Timeline for Network-wide HTTPS: It's time
Current License: CC BY-SA 3.0
117 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 31, 2021 at 10:18 | comment | added | Sebastian Simon | Some help articles seem to still have HTTP links, e.g.: the roomba help article has an HTTP link at the bottom. | |
| Jan 1, 2020 at 19:03 | answer | added | user23013 | timeline score: 6 | |
| Aug 14, 2019 at 11:50 | answer | added | Luuklag | timeline score: 6 | |
| Jun 21, 2019 at 17:19 | comment | added | WBT | Revision requested to: "I'll continue to update this post as we deploy new bits." | |
| Apr 27, 2018 at 8:07 | answer | added | Martin | timeline score: 1 | |
| Jan 27, 2018 at 16:39 | answer | added | Ilmari Karonen | timeline score: 5 | |
| Nov 17, 2017 at 22:56 | answer | added | Stijn | timeline score: 1 | |
| Nov 6, 2017 at 9:30 | answer | added | GlorfindelMod | timeline score: 1 | |
| Oct 26, 2017 at 15:51 | answer | added | αλεχολυτ | timeline score: 4 | |
| Sep 10, 2017 at 20:21 | comment | added | Nick Craver Mod |
@DonaldDuck *.meta.stackexchange is a valid certificate, whereas meta.*.stackexchange.com is not. I covered the migration in a bit of detail here: nickcraver.com/blog/2017/05/22/https-on-stack-overflow
|
|
| Sep 9, 2017 at 17:49 | comment | added | Donald Duck |
Just curious: what's the purpose of changing meta.*.stackexchange.com to *.meta.stackexchange.com?
|
|
| Aug 24, 2017 at 10:47 | answer | added | lois6b | timeline score: 4 | |
| Aug 24, 2017 at 10:39 | answer | added | fedorqui 'SO stop harming' | timeline score: 7 | |
| Aug 21, 2017 at 9:49 | answer | added | GlorfindelMod | timeline score: 10 | |
| Aug 6, 2017 at 10:45 | comment | added | Shadow Wizard | @Nick what about stackpromos.com? | |
| Aug 2, 2017 at 14:27 | answer | added | GlorfindelMod | timeline score: 8 | |
| Jul 12, 2017 at 6:28 | answer | added | SQB | timeline score: 7 | |
| Jun 28, 2017 at 14:44 | answer | added | αλεχολυτ | timeline score: 9 | |
| Jun 28, 2017 at 13:01 | answer | added | Sebastian | timeline score: 4 | |
| May 29, 2017 at 0:59 | answer | added | Noah Cristino | timeline score: 1 | |
| May 24, 2017 at 12:20 | answer | added | Martin Prikryl | timeline score: 6 | |
| May 24, 2017 at 10:16 | comment | added | Shadow Wizard | @Nick two words only: WELL DONE. ;) | |
| May 22, 2017 at 14:59 | history | edited | Nick CraverMod | CC BY-SA 3.0 |
added 406 characters in body
|
| May 9, 2017 at 19:30 | comment | added | Fox | @NickCraver I posted a report, got linked as a dupe of this. Shadow Wizard and rene seem to be suggesting that the system users (e.g. Feeds, id -2) have their avatars loaded in a different way from the others and end up HTTP? They said to ping you on it. Also, the "continue this discussion in chat" links are protocol-relative, and I was told to ping you on that, too | |
| Apr 25, 2017 at 0:20 | comment | added | Pekka | @BillalBEGUERADJ Why? | |
| Apr 25, 2017 at 0:10 | history | edited | Nick CraverMod | CC BY-SA 3.0 |
added 32 characters in body
|
| Apr 13, 2017 at 20:35 | history | edited | Nathan Tuggy | CC BY-SA 3.0 |
Folded identical list items together
|
| Apr 13, 2017 at 13:07 | history | edited | m0sa | CC BY-SA 3.0 |
added 72 characters in body
|
| Apr 8, 2017 at 21:57 | comment | added | Nzall | @NickCraver Understandable. SStatus doesn't really have any information worth encrypting either, so I don't think it would be worth it to put a lot of effort into encrypting it. | |
| Apr 8, 2017 at 18:47 | comment | added | Nick Craver Mod | @Nzall not at the time, Tumblr doesn't support encryption for custom domains - they're just not setup for it. I have no idea if they ever will. And you can't put them behind a proxy in general, e.g. CloudFlare, they're "not compatible"...which means they really don't like it, for whatever reason. | |
| Apr 8, 2017 at 16:27 | comment | added | Nzall | Will stackstatus.net (the status and postmortem announcer) also be updated to HTTPS? | |
| Apr 8, 2017 at 1:02 | history | edited | CommunityBot |
|
|
| Mar 31, 2017 at 12:44 | comment | added | Braiam | @TRiGisTimothyRichardGreen Security.SE: "(why? This community is well equipped to test HTTPS concerns and give feedback)"; Super User is the most power user oriented site. | |
| Mar 31, 2017 at 11:19 | comment | added | TRiG | Any particular reason why Super User & Security SE were picked ahead of all other main sites? | |
| Mar 30, 2017 at 1:50 | comment | added | NobodyNada |
@John It's not completed yet -- they still have to migrate SO, stackexchange.com, Area 51, and chat. They also need to do #10-12 on the first list.
|
|
| Mar 29, 2017 at 0:33 | comment | added | John Militer | Should this question be tagged status-completed? | |
| Mar 28, 2017 at 22:33 | answer | added | chirlu | timeline score: 3 | |
| Mar 27, 2017 at 19:17 | answer | added | bahman | timeline score: 2 | |
| Mar 22, 2017 at 1:07 | comment | added | SomeShinyObject | Really? After the whine-fest that was had in this question (meta.stackexchange.com/questions/181774/…) we're using KBD tags for formatting on a semi-official site wide notification? | |
| Mar 20, 2017 at 20:29 | comment | added | Luc | "(and set an https-only cookie)" so is that http-only or secure-only or both? | |
| Mar 20, 2017 at 9:33 | history | edited | CommunityBot |
replaced http://meta.stackoverflow.com/ with https://meta.stackoverflow.com/
|
|
| Mar 20, 2017 at 5:37 | answer | added | undo | timeline score: 6 | |
| Mar 19, 2017 at 14:42 | answer | added | Jason C | timeline score: 5 | |
| Mar 19, 2017 at 6:47 | answer | added | Scott - Слава Україні | timeline score: 5 | |
| Mar 19, 2017 at 3:10 | comment | added | Jason C | Gravatar links on some pages are an issue -- meta.stackexchange.com/questions/292598/… -- if it hasn't been reported here yet. | |
| Mar 18, 2017 at 21:10 | answer | added | Tom Carpenter | timeline score: 2 | |
| Mar 17, 2017 at 16:06 | answer | added | Monica Cellio | timeline score: 4 | |
| Mar 17, 2017 at 10:50 | answer | added | Nzall | timeline score: 2 | |
| Mar 17, 2017 at 7:08 | answer | added | Martin Prikryl | timeline score: 4 | |
| Mar 16, 2017 at 19:38 | comment | added | Nick Craver Mod | @ETHproductions we had an unrelated backend issue for a bit, rep should be syncing now. | |
| Mar 16, 2017 at 19:36 | history | edited | Nick CraverMod | CC BY-SA 3.0 |
Update deployment status
|
| Mar 16, 2017 at 18:23 | answer | added | Double AA | timeline score: 12 | |
| Mar 16, 2017 at 17:13 | answer | added | Double AA | timeline score: 11 | |
| Mar 16, 2017 at 16:17 | comment | added | ETHproductions |
The codegolf meta has been switched over to https://codegolf.meta.stackexchange.com, and it seems to be working fine, with one minor exception: my rep hasn't updated on codegolf meta for the last half hour :P
|
|
| Mar 16, 2017 at 14:42 | history | edited | CommunityBot |
replaced http://meta.ja.stackoverflow.com/ with https://ja.meta.stackoverflow.com/
|
|
| Mar 15, 2017 at 19:35 | comment | added | user343622 | Network-wide HTTPS: It's too late | |
| Mar 15, 2017 at 15:28 | history | edited | CommunityBot |
replaced http://meta.security.stackexchange.com/ with https://security.meta.stackexchange.com/
|
|
| Mar 15, 2017 at 7:44 | comment | added | Parth Sane | HSTS is a good idea. Lets wait for it. I wonder if we as a community can help... | |
| Mar 15, 2017 at 6:57 | answer | added | Arulkumar | timeline score: 5 | |
| Mar 14, 2017 at 21:41 | comment | added | pal4life | @NickCraver I am curious if you folks were using a tool to scan for mixed content of pages - I have tried using jitbit.com/sslcheck and whynopadlock.com in the past but none of them are 100% helpful. | |
| Mar 14, 2017 at 21:14 | answer | added | Martin Schröder | timeline score: 5 | |
| Mar 14, 2017 at 20:32 | comment | added | Nick Craver Mod | @Braiam Yep, I'm working on it right now - I'd expect reporting to go out tomorrow. | |
| Mar 14, 2017 at 17:57 | comment | added | Braiam | Is there any plans to add CSP headers now that we are going full https? | |
| Mar 14, 2017 at 14:10 | answer | added | user2428118 | timeline score: 23 | |
| Mar 14, 2017 at 13:59 | answer | added | blade19899 | timeline score: 6 | |
| Mar 14, 2017 at 13:55 | answer | added | Vi. | timeline score: 4 | |
| Mar 13, 2017 at 12:40 | comment | added | Full Time Skeleton | @NickCraver Regarding the issue with Fastly and ignoring the protocol (https/ http), we have had to go through exactly the same issue with our site. Lots of pages ending up in infinite redirect loops which I had to accommodate through tweaking the VCL. It's a temporary thing as we will move to all HTTPS eventually but not just yet. It was a difficult one to track down. | |
| Mar 13, 2017 at 11:55 | answer | added | user139336 | timeline score: 7 | |
| Mar 13, 2017 at 7:23 | answer | added | user134589 | timeline score: 12 | |
| Mar 13, 2017 at 4:55 | answer | added | Jason C | timeline score: 5 | |
| Mar 13, 2017 at 2:03 | comment | added | Journeyman Geek | Have we officially reached https on main sites? SU seems to be on HTTPS, but the page is not updated | |
| Mar 12, 2017 at 13:25 | comment | added | Rand al'Thor | Posted this as a separate bug report since I'm not sure if it's related to the HTTPS stuff, but I suspect it is. | |
| Mar 12, 2017 at 13:09 | answer | added | user139336 | timeline score: 4 | |
| Mar 12, 2017 at 2:00 | comment | added | Dan Ross | About the separation of identity and protocol in URIs: Facebook has the same issue, which makes migrating FB-indexed content to HTTPS hard or impossible to do without either data loss on the FB side, or manual intervention by an FB business account manager. I suspect that there is more web software out there that makes the same mistake, than does not. Is the solution really as simple as "PSA: Exclude the $protocol:// from URIs before using them as IDs"? I've noticed that there is a way to make a chat post turn into an out of band chat room on SE, but perhaps I do not have access to that yet... | |
| Mar 11, 2017 at 20:25 | comment | added | Brian |
You might want to add a Content-Security-Policy-Report-Only header so that users will automatically report mixed content and similar issues. You could also add an upgrade-insecure-requests CSP header, though that's not ideal until you're done with everything else.
|
|
| Mar 11, 2017 at 18:55 | answer | added | Cai | timeline score: 7 | |
| Mar 11, 2017 at 1:45 | comment | added | David | thanks @NickCraver. I read your blog post (can't believe that it was 4 years old!) It looks like you all have chosen the best route forward, I just hope the meta domain switch does not cause major confusion. | |
| Mar 11, 2017 at 1:27 | comment | added | Nick Craver Mod |
@David Wildcard certificates must be left-hand matches and single level, so meta.*.stackexchange.com isn't an option. I cover it with some examples in a blog post here: nickcraver.com/blog/2013/04/23/…
|
|
| Mar 10, 2017 at 17:13 | comment | added | Xander | @PeterTurner Nick's kind undeletion aside, I think it was correctly deleted, as it does not answer the question which is looking for specific technical issues with SE's HTTPS rollout. It would be more appropriate as a separate meta question than as an answer here. | |
| Mar 10, 2017 at 17:03 | comment | added | Nick Craver Mod | @PeterTurner It was community deleted - I have undeleted it. | |
| Mar 10, 2017 at 16:17 | comment | added | Peter Turner | Not used to having my answers deleted - that much is troubling, is there that much orthodoxy around HTTPS everywhere that we (the programmers of the world) silence dissent? | |
| Mar 10, 2017 at 15:54 | comment | added | mbomb007 | @suomynonA Just search "What is https" on Google and you'll get some good results. Here's one: What is HTTPS? | |
| Mar 10, 2017 at 4:21 | comment | added | suomynonA | What's the difference between https and no https? | |
| Mar 9, 2017 at 15:44 | answer | added | Peter Turner | timeline score: -61 | |
| Mar 9, 2017 at 14:19 | answer | added | Arulkumar | timeline score: 11 | |
| Mar 9, 2017 at 14:16 | answer | added | αλεχολυτ | timeline score: 19 | |
| Mar 9, 2017 at 13:49 | history | edited | Nick CraverMod | CC BY-SA 3.0 |
added 4 characters in body
|
| Mar 9, 2017 at 11:52 | comment | added | Chris | @NickCraver - The (http) image in this question isn't loading in the iOS app - but is fine on web. From what you've written above, not sure anything is live on Sustainability SE yet - is this likely to be affected by some site-wide ssl changes, or is this a separate bug? sustainability.stackexchange.com/questions/5883/… | |
| Mar 9, 2017 at 3:12 | comment | added | Monica Cellio | Answer: it's SOUP. | |
| Mar 9, 2017 at 3:06 | comment | added | Monica Cellio | @NickCraver no, I don't use HTTPS Everywhere. Must be some weird Firefox thing, then. (Reproduced in a slightly older Firefox version on a different machine.) Edit: oh this is weird; it also happens to me on this machine in Chrome, but didn't on the machine I was using earlier. Maybe some userscript is to blame? Will investigate; sorry to bother you. | |
| Mar 9, 2017 at 3:04 | comment | added | Nick Craver Mod |
@randal'thor There was indeed a 301 redirect issue (caching on the Fastly side), which we have addressed by changing how the Varnish cache key is calculated in VCL. Basically, it wasn't differentiating on http:// vs https:// in cache lookups on redirects by default...and that's crazy bad. They expect redirects to be done at the edge in VCL. This will be the case later, but not during the move while it's per-site.
|
|
| Mar 9, 2017 at 2:19 | comment | added | Rand al'Thor | I don't know if this is related to any of the https stuff, but MSE was giving me weird errors earlier when I was trying to follow some links there in Chrome while not logged in. Something like "you've had too many referrals to this site, please clear your cookies". (Sorry I can't give any more details - it's norepro while logged in, and I didn't take a screenshot earlier.) | |
| Mar 9, 2017 at 1:30 | comment | added | Nick Craver Mod | @PeterMortensen What's "this"? Pretend I know nothing about your super secret always-encrypted programming language :) What's breaking? Does the lib not support HTTPS at all or something? Or...another issue? | |
| Mar 9, 2017 at 1:29 | comment | added | Nick Craver Mod |
@MonicaCellio Are you using HTTPS Everywhere, or some other confused plugin? Our collider doesn't render https:// links except to Meta.SO and Meta.SE right now (as intended). The URL generation is controller by per-site settings as part of the rollout.
|
|
| Mar 8, 2017 at 22:52 | comment | added | Monica Cellio | Followup: doesn't happen on Chrome 56.0.2924.87. Maybe a Firefox bug? (I'm not sure I want to use IE to break a tie...) | |
| Mar 8, 2017 at 22:46 | comment | added | Monica Cellio | @NickCraver I'm getting sticky HTTPS from here on MSE to other sites. E.g. I come here and it rewrites the URL to HTTPS, I use the supercollider to go elsewhere, URL stays HTTPS, and then when I go to that other site's meta I hit the cert error. I gather that's not intended behavior? I'm seeing it in Firefox 51.0.1 and reproduced in a private window. I am not using the HTTPS Everywhere extension. | |
| Mar 8, 2017 at 20:35 | comment | added | Nick Craver Mod | @Riker We'll be doing a mass edit on our side to migrate sites - it'll have code and everything. Might even worth within the first 10 tries! | |
| Mar 8, 2017 at 20:13 | comment | added | This_is_NOT_a_forum |
This breaks Perl scripts that use the core module File::Fetch (using http)... LWP works (use LWP::Simple; my $content = get('https://meta.stackexchange.com/users/63550/peter-mortensen?tab=profile') or die 'Unable to get page';), but this requires installation. HTTP::Tiny may or may not be built in and may or may not work for this (I haven't tried it).
|
|
| Mar 8, 2017 at 19:46 | answer | added | Mithical | timeline score: 21 | |
| Mar 8, 2017 at 17:56 | comment | added | Christopher | @NickCraver Ah, sorry, I thought that was maybe covered in the fixing of HTTP-related code. Fair enough! :) | |
| Mar 8, 2017 at 17:35 | comment | added | user311528 | How are you planning on moving the metas to site.meta.se? Will you have the Community bot go around editing them, or will that be on the users to edit their posts? | |
| Mar 8, 2017 at 17:28 | answer | added | Suraj Jain | timeline score: 40 | |
| Mar 8, 2017 at 17:21 | history | edited | This_is_NOT_a_forum | CC BY-SA 3.0 |
added 4 characters in body
|
| Mar 8, 2017 at 17:07 | comment | added | Nick Craver Mod |
@Floern The links are https:// if linking to a site where it's enabled, it's being enabled per-site as we re-bake content and transition things on the Google side. All links are rendered dynamically, in the context of the site they're going to.
|
|
| Mar 8, 2017 at 17:04 | comment | added | Floern | The Hot Meta Posts (on meta.SO itself) are not linked with https (not sure if caching, but it's been a while). | |
| Mar 8, 2017 at 17:00 | comment | added | Nick Craver Mod | @Christopher That's because we haven't switch Stack Overflow to HTTPS yet, that's step 5 in the bottom list :) | |
| Mar 8, 2017 at 16:59 | comment | added | Christopher | The "share" permalink dialog on Stack Overflow still hands out http:// URLs (I'm logged in). Which will at least not be an issue once HSTS is rolled out. | |
| Mar 8, 2017 at 15:34 | comment | added | Nick Craver Mod | @SEJPM correct, they'll be about the same time. | |
| Mar 8, 2017 at 15:32 | comment | added | SEJPM | What about ServerFault, AskUbuntu, MathOverflow (and potentially other custom-domain sites) in step 6 of the second list? | |
| Mar 8, 2017 at 15:29 | comment | added | Braiam | But I would have to join a chat server less :( | |
| Mar 8, 2017 at 15:25 | comment | added | Tim Stone | There's a minor content security-related bug for the editor preview that may have been missed for #3. TO THE WHEEL OF BLAME! | |
| Mar 8, 2017 at 15:20 | comment | added | ale | Do you want bug reports as answers to this, separate questions tagged bug and ssl, or something else? | |
| Mar 8, 2017 at 15:19 | history | edited | ale | CC BY-SA 3.0 |
replaced "access" with "assess" which, from context, is what was meant
|
| Mar 8, 2017 at 15:00 | comment | added | Machavity | On the Google thing, they made this big deal about how it helps SEO and yet there's no indication it helps much, if at all. So the fact that WMT doesn't support it correctly doesn't surprise me either. Google wants HTTPS, but not badly enough to make it easier for people to make it work | |
| Mar 8, 2017 at 14:52 | comment | added | Nick Craver Mod | @Braiam That's not really a problem less, it's the same solution for all 3. However, it would create a ton of problems merging 3 databases, room lists, users, code assumptions, figuring out redirects for all time, etc. It's just not a win in any way :) | |
| Mar 8, 2017 at 14:51 | comment | added | Braiam | For 11. chat, how about you migrate chat.so to chat.se and have a problem less? | |
| Mar 8, 2017 at 14:42 | history | asked | Nick CraverMod | CC BY-SA 3.0 |
