6

In 2017 the network decided to implement the HTTPS protocol, as was announced in Network-wide HTTPS: It's time. Although that post isn't completely marked as I think most, if not all, of that came through.

During that process there was a script that converted all links in posts from HTTP:// to HTTPS://, as you can see in the screenshot below (freehand circle mine).

A screenshot of a revision by the community user with description: "replaced http://stackoverflow.com/ with https://stackoverflow.com/". two links in text are changed, but it failed to replace a link to a chat transcript inside a blockquote

Was this intended behaviour?

EDIT: I wrote a feature request to have the community user change these links as an answer to the original announcement.

Improve this question
9
  • That link is to chat.stackoverflow.com and I'm pretty sure when the bot was run chat wasn't 100% verified to be error free on https yet.
    – rene Mod
    Commented Aug 14, 2019 at 7:15
  • @rene yeah, chat got the love pretty late, maybe year later or so.
    – Shadow Wizard
    Commented Aug 14, 2019 at 7:38
  • 1
    Well if it didn't get HTTPS at that point, it would still be useful to convert old links from HTTP to HTTPS by now. @rene
    – Luuklag
    Commented Aug 14, 2019 at 7:38
  • 1
    I agree - there are 681 links to the HTTP version of chat.SO vs. 69 to HTTPS, all done manually as far as I bothered to check.
    – Glorfindel Mod
    Commented Aug 14, 2019 at 8:03
  • @Glorfindel that would definetly warrants automation, if only to avoid bumping the homepage with tiny edits.
    – Luuklag
    Commented Aug 14, 2019 at 8:06
  • @Luuklag sure, it would be useful but that is not what you asked in your question ...
    – rene Mod
    Commented Aug 14, 2019 at 10:17
  • 1
    @rene, I could start off by saying this SHOULD be changed and all, but I feel more comfortable knowing the propper background before making such a request.
    – Luuklag
    Commented Aug 14, 2019 at 10:27
  • 1
    @rene, made a FR here: meta.stackexchange.com/questions/292058/…
    – Luuklag
    Commented Aug 14, 2019 at 11:51
  • 4
    Possible duplicate of Old HTTP links to SE sites without ending / weren't converted to HTTPS links...not exactly the same bug, but the gist of the answer there also applies here.
    – Sonic the Anonymous Hedgehog
    Commented Aug 15, 2019 at 12:41

1 Answer 1

Reset to default
-1

It...

Dosen't really matter

I've noticed folks have been trickling in edits but since SE dosen't actually have those sites on HTTP, and things are redirected, changing http to https in links is basically just window dressing. It dosen't do anything - its not considered mixed content , and just makes things look nicer.

I ran a quick check of what the certs for MSE do, and what the settings are -its a screenshot but you can generate your own tests here

We have HSTS

One of the nice things it does as per the wikipedia article...

Automatically turn any insecure links referencing the web application into secure links. (For instance, http://example.com/some/page/ will be modified to https://example.com/some/page/ before accessing the server.

Which is shiny, and means that no http only connections work. It also kinda fixes what folks think they are fixing by editing http links into https.

Since there's a 301 redirect from http to https, they both point to the same place and you will hit a https site in either case.

I don't think there's much point fretting over this.

Improve this answer
8
  • 4
    Then why was the entire endeavour undertaken before, replacing all links to any SE page. That would have been useless as well then? Also leaving half of the links converted, and the other half in their original form is poor consistency.
    – Luuklag
    Commented Aug 14, 2019 at 12:18
  • It looks neater I guess. And it bothers some folks more than others.
    – Journeyman Geek Mod
    Commented Aug 14, 2019 at 12:26
  • I may be wrong or may have dreamed this but in the near future isn't Google changing its algorithm to not crawl http and will be just crawling https. As far as Google is concerned every site should be secure by now and therefore rendering http pages useless for any SEO or ranking
    – Dan K
    Commented Aug 14, 2019 at 13:22
  • @Luuklag because if your somewhere trying to censor your internet, if you originally try to go to an HTTP version of a site but get redirected, it's effectively as bad as you going to a site with no SSL—they see what page you're going to because you have to connect to it to be forced to redirect, even if for you it doesn't seem to be doing anything. HTTPS is more secure, and I've heard it's a lot harder to block you from going to HTTPS-secured sites.
    – Stormblessed
    Commented Aug 14, 2019 at 13:31
  • 1
    @Luuklag it's designed to be less vulnerable to man-in-the middle attacks, too.
    – Stormblessed
    Commented Aug 14, 2019 at 13:32
  • 1
    @Luuklag yup. Currently, I think chat.se, se.com, and data.se are the only Network sites which didn't get converted, but those three are really commonly linked. Probably also chat.meta.se, chat.so, etc. also weren't.
    – Stormblessed
    Commented Aug 14, 2019 at 13:36
  • @Stormblessed I inserted your info into my FR.
    – Luuklag
    Commented Aug 14, 2019 at 13:44
  • SE uses HSTS . I know this is important somehow, and future me will thank me for this. I seem to think this helps with keeping stuff safe but I'll leave that for future me.
    – Journeyman Geek Mod
    Commented Aug 14, 2019 at 14:48

Not the answer you're looking for? Browse other questions tagged .