https?

[rosscdh]

Hi there, any reason why the codebase seems to default and be enforced via assert to http? and not https?

regards
Ross

[zimbatm]

I think the reason is historical instead of technical. The python's stdlib was not very good with http back in the days. Also 50% of that library could be removed if we used the "requests" library instead of the stdlib.

The SSL negociation does add ~200ms of latency to the connection. The signature system already protects you from most of the tampering cases so it's not such a risk to run over plain HTTP. YMMV

[rosscdh]

Agreed re requests! I wonder what the metric would be using it. When I get
a sec I'll look at submitting a PR!

Thanks for the feedback!

On Monday, 31 March 2014, zimbatm notifications@github.com wrote:

I think the reason is historical instead of technical. The python's stdlib
was not very good with http back in the days. Also 50% of that library
could be removed if we used the "requests" library instead of the stdlib.

The SSL negociation does add ~200ms of latency to the connection. The
signature system already protects you from most of the tampering cases so
it's not such a risk to run over plain HTTP. YMMV

Reply to this email directly or view it on GitHubhttps://github.com//issues/28#issuecomment-39072989
.

[rasky]

Given the "YMMV" comment above, I've created a pull-request as I intend to deploy pusher via HTTPS.

[iurisilvio]

This issue has a merged pull request and probably does not make sense anymore. The default is already HTTPS.

[zimbatm]

agreed