upgrade to https

[quozl]

accessing via http does not upgrade to https; it's okay to do so, but was that intended?

[srevinsaju]

accessing via http does not upgrade to https; it's okay to do so, but was that intended?

It is not intended. I just needed another opinion. Do you think I should redirect to https too? I was thinking if its okay to do that.

[quozl]

Here's what I think. For v4, it should upgrade to https;

• current release of Browse can follow the upgrade,
• an upgrade improves the information security situation for the end-user,
• it is convention,

Negative consequences and discussion;

• causes additional delay as the connection is negotiated again; we can control for that by making sure our links use https in Browse (done) and in other contexts,
• risk of certificate expiry; we can control for that with appropriate devops/sysadmin practices,
• increases energy consumption; but it is infrequently accessed.

[srevinsaju]

Here's what I think. For v4, it should upgrade to https;

• current release of Browse can follow the upgrade,
• an upgrade improves the information security situation for the end-user,
• it is convention,

Negative consequences and discussion;

• causes additional delay as the connection is negotiated again; we can control for that by making sure our links use https in Browse (done) and in other contexts,
• risk of certificate expiry; we can control for that with appropriate devops/sysadmin practices,
• increases energy consumption; but it is infrequently accessed.

Thats not a problem. I was wondering only if the website becomes inaccessible over https, trying to access over http also fails, because the server would constantly try to redirect to the secure version. I am not able to access torproject.org from here, it says ERR_SSL_PROTOCOL_ERROR, I cannot use http either, because it redirects to https always. I am completely fine with automatically redirecting to https, and I think its safer. We automatically renew our certificates when one-third of life is left for its expiry. So, its completely safe. And, regarding energy consumption, we can say, compared to the advantages, the disadvantage is negligible.

[quozl]

torproject.org may be blocked in your country. That's something that some countries do, in an abundance of caution to combat their imagined enemies. Like locking up kitchen knives.

[srevinsaju]

Ok, so I do not see anything blocking this. I will add a redirect to https right away. Thanks.

[srevinsaju]

Fixed. Please confirm.

[quozl]

Tested. Pass.