6

In 2017 the network decided to implement the HTTPS protocol, as was announced in Network-wide HTTPS: It's time. Although that post isn't completely marked as I think most, if not all, of that came through.

During that process there was a script that converted all links in posts from HTTP:// to HTTPS://, as you can see in the screenshot below (freehand circle mine).

A screenshot of a revision by the community user with description: "replaced http://stackoverflow.com/ with https://stackoverflow.com/". two links in text are changed, but it failed to replace a link to a chat transcript inside a blockquote

Was this intended behaviour?

EDIT: I wrote a feature request to have the community user change these links as an answer to the original announcement.

-1

It...

Dosen't really matter

I've noticed folks have been trickling in edits but since SE dosen't actually have those sites on HTTP, and things are redirected, changing http to https in links is basically just window dressing. It dosen't do anything - its not considered mixed content , and just makes things look nicer.

I ran a quick check of what the certs for MSE do, and what the settings are -its a screenshot but you can generate your own tests here

We have HSTS

One of the nice things it does as per the wikipedia article...

Automatically turn any insecure links referencing the web application into secure links. (For instance, http://example.com/some/page/ will be modified to https://example.com/some/page/ before accessing the server.

Which is shiny, and means that no http only connections work. It also kinda fixes what folks think they are fixing by editing http links into https.

Since there's a 301 redirect from http to https, they both point to the same place and you will hit a https site in either case.

I don't think there's much point fretting over this.

  • 4
    Then why was the entire endeavour undertaken before, replacing all links to any SE page. That would have been useless as well then? Also leaving half of the links converted, and the other half in their original form is poor consistency. – Luuklag Aug 14 at 12:18
  • It looks neater I guess. And it bothers some folks more than others. – Journeyman Geek Aug 14 at 12:26
  • I may be wrong or may have dreamed this but in the near future isn't Google changing its algorithm to not crawl http and will be just crawling https. As far as Google is concerned every site should be secure by now and therefore rendering http pages useless for any SEO or ranking – Dan K Aug 14 at 13:22
  • @Luuklag because if your somewhere trying to censor your internet, if you originally try to go to an HTTP version of a site but get redirected, it's effectively as bad as you going to a site with no SSL—they see what page you're going to because you have to connect to it to be forced to redirect, even if for you it doesn't seem to be doing anything. HTTPS is more secure, and I've heard it's a lot harder to block you from going to HTTPS-secured sites. – Stormblessed Aug 14 at 13:31
  • 1
    @Luuklag it's designed to be less vulnerable to man-in-the middle attacks, too. – Stormblessed Aug 14 at 13:32
  • 1
    @Luuklag yup. Currently, I think chat.se, se.com, and data.se are the only Network sites which didn't get converted, but those three are really commonly linked. Probably also chat.meta.se, chat.so, etc. also weren't. – Stormblessed Aug 14 at 13:36
  • @Stormblessed I inserted your info into my FR. – Luuklag Aug 14 at 13:44
  • SE uses HSTS . I know this is important somehow, and future me will thank me for this. I seem to think this helps with keeping stuff safe but I'll leave that for future me. – Journeyman Geek Aug 14 at 14:48

Not the answer you're looking for? Browse other questions tagged .