Re: Proposed patch for web site: update most links to HTTPS

[Adam Dinwoodie <adam at dinwoodie dot org>]

On Mon, Apr 25, 2016 at 08:49:18AM +0300, Andrey Repin wrote:
> Greetings, Brian Clifton!
> > -----Original Message-----
> > From: Andrey Repin
> >> Greetings, Brian Clifton!
> >
> >>> Hi folks,
> >
> >>> I have a proposed change for the web site. This patch (see below) will 
> >>> update most of the urls to HTTPS. In many cases there was a redirect; 
> >>> for those I captured the new canonical address.
> >
> >> Please no.
> 
> 
> > Can you please elaborate on why? I'm confused on why you prefer that Cygwin
> > links users to non-secure versions of pages? (which in many cases will be
> > redirected anyways).
> 
> I prefer it not forcing either, and only force secure connection, when absolutely
> necessary. I.e. when downloading the setup binary.
> 
> > Links which ONLY work on http *have not* been changed and there are no other
> > changes in this patch.
> 
> Secure connections been painfully slow and just annoying, when all you need is
> a quick glance at the documentation.
> All internal links must be relative to the domain and not force either
> protocol or the domain name.

Secure connections historically had a high overhead, sure, but that's
very rarely the case nowadays.  Certainly my experince of loading the
Cygwin web page is that there's no perceptible difference between the
http and https versions.  Adam Langley (a senior engineer at Google)
wrote an article back in 2010 about how TLS is now computationally
cheap[0]; it's only gotten cheaper since.

[0]: https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html

See also https://istlsfastyet.com/, which has a lot of discussion about
the impacts of TLS, but the short answer is "yes".

At the very least, the Cygwin website should be using protocol-
independent links, meaning users accessing the website using https
aren't switched to http when they click on a link (i.e. link to
"//cygwin.com/path/to/page" rather than "https://cygwin.com/..."; or
"http://cygwin.com/...";).  But I agree with Brian: the Cygwin website
should use https everywhere unless there's some good, specific reason
why it's a bad idea.  And "TLS is slow" hasn't been a good reason for
years.

Adam

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple