Subject: [Tools-discuss] HTTPS on tools.ietf.org

From: Richard Barnes <[email-masked]>
Date: Sat, 14 Nov 2015 16:57:10 -0500

(1) It's not on by default (no redirect from http:)

(2) It doesn't work: https://tools.ietf.org/wg/acme/

---

From: Warren Kumari <[email-masked]>
Date: Sat, 14 Nov 2015 17:36:53 -0500

> (2) It doesn't work: https://tools.ietf.org/wg/acme/

WFM, Chrome on IOS.
On a plane, about to take off, so cannot easily provide more useful debug.
W

-- 
I don't think the execution is relevant when it was obviously a bad idea in
the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair of
pants.
   ---maf

---

From: Bob Hinden <[email-masked]>
Date: Sat, 14 Nov 2015 19:58:15 -0300

> On Nov 14, 2015, at 7:36 PM, Warren Kumari <[email-masked]> wrote:
> 
> 
> 
> On Saturday, November 14, 2015, Richard Barnes <[email-masked]> wrote:

Worked for me from a lounge in the São Paulo airport using Safari.

Bob

---

From: "Paul Hoffman" <[email-masked]>
Date: Sat, 14 Nov 2015 15:02:33 -0800

> (1) It's not on by default (no redirect from http:)

That is an odd definition for "on by default". The lack of a forced 
redirect allows people who do not trust the certificate for the site to 
still read the material.

> (2) It doesn't work: https://tools.ietf.org/wg/acme/

Eeeewwww. Warren is right that this works in Chrome just fine. In 
Firefox/Mac, it fails partway through the page. Fortunately, the source 
of the failed page gives a dump.

Now the question is what on earth could be different between the two 
browsers that would cause such an error.

--Paul Hoffman

---

From: Richard Barnes <[email-masked]>
Date: Sat, 14 Nov 2015 21:05:38 -0500

> redirect allows people who do not trust the certificate for the site to

You're implying that it's still OK for people to be accessing the site over
plaintext.  Why do you hate security, Paul?  :)

I'm also not clear on why you think people would not trust the
certificate.  Starfield is not the most well-known CA, but they're run by
Amazon now, and if you don't trust Amazon, you have bigger things to worry
about than the tools pages.  And if there's an issue with the CA, that
seems fixable.

> Firefox/Mac, it fails partway through the page. Fortunately, the source of
> the failed page gives a dump.
>
> Tools-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tools-discuss
>
> Please report datatracker.ietf.org bugs at
> http://tools.ietf.org/tools/ietfdb
> Please report tools.ietf.org bugs at http://tools.ietf.org/tools/issues or
> send email to [email-masked]
>

---

From: Yaron Sheffer <[email-masked]>
Date: Sun, 15 Nov 2015 10:34:33 +0200

> browsers that would cause such an error.

Works for me (Firefox on Linux). But there's a 404 for 
https://tools.ietf.org/photo/salz-rich-th.jpg. Mr. Salz's photo 
thumbnail is only available on HTTP.

---

From: "Paul Hoffman" <[email-masked]>
Date: Sun, 15 Nov 2015 08:39:11 -0800

> thumbnail is only available on HTTP.

Now that's weird because I can see his smiling face and the location bar 
indicates it got it over https:. In fact, I checked that yesterday and 
also had no problem.

--Paul Hoffman

---

From: Tim Wicinski <[email-masked]>
Date: Sun, 15 Nov 2015 12:01:57 -0500

> indicates it got it over https:. In fact, I checked that yesterday and

on my El Capitain mac:

https://tools.ietf.org/photo/salz-rich-th.jpg

Firefox Aurora: 404

Chrome: Salz, top left justified

Safari: Salz, top center justified

Firefox 42.0: Salz, center justified, page and window

3/4 on my Salz-o-meter

tim

---

From: Richard Barnes <[email-masked]>
Date: Sun, 15 Nov 2015 12:10:56 -0500

+Henrik

Henrik: Any idea wtf is going on here?

---

From: Henrik Levkowetz <[email-masked]>
Date: Sun, 15 Nov 2015 18:22:51 +0100

Hi Richard,

> Henrik: Any idea wtf is going on here?

Yes.  A missing lib on one of the servers which I recently took into
operation.  Should be fixed now.

Best regards,

	Henrik

---

From: Richard Barnes <[email-masked]>
Date: Sun, 15 Nov 2015 12:36:24 -0500

> operation.  Should be fixed now.

Would you mind elaborating on what the problem was?  Curious what could
cause this failure mode.

---

From: Henrik Levkowetz <[email-masked]>
Date: Sun, 15 Nov 2015 18:59:28 +0100

Hi Richard,

> Would you mind elaborating on what the problem was?  Curious what could

I suspect the differences between browsers was not real, just an effect
of different people/browsers hitting different tools servers.  There are
currently 3 servers with A records (and unfortunately only 1 with an AAAA
record) for tools.ietf.org.

FWIW, the lib was python-genshi, which was quite non-obvious from the
error message; but I don't think that's really relevant to the apparent
failure mode.

Regards,

	Henrik

---

From: Michael Richardson <[email-masked]>
Date: Sun, 15 Nov 2015 17:39:21 -0500

Richard Barnes <[email-masked]> wrote:
    > You're implying that it's still OK for people to be accessing the site
    > over plaintext. Why do you hate security, Paul? :)

So, when I landed at IETF94, my tablet had somehow lost it's cmos clock.
It thought it was the year 2000 --- no certificates were valid.
All sorts of non-browser things didn't work... 

It was a very odd experience, and it took me some time to figure out what was
wrong.   Of course, I couldn't even google for an answer on that machine.

I think we have done it wrong with forced redirects to https.
I thought we had an in-protocol HTTP way to say, "and https is available"

-- 
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 15 Nov 2015 14:55:10 -0800

> I thought we had an in-protocol HTTP way to say, "and https is available"

Unfortunately, this has inferior security properties to HSTS.

-Ekr

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 16 Nov 2015 10:37:00 +0200

>
> On Sun, Nov 15, 2015 at 2:39 PM, Michael Richardson
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>
>     Richard Barnes <[email-masked]
>     <mailto:[email-masked]>> wrote:

I'm confused. The discussion is about clients that are accessing the 
site using plain HTTP, and so HSTS does not apply. Even the HSTS RFC 
(Sec. 7.2) recommends a redirect from HTTP to HTTPS in such cases.

Thanks,
	Yaron

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 16 Nov 2015 06:37:40 -0800

On Mon, Nov 16, 2015 at 12:37 AM, Yaron Sheffer <[email-masked]>
wrote:

> I'm confused. The discussion is about clients that are accessing the site
> using plain HTTP, and so HSTS does not apply. Even the HSTS RFC (Sec. 7.2)
> recommends a redirect from HTTP to HTTPS in such cases.
>

Yes, but if that is the only thing you do, it has weak security properties.

And if you have HSTS then you immediately run into the problem
that Michael identifies.

-Ekr

---

From: Ralph Giles <[email-masked]>
Date: Tue, 17 Nov 2015 14:44:02 -0800

> (2) It doesn't work: https://tools.ietf.org/wg/acme/

Saw another issue today.

https://www.rfc-editor.org/errata_search.php?rfc=4281 loads the
Noto Sans stylesheet from fonts.googleapis.com over http.

 -r

---

From: Richard Barnes <[email-masked]>
Date: Tue, 17 Nov 2015 14:45:27 -0800

Adding Heather, since I'm not sure that the tools team has any impact on
that page.

---

From: "Eggert, Lars" <[email-masked]>
Date: Wed, 18 Nov 2015 08:17:43 +0000

> Noto Sans stylesheet from fonts.googleapis.com over http.

I'm not surprised. The recent update to the RFC Editor site brought it from 90s web technology to 00s web technology, but no further.

Lars

---

From: "Heather Flanagan (RFC Series Editor)" <[email-masked]>
Date: Wed, 18 Nov 2015 16:04:21 -0800

Ack. Thanks for the bug report!

- -Heather

On 11/17/15 2:45 PM, Richard Barnes wrote:
> Adding Heather, since I'm not sure that the tools team has any
> impact on that page.
> 
> On Tue, Nov 17, 2015 at 2:44 PM, Ralph Giles <[email-masked] 
> <mailto:[email-masked]>> wrote:
> 
> Noto Sans stylesheet from fonts.googleapis.com 
> <http://fonts.googleapis.com> over http.
> 
> -r
> 
> -- Tools-discuss mailing list [email-masked]
> <mailto:[email-masked]> 
> Please report datatracker.ietf.org <http://datatracker.ietf.org> 
> bugs at http://tools.ietf.org/tools/ietfdb Please report
> tools.ietf.org <http://tools.ietf.org> bugs at 
> http://tools.ietf.org/tools/issues or send email to
> [email-masked] <mailto:[email-masked]>
> 
>