This is the mail archive of the
cygwin
mailing list for the Cygwin project.
Re: Proposed patch for web site: update most links to HTTPS
- From: Adam Dinwoodie <adam at dinwoodie dot org>
- To: cygwin at cygwin dot com
- Date: Mon, 25 Apr 2016 13:43:32 +0100
- Subject: Re: Proposed patch for web site: update most links to HTTPS
- Authentication-results: sourceware.org; auth=none
- References: <BL2PR03MB228A4FE7B2CCA51E5FF5163DF610 at BL2PR03MB228 dot namprd03 dot prod dot outlook dot com> <1074467721 dot 20160425030008 at yandex dot ru> <BL2PR03MB22817533DCF96CD385BD883DF620 at BL2PR03MB228 dot namprd03 dot prod dot outlook dot com> <48360918 dot 20160425084918 at yandex dot ru>
On Mon, Apr 25, 2016 at 08:49:18AM +0300, Andrey Repin wrote:
> Greetings, Brian Clifton!
> > -----Original Message-----
> > From: Andrey Repin
> >> Greetings, Brian Clifton!
> >
> >>> Hi folks,
> >
> >>> I have a proposed change for the web site. This patch (see below) will
> >>> update most of the urls to HTTPS. In many cases there was a redirect;
> >>> for those I captured the new canonical address.
> >
> >> Please no.
>
>
> > Can you please elaborate on why? I'm confused on why you prefer that Cygwin
> > links users to non-secure versions of pages? (which in many cases will be
> > redirected anyways).
>
> I prefer it not forcing either, and only force secure connection, when absolutely
> necessary. I.e. when downloading the setup binary.
>
> > Links which ONLY work on http *have not* been changed and there are no other
> > changes in this patch.
>
> Secure connections been painfully slow and just annoying, when all you need is
> a quick glance at the documentation.
> All internal links must be relative to the domain and not force either
> protocol or the domain name.
Secure connections historically had a high overhead, sure, but that's
very rarely the case nowadays. Certainly my experince of loading the
Cygwin web page is that there's no perceptible difference between the
http and https versions. Adam Langley (a senior engineer at Google)
wrote an article back in 2010 about how TLS is now computationally
cheap[0]; it's only gotten cheaper since.
[0]: https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html
See also https://istlsfastyet.com/, which has a lot of discussion about
the impacts of TLS, but the short answer is "yes".
At the very least, the Cygwin website should be using protocol-
independent links, meaning users accessing the website using https
aren't switched to http when they click on a link (i.e. link to
"//cygwin.com/path/to/page" rather than "https://cygwin.com/..." or
"http://cygwin.com/..."). But I agree with Brian: the Cygwin website
should use https everywhere unless there's some good, specific reason
why it's a bad idea. And "TLS is slow" hasn't been a good reason for
years.
Adam
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple