Hacker News Reader

Comment by agwa | Hacker News Reader

Actually, they probably don't intend for people to use www.akamai.com with HTTPS. If you add an override for the bad cert, you end up getting redirected to a non-HTTPS site anyways. I don't see anything like a login link on www.akamai.com so this is probably OK. (Of course it would be nice if everything were HTTPS...)

View on HN

The a248 cert is used for all SSL requests for properties delivered over Akamai's non-ssl network. It's useful to be able to serve SSL requests even if the cert doesn't have a the hostname in question on it.

Regarding the cipher sneering below: Akamai's default settings probably err on the side of acceptance. Not all of their customers are Amazon.coms - mom & pop ecommerce are unlikely to do anything that would cause a visitor's SSL connection to fail, and changing the ciphers back to the high-acceptance settings would increase their cost of implementation per cert. I'm guessing they manage more than a few of those.

> Of course it would be nice if everything were HTTPS...

Nice try, Certificate Authorities!

>> Of course it would be nice if everything were HTTPS...

> Nice try, Certificate Authorities!

Nice try, NSA.

>>> Of course it would be nice if everything were HTTPS...

>> Nice try, Certificate Authorities!

> Nice try, NSA.

Nice try, HN.

Nice try... wait, this is not on reddit. Let's stop the joke now.

It would be nice if everything were HTTPS, but the default behaviour for a self-signed cert was "accept it the first time, but don't show the lock icon or anything, and then warn if it changes" - ie self-signed HTTPS is the new HTTP

Reply on news.ycombinator.com