Thanks for creating this! Just a note: It would be nice if the page at semver.org served over HTTPS.
Thanks.
Originally created by @jprystowsky on GitHub (Mar 19, 2014).
Original GitHub issue: https://github.com/semver/semver/issues/186
Thanks for creating this! Just a note: It would be nice if the page at semver.org served over HTTPS.
Thanks.
Out of curiosity, what is the benefit of using HTTPS for a purely static website?
<!-- gh-comment-id:38162191 -->
@crazedsanity commented on GitHub (Mar 20, 2014):
Out of curiosity, what is the benefit of using HTTPS for a purely static website?
Hides traffic from man in the middle. If the site uses https the owners of the transitional servers can't read traffic. This does not mutter much for site like http://semver.org/ that hasn't got any private parts.
https prohibit change of the traffic. Some places with free wifi does evil thing — they add there own advertisements to every site that users http. So to be sure that the users gets the correct content a site must use https and only https.
<!-- gh-comment-id:38163244 -->
@bessarabov commented on GitHub (Mar 20, 2014):
@crazedsanity Every site should use https =)
https does 2 things:
- Hides traffic from man in the middle. If the site uses https the owners of the transitional servers can't read traffic. This does not mutter much for site like http://semver.org/ that hasn't got any private parts.
- https prohibit change of the traffic. Some places with free wifi does evil thing — they add there own advertisements to every site that users http. So to be sure that the users gets the correct content a site must use https and only https.
@Haacked Duly created (mojombo/semver.org#86). Sorry, I didn't see that repo before.
@crazedsanity as @bessarabov said. On the face of it, semver doesn't expose any vulnerable data and so "doesn't need https;" but, https > http for the security of web users in general. (Thinking out loud about the NSA revelations, etc.) I try to encourage security by default when I see the opportunity.
<!-- gh-comment-id:38177504 -->
@jprystowsky commented on GitHub (Mar 20, 2014):
@Haacked Duly created (mojombo/semver.org#86). Sorry, I didn't see that repo before.
@crazedsanity as @bessarabov said. On the face of it, semver doesn't expose any vulnerable data and so "doesn't need https;" but, https > http for the security of web users in general. (Thinking out loud about the NSA revelations, etc.) I try to encourage security by default when I see the opportunity.
<!-- gh-comment-id:38178302 -->
@rlidwka commented on GitHub (Mar 20, 2014):
> Hides traffic from man in the middle. If the site uses https the owners of the transitional servers can't read traffic.
Not really.
http://files.cloudprivacy.net/ssl-mitm.pdf
@rlidwka True, but, it's better than nothing. If TLS were the norm then it would become at least more costly and difficult to perform most attacks.
<!-- gh-comment-id:38225542 -->
@jprystowsky commented on GitHub (Mar 20, 2014):
@rlidwka True, but, it's better than nothing. If TLS were the norm then it would become at least more costly and difficult to perform most attacks.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @jprystowsky on GitHub (Mar 19, 2014).
Original GitHub issue: https://github.com/semver/semver/issues/186
Thanks for creating this! Just a note: It would be nice if the page at semver.org served over HTTPS.
Thanks.
@haacked commented on GitHub (Mar 19, 2014):
Mind logging an issue on that repo? https://github.com/mojombo/semver.org
@crazedsanity commented on GitHub (Mar 20, 2014):
Out of curiosity, what is the benefit of using HTTPS for a purely static website?
@bessarabov commented on GitHub (Mar 20, 2014):
@crazedsanity Every site should use https =)
https does 2 things:
@jprystowsky commented on GitHub (Mar 20, 2014):
@Haacked Duly created (mojombo/semver.org#86). Sorry, I didn't see that repo before.
@crazedsanity as @bessarabov said. On the face of it, semver doesn't expose any vulnerable data and so "doesn't need https;" but, https > http for the security of web users in general. (Thinking out loud about the NSA revelations, etc.) I try to encourage security by default when I see the opportunity.
@rlidwka commented on GitHub (Mar 20, 2014):
Not really.
http://files.cloudprivacy.net/ssl-mitm.pdf
@jprystowsky commented on GitHub (Mar 20, 2014):
@rlidwka True, but, it's better than nothing. If TLS were the norm then it would become at least more costly and difficult to perform most attacks.