If you refuse...

    Unable to detect location.
    To use your current location, allow permission via browser settings.

It simply hides the content of the page, so you can't see or do anything with a URL somebody sends you if you don't grant location permission.

I bet this page cost millions. It hides the information I'm looking for "below the fold". It shows a grand total of 276 bytes of readable text on an entire page of HTML that took 198 requests, 2.32 MB and 19 seconds to load.

As I mentioned, I have to scroll down to see the content I actually wanted, which is the hourly forecast. But despite making you scroll, it still hides half the content with a "show more" expanding section you have to manually click. The "saved" area is a tiny, tiny fraction of the multi-page screen real estate they waste on enormous empty space.

The radar map no longer shows temperature measurements or anything useful, and is staggeringly slow. It stutters my very high-end gaming laptop. This is in part because BoM was too incompetent to host ESRI ArcGIS themselves and used the cloud-hosted "tiles.arcgis.com", which is hosted in the United States, 230 milliseconds away from Australian users.

Speaking of United States data centers used for Australian Government websites, I've noticed that it seems to be the policy of both state and federal departments to add the Google Analytics to all pages to ensure that Google can track our citizens during their interactions with their government...

We're the lucky country mate.

Someone came along and gave me that site. Bugger if I know how to change it. Once it's gone it's gone!

On the one hand, https on BOM might not be a big deal / low priority in the grand scheme of things, but in the other hand it could be done in like half a day by anyone there who knows computers.

It's probably safe to say they don't know how to computer

IT procurement in Australia is a piece of shit because, in the name of fairness, everything needs to go out to tender, but the only companies big enough to deal with a tender process are mostly lawyers with a couple of coders attached (or worse still, they just subcontract the coding). Almost all the money goes to people who sit in meetings discussing the scope, and some poor sap ends up doing the code for next to nothing.

The government just needs to hire coders directly, that's what Service NSW does and it shows.

This seems to be the correct answer based on my experience.

This is a problem almost everywhere today.

Lots of businesses are now tech companies, but the managers are from a different age so you need layers of other managers to do exactly the same job (when people talk about weak productivity growth from technology, this is it...it took half a decade plus after the industrial revolution for things to filter through, it will be a bit quicker this time but there are massive institutional roadblocks...perhaps even bigger than in the 19th century which was all de novo innovation).

1,000x this.

There are a bunch of potential projects I could knock over personally in a month or two each that I will never ever be allowed to bid on.

Instead, it goes through an internal process at the department that takes months, which means a bunch of people have to justify their positions, driving up the minimum cost.

These non-technical people architect the solution, put it a scribble of a Frankenstein's monster of a design in the tender with a laundry list of requirements, none of which are actually needed because what they really wanted was a mostly static website any idiot could develop.

A couple of years later (I wish I was kidding), the tender process is finished and a Big Consultancy begins the hard work of... subcontracting the work. To my parent company, that finally gives it to me. Out of the $millions on the tender, I now have 2 weeks to a job that should have been 2 months.

The design is now hilariously out-of-date, and was wrong to begin with, but it is now a part of a legally binding contract between orgs I have zero leverage with. It MUST be implemented, verbatim. Including the bits that are actively harmful, stupid, backwards, legacy, or just idiotic. All of it. This stuff is audited to make sure there's no corruption or dodgy work!

The end result is a monstrosity built in a hurry by a poorly paid tech, while 10+ middle manager types all take their cut.

It's abhorrent.

Sure but why do I care if my weather reports are covered by HTTPS? What risk is that going to mitigate?

Weatherman in the Middle

Tell that to Eisenhower as he’s postponing D-day due to bad weather.

Malicious JS being injected.

Also Australian,

The only sensible reason I can think that BOM is not under https is that there are ancient mission critical consuming services somewhere that can't handle the upgrade.

For example: a network of regional flood warning alarms that are pulling flood/rainfall data from a feed on the same url. They could have been built in the early 80s, and cant be upgraded. Ignoring them would risk lives etc etc

Nevertheless there would be other ways to solve that.

The web uses port 443 for HTTPS, so this example is unlikely to be an issue. Having said that, there are weird and wonderful corporate and government proxy configurations out there that do wacky things.

My guess is that their entire system is so tightly coupled that they can't unpick this without a huge amount of work that requires real developers to stick with it and get around it.

Adding HTTPS support doesn't necessarily mean removing HTTP.

Even if there was an ancient service that can't handle HTTP, keeping HTTP and adding HTTPS support will do just fine.

You're just making up things trying to find a reason. HTTP was only invented in 1989, so these imaginary early 80s clients likely don't exist

Good example, but even so I can think of many way a well directed intern could solve that without touching the code of that things.

“Do not redirect from HTTP to HTTPS if source is IP is in list if legacy devices.”

There. I’ve solved it.

Similarly, a filter based on User Agent would likely also work.

I meant actually solve it by upgrading to HTTPS in a reverse proxy but yeah :)

They're already behind Akamai, and have a valid certificate and the site is reachable on HTTPS... but redirects back to HTTP.

That's purposeful incompetence, not an accident, oversight, lack of budget, or anything else that can be excused.

There is no sensible reason, except perhaps money. And using it as an attempt to increase funds or raise the low pay levels hasn't worked and won't work. It is likely to be stuck that way until Chrome stops serving plain HTTP at all from the Internet and someone gets a kick in the bum to fix it, after which a few clicks with Cloudflare or other HTTPS front end provider will sort the problem. And possibly even save money due to caching and not passing on much bad traffic.

> Accenture and Deloitte Both ? Here you go.