Following Many Patches, Linux 5.9 Finally Switching To HTTPS Links En Masse

[phoronix]

Phoronix: Following Many Patches, Linux 5.9 Finally Switching To HTTPS Links En Masse

On the mailing lists and browsing various Git "-next" repositories it's felt like "damn, there are a lot of patches about replacing HTTP links with HTTPS all of a sudden" inside the kernel sources and documentation. Indeed, for Linux 5.9 where applicable HTTP links are being replaced for HTTPS...

http://www.phoronix.com/scan.php?page=news_item&px=Linux-5.9-HTTPS-Links

[ed31337]

HTTPS feels like a sham... It breaks traditional caching proxy servers like Squid, yet somehow Cloudflare seems to be able to serve cached data for many sites, even using HTTPS... We're all being MITM attacked?

[sbivol]

HTTPS feels like a sham... It breaks traditional caching proxy servers like Squid,

Squid has always supported HTTPS. Yes, you need to configure a proxy in your browser, so it's not transparent anymore but this is easily done in an automated fashion.

yet somehow Cloudflare seems to be able to serve cached data for many sites, even using HTTPS... We're all being MITM attacked?

You're confusing a forward proxy with a reverse proxy. Cloudflare is a reverse proxy so it is the website owner who needs to configure the proxy, not the visitor. If anything, proxying through Cloudflare / Sucuri usually improves the security of a connection.

[Delgarde]

You're confusing a forward proxy with a reverse proxy. Cloudflare is a reverse proxy so it is the website owner who needs to configure the proxy, not the visitor. If anything, proxying through Cloudflare / Sucuri usually improves the security of a connection.

Yeah, what Cloudflare does is somewhere between proxying and hosting...

[macemoneta]

Wouldn't the HTTP documentation links be redirecting to HTTPS pretty much everywhere now anyway?

[easy]

Looks like Alexander Klimov from Russia
It is common for Russian ISP to modify traffic and replace or add own ads.
Currently they usually don't touch https traffic.

[sbivol]

Wouldn't the HTTP documentation links be redirecting to HTTPS pretty much everywhere now anyway?

It does, but the redirect to HTTPS happens after your cookies were sent, which means someone could have sniffed your authentication token and reused it to impersonate you.
Even without cookies, a man-in-the-middle can alter the redirect itself to make you visit an unexpected website. Like http://example.com redirecting to

https://exemple.com

which tricks you into logging in.

[Delgarde]

It does, but the redirect to HTTPS happens after your cookies were sent, which means someone could have sniffed your authentication token and reused it to impersonate you.
Even without cookies, a man-in-the-middle can alter the redirect itself to make you visit an unexpected website. Like http://example.com redirecting to

https://exemple.com

which tricks you into logging in.

Yep... if you're relying on HTTP to redirect you to HTTPS, you're trusting something that can be trivially MITMed to enable your security. Better than nothing, but not great.

[Guest]

HTTPS feels like a sham... It breaks traditional caching proxy servers like Squid, yet somehow Cloudflare seems to be able to serve cached data for many sites, even using HTTPS... We're all being MITM attacked?

True, here in India ISPs have started hijacking DNS and doing other shit. I'd rather have HTTPS with known certificates, and use DNSoTLS/DNSoHTTPS with DNSSEC.