Hacker News Reader

Comment by that_lurker | Hacker News Reader

And still no https

Huh? It works for me, with a 301 redirect. Truncated output:

    $ curl -Lv http://bbc.co.uk
    > GET / HTTP/1.1
    > Host: bbc.co.uk
    > User-Agent: curl/7.56.1
    > Accept: */*
    > 
    < HTTP/1.1 301 Moved Permanently
    < Location: http://www.bbc.co.uk/
    < 
    > GET / HTTP/1.1
    > Host: www.bbc.co.uk
    > User-Agent: curl/7.56.1
    > Accept: */*
    > 
    < HTTP/1.1 301 Moved Permanently
    < Location: https://www.bbc.co.uk/
    < 
    > GET / HTTP/2
    > Host: www.bbc.co.uk
    > User-Agent: curl/7.56.1
    > Accept: */*
    > 
    < HTTP/2 200 
    < content-type: text/html; charset=utf-8
    < content-length: 270866

With a site like BBC News integrating with lots of different internal services, it can be more difficult than it seems on the face it to enable HTTPs, but I'm sure it's coming soon, other BBC sites have enabled HTTPs.

I keep reading that - but I just don't buy it - you can offload SSL to edge devices - why do the servers even need to care?

Good write-up here: http://www.bbc.co.uk/blogs/internet/entries/f6f50d1f-a879-49...

TL;DR Chrome lit a fire on their collective arses. They’d never have switched otherwise.

> Earlier in 2016, the Chromium development team decided to implement a change to Google Chrome, preventing access to certain in-browser features on ‘insecure’ (non-HTTPS) web pages. In practice, this meant that key features of certain products, such as the location-finding feature within the Homepage, Travel News and Weather sites, would stop working if we didn’t enable HTTPS for those services.

Thanks Obama, I mean Google.

There's actually not much to stop the rollout of HTTPS on the BBC News site now. In fact, the major hurdles were overcome nearly a year ago. The final hurdle is convincing the product and editorial teams that enabling HTTPS is more important than whatever features they want to build.

Ah - fair enough. I made some assumptions based on some of the hurdles seen by some of the more recent moves to HTTPs on smaller BBC sites, not of any real knowledge of the current situation.

(FWIW, your article from Dec 2016 played a part in me joining the BBC recently as a developer, and I know of at least one other developer currently at the BBC who also was motivated to apply after your article :))

There are hurdles for sure. I guess I'm just publicly venting my frustration at having HTTPS on one of the world's biggest news websites be under-prioritised for years and years :)

I'm really glad to hear that btw. I wish I could have stuck around for longer!

You can read BBC in countries that blocks it via an iframe proxy provider. Maybe that's why there is no https. But they can make http not redirect to https and still have https

Reply on news.ycombinator.com