Hacker News Reader

Comment by shitsbsbbsbs | Hacker News Reader

Fuck the NY times, they can't even be ass bothered to allow https.

We seemed to have lost the crypto wars.

The issue is not that they can't be bothered - the NYT has quite a sophisticated tech team. The problem is that they're very reliant on advertising and some ad networks don't support HTTPS. The mixed content rules then mean that the entire site cannot be served over HTTPS.

   http://open.blogs.nytimes.com/2014/11/13/embracing-https/

Unfortunately, this is one of those times when idealism hits business and business requirements win. HTTPS for ad networks increases their costs and (possibly) impacts revenue due to slower loading (this might not be an issue these days). But the real issue is, they have no motivation to do it. Even just one or two ad networks that don't bother then has a ripple effect preventing every website that uses them from going secure. And that in turn reduces the incentives for other sites to do it, because now their tech staff can't say "look, we're the odd ones out".

The mixed content rules have good reasons for existing, but in many ways they directly reduce the amount of traffic going over SSL. As is so often the case, the fact that web browsers flag partially secure sites as worse than totally unsecure sites in their UI really drags everything down.

The future is serving ads from your own domain, or subdomain. This isn't technically difficult.

Theoretically, it's easy as pie. However, the whole way internet advertising works is that a website gives a link to a third-party domain where the advertising is served from, and that way the advertising network knows exactly how many hits it's gotten from the site, and then pays that site based on that number of hits.

If the site served ads directly, then the advertiser would have no real way of verifying how many hits it got; they'd have to trust their client to give them the correct number, and they don't trust their customers that way.

Also, it's even more complicated: the advertising network lets different advertisers bid on each ad in real-time (which is part of why it's so slow to load ad-laden sites), so it's unknown what ad will pop up when you load a page.

Now of course, with ad-blockers becoming so commonly used, this system might be forced to change.

Sure, but unless you're pulling ad stock from a secure source, that just obfuscates the issue. Is your network path to the client meaningfully less secure than your network path to the ad server?

This is why ads must die. We've always been subjected to crap but now that they're a primary malware vector and source of update friction it's really obvious how user-hostile the whole industry is.

If you're so paranoid, use a proxy or Tor Browser if they allow it. But why would you care if someone knew you read an article from one of the most well known papers in the US?

That doesn't exactly make you stand out.

>Documents leaked by Edward Snowden reveal programs to track targets, spread information and manipulate online debates

http://www.theguardian.com/uk-news/2014/jul/14/gchq-tools-ma...

This is about trusting what you read on the NYT, not trusting the site.

In both cases, caution is advised :)

HTTPS can do more then hide the exact content you're looking at. Given the domain name and size of reply(https) the exact content can be estimated. But the user will be sure to be reading the contents without modification.

It's not at all about hiding something.

It's your civic responsibility to encrypt everything you can. Democracy everywhere is counting on it. We need to make it as ubiquitous and as difficult as possible to conduct mass surveillance.

The world is depending on all of us techies to get this right.

Reply on news.ycombinator.com