{"id":27632,"date":"2017-05-28T13:26:47","date_gmt":"2017-05-28T11:26:47","guid":{"rendered":"https:\/\/mamchenkov.net\/wordpress\/?p=27632"},"modified":"2017-05-28T13:26:47","modified_gmt":"2017-05-28T11:26:47","slug":"https-on-stack-overflow-the-end-of-a-long-road","status":"publish","type":"post","link":"https:\/\/mamchenkov.net\/wordpress\/2017\/05\/28\/https-on-stack-overflow-the-end-of-a-long-road\/","title":{"rendered":"HTTPS on Stack Overflow: The End of a Long Road"},"content":{"rendered":"\n

Way too often I hear rants from random people (unfortunately, many of them are also from the IT industry, with the deep understanding of the underlying issues) complaining about why company X or product Y doesn’t implement this or that feature. \u00a0As someone who has been involved a dozens, if not hundreds, of projects, I pretty much always can think of a number of reasons why even seemingly the simplest of features aren’t implemented for years. \u00a0These can vary from business side of things – insufficient budgets, strategic goals, and the like – to technical, such as architectural limitations, insufficient expertise, insufficient resources, etc.<\/p>\n

One of the recent frequent rant that keeps coming up is “Why don’t they just enable HTTPS?”. \u00a0Again, as someone being involved in HTTPS setup for several different environments I can think of a number of reasons why. \u00a0SSL certificates used to cost money and were quite cumbersome to install until very recently. \u00a0Thanks to Let’s Encrypt<\/a> effort, SSL certificates are now free and quite easy to issue and renew. \u00a0But that’s only part of the problem. \u00a0Enabling HTTPS requires infrastructural changes, and the more complex your infrastructure, the more changes are needed. \u00a0Just think of a few points here – web server configuration (especially when you have multiple web servers, with varied software (Apache, Nginx, IIS) and varied versions of that software), load balancers, web application firewalls, reverse proxies, caching servers, and so on.<\/p>\n

Apart from the infrastructural changes, HTTPS often needs changes on the application level. \u00a0Caching, cookies, headers, making sure that all your resources are HTTPS-only, redirects, and the like.<\/p>\n

All of the above issues are multiplied by a gadzillion, when your project is publicly available, used by tonnes of people, and provides embeddable content or APIs to third-party (hello, backward compatibility).<\/p>\n

This is not to mention that HTTPS itself is a complex subject, not well understood by even the most experienced system administrators and developers. \u00a0There are different protocols and versions (SSL vs. TLS), cipher suites, handshakes, and protocol details. \u00a0Just have a look at the variety of checks and the report length done by Qualys’ SSL Labs<\/a> Server Test. \u00a0Even giants like Google, who employ thousands of smart people, can’t get it all right<\/a>.<\/p>\n

\"\"<\/a><\/p>\n

But for some reason, people either don’t know or prefer to ignore all this complexities, and whine and cry anyway.<\/p>\n

Recently, Stack Overflow – a well known collection of sites on a variety of technical subjects, has completed the migration to HTTPS everywhere. \u00a0These are also people with a lot of knowledge and expertise and with access to all the information. \u00a0Just have a look at their long way, which took not months, but years:\u00a0HTTPS on Stack Overflow: The End of a Long Road<\/a>.<\/p>\n

Today, we deployed HTTPS by default on Stack Overflow<\/a>. All traffic is now redirected to https:\/\/<\/code> and Google links will change over the next few weeks. The activation of this is quite literally flipping a switch (feature flag), but getting to that point has taken years of work. As of now, HTTPS is the default on all Q&A websites.<\/p>\n

We\u2019ve been rolling it out across the Stack Exchange network for the past 2 months<\/a>. Stack Overflow is the last site, and by far the largest. This is a huge milestone for us, but by no means the end. There\u2019s still more work to do, which we\u2019ll get to<\/a>. But the end is finally in sight, hooray!<\/p><\/blockquote>\n

So next time you are about to start crying about somebody not having feature X or Y, just give it a minute first. \u00a0Try to imagine what goes on on the other side. \u00a0You aren’t the only one with low budgets, pressing deadlines, insufficient knowledge, bad colleagues and horrible bosses…<\/p>\n\n","protected":false},"excerpt":{"rendered":"\n

Way too often I hear rants from random people (unfortunately, many of them are also from the IT industry, with the deep understanding of the underlying issues) complaining about why company X or product Y doesn’t implement this or that feature. \u00a0As someone who has been involved a dozens, if not hundreds, of projects, I … Continue reading HTTPS on Stack Overflow: The End of a Long Road<\/span><\/a><\/p>\n\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"HTTPS on Stack Overflow: The End of a Long Road #HTTP #SSL #security #WebDev #hosting #SysAdmin","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false,"_links_to":"","_links_to_target":""},"categories":[1,6,133,62,1334],"tags":[3225,1057,200,3413,3435,1330,2289],"keyring_services":[],"class_list":["post-27632","post","type-post","status-publish","format-standard","hentry","category-general","category-linux","category-sysadmin","category-technology","category-web-work","tag-http","tag-performance","tag-security","tag-ssl","tag-stackoverflow","tag-web-development","tag-web-hosting"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t