On Mon, Apr 25, 2016 at 08:49:18AM +0300, Andrey Repin wrote: > Greetings, Brian Clifton! > > -----Original Message----- > > From: Andrey Repin > >> Greetings, Brian Clifton! > > > >>> Hi folks, > > > >>> I have a proposed change for the web site. This patch (see below) will > >>> update most of the urls to HTTPS. In many cases there was a redirect; > >>> for those I captured the new canonical address. > > > >> Please no. > > > > Can you please elaborate on why? I'm confused on why you prefer that Cygwin > > links users to non-secure versions of pages? (which in many cases will be > > redirected anyways). > > I prefer it not forcing either, and only force secure connection, when > absolutely > necessary. I.e. when downloading the setup binary. > > > Links which ONLY work on http *have not* been changed and there are no other > > changes in this patch. > > Secure connections been painfully slow and just annoying, when all you need is > a quick glance at the documentation. > All internal links must be relative to the domain and not force either > protocol or the domain name.
Secure connections historically had a high overhead, sure, but that's very rarely the case nowadays. Certainly my experince of loading the Cygwin web page is that there's no perceptible difference between the http and https versions. Adam Langley (a senior engineer at Google) wrote an article back in 2010 about how TLS is now computationally cheap[0]; it's only gotten cheaper since. [0]: https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html See also https://istlsfastyet.com/, which has a lot of discussion about the impacts of TLS, but the short answer is "yes". At the very least, the Cygwin website should be using protocol- independent links, meaning users accessing the website using https aren't switched to http when they click on a link (i.e. link to "//cygwin.com/path/to/page" rather than "https://cygwin.com/..."; or "http://cygwin.com/...";). But I agree with Brian: the Cygwin website should use https everywhere unless there's some good, specific reason why it's a bad idea. And "TLS is slow" hasn't been a good reason for years. Adam -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
