NY Times Urges News Sites To Embrace HTTPS/SSL… In An Article That Can't Be Read Via HTTPS
from the fail dept
Earlier this year, Techdirt announced that it had gone over to HTTPS as a default to better protect everyone’s privacy on this site. As the Freedom of the Press Foundation recently pointed out, it appears that we’re one of only three media properties that do so, along with Muckrock and the Intercept. A few others have SSL, but not by default. But most don’t even have HTTPS at all.
That’s why it was really interesting to see the NY Times publish a piece encouraging news organization to “embrace HTTPS,” detailing why it’s a good idea, and knocking down many of the excuses that some have used not to move forward. The piece is co-authored by Rajiv Pant, the CTO of the NY Times. Thus, you’d expect that the NY Times has SSL, right? Wrong. Hell, just try to visit that very article with the HTTPS version and you get:
Filed Under: https, media sites, ny times, privacy, rajiv pant, security, ssl
Companies: ny times
Comments on “NY Times Urges News Sites To Embrace HTTPS/SSL… In An Article That Can't Be Read Via HTTPS”
Americans Say They Want Privacy, but Act as if They Don’t
An interesting article in the New York Times: “Americans Say They Want Privacy, but Act as if They Don’t”, by Claire Cain Miller, Nov 12, 2014
Wow. Who knew?
Re: Americans Say They Want Privacy, but Act as if They Don’t
Obama really is like other Americans after all: Say one thing, do another.
Re: Americans Say They Want Privacy, but Act as if They Don’t
Most of the fellow Americans I know say we’ll never have privacy.
Re: Americans Say They Want Privacy, but Act as if They Don’t
And people continue to use Windows and Mac instead of Linux which is free software… And use Google Chrome… and Gmail… and then cry for privacy.
Implementation fails
As someone who audits sites for a living, I can’t tell you how sad it is out there. Most site managers / devs who roll out HTTPS make big mistakes.
I’ve seen it do so much harm it’s pathetic. And the bigger the site, the more likely there’s a lack of proper QA testing overall long before a site tries to go “all” HTTPS.
So this is a perfect example of that.
Re: Implementation fails
So this is a perfect example of that.
I don’t think so. I think this is them not doing it at all, and just saying everyone should. I assume the NYT will be doing it soon, but still odd…
Re: Re: Implementation fails
I disagree. If you’re not going to allow proper https functionality, the correct best practices functionality should have the https version automatically redirect via 301 server redirect to the non https version.
This ensures that anyone getting to the page will actually get a page.
Re: Re: Implementation fails
More than a year and a half later, I just checked; the article is still accessible at the HTTP link, but the HTTPS link still returns a “could not connect to server” error.
Looks like this was more a “non-binding opinion piece” than anything else…
This might have been rushed out. In the headline Urgers should be Urges and in the body encrouaging should be encouraging.
Do as I say not as I do, down on the farm we call that a hypocrite. Good to see techdirt on board. Hopefully there will be something more secure, open source, and readily available in the near future.
Is there an opposite for the phrase “preaching to the choir,” something like, “preaching by the heathens?”
Well, I guess it would just be “politician speaks,” if we’re just going for a phrase that covers the utterance of hypocritical statements.
Confusion
I am trying to figure out who lives in the glass house and should not be throwing stones; is it the NYT, the article author, every media organization that is not supporting https, or everybody else?
Urgers?
https://plus.google.com/+PierreFar/posts/7hu6HDob2jn & http://newstweek.com/overview refer.
Tracking and advertising
I suspect that the very biggest reason that the Times has not gotten there yet is revealed in this section:
That particular NY Times article has references to (at minimum) the following third-party resources:
Dynamic Yield, Google Analytics, New Relic, Web Trends, Adobe Typekit, Scorecard Research, Revsci, Chartbeat.
Mike, can you tell us how difficult it was for you guys to go HTTPS? This very TechDirt article is pulling even more third party resources: Bizo, ChartBeat, DoubleClick, Facebook Connect, Flattr, Google Analytics, Google+ Platform, Gravatar, Quantcast, Reddit, Scorecard Research, Twitter Button, Akamai (not sure that counts), Google APIs, Google Tag Services. And possibly others I cannot see.
Just how much of a challenge is it?
Re: Tracking and advertising
A very large one, apparently, since they still aren’t finished. The RSS feed, published through Google FeedBurner, still uses plaintext HTTP.
Re: Tracking and advertising
https://www.techdirt.com/articles/20140604/16164727464/techdirt-is-now-100-ssl.shtml
HTTPS sucks
I have an older browser and had been reading this site daily for more than three years. When it started using https, my computer started running hot, so I didn’t read as much. And something happened in the past month so that I can’t read this site at all unless I switch to a browser I hate.
What’s the point of https on a site like this? All I want to do is read the posts. What’s the point of encryption if I’m not sending credit-card information or other personal stuff? Encryption just for the sake of encryption just seems dumb.
Re: HTTPS sucks
The articles that I choose to read here at Techdirt, that is, the urls of the pages I visit at this site, ought not to be any business or concern of my ISP. Absent a secure connection, anyone in position to eavesdrop on the communication between my browser and Techdirt’s server would be in position to determine which articles I read here.
The liberty to read in freedom ought to be cherished. See, generally, Tattered Cover v City of Thorton (Colo. 2002).
Are we sure this is an actual NYT article or is it some Law enforcement data grab.
I’m a bit fuzzy on what use a news site needs ssl for.
Re: Re:
Well, suppose the news site was delivering “communist political propaganda”, as was the case in Lamont v Postmaster General (1965).
Would you want your neighbors, or your employer, or the government to find out you were reading “communist political propaganda”?