Hacker News Reader

Comment by fiatmoney | Hacker News Reader

If it's DDOS (or even if it's not), what insignificance. Does anyone think anything important runs off of their public website?

https://xkcd.com/932/

View on HN

Xkcd, ironically, has an even more common hiccup with domains. Notice the https:// . This makes every style and background stuff break on browsers that enforce HTTPS consistency because these are served from "imgs" subdomain, which doesn't have SSL and/or has a hard coded http:// in the template.

I'm curious, why the https? Muscle memory?

I bet the answer is HTTPS Everywhere. The only bad thing about it is the mixed content blocking, but I still think everyone should use it.

There was a link to schneier's blog here recently and a few people mentioned that his cert was expired. I am willing to be that everyone who saw the cert warning were httpseverywhere users.

https://www.eff.org/https-everywhere

Perhaps he's using HTTPS Everywhere.

I didn't post it, but I assume s/he was cutting and pasting from their URL bar, and they use HTTPS Everywhere or similar to encourage their browser to always prefer HTTPS connections (which xkcd provides, but to my ongoing annoyance, Amazon does not).

https://www.eff.org/https-everywhere

One could argue this should be a built-in option these days....

Unfortunately, xkcd (along with NYTimes and probably others) link to CSS/JS resources at http:// URLs, which defeats the security of HTTPS. The next version of Firefox will block mixed content in these cases, and being on the alpha channel, I've had to disable HTTPS Everywhere for these sites.

Reply on news.ycombinator.com