NSA broke it already


On Mon, Nov 4, 2013 at 1:42 PM, William Denton <[log in to unmask]> wrote:

> I think it's time we made everything on code4lib.org use HTTPS by default
> and redirect people to HTTPS from HTTP when needed.  (Right now there's an
> outdated self-signed SSL certificate on the site, so someone took a stab at
> this earlier, but it's time to do it right.)
>
> StartCom gives free SSL certs [0], and there are lots of places that sell
> them for prices that seem to run over $100 per year (which seems ridiculous
> to me, but maybe there's a good reason).
>
> I don't know which is the best way to get a cert for a site like this, but
> if people agree this is the right thing to do, perhaps someone with some
> expertise could work with the Oregon State hosts?
>
> More broadly, I think everyone should be using HTTPS everywhere (and HTTPS
> Everywhere, the browser extension).  Are any of you implementing HTTPS on
> your institution's sites, and moving to it as default?  It's one of those
> slightly finicky things that on the surface isn't necessary (why bother
> with a library's opening hours or address?) but deeper down is, because
> everyone should be able to browse the web without being monitored.
>
> Bill
>
> [0] https://cert.startcom.org/
>
> --
> William Denton
> Toronto, Canada
> http://www.miskatonic.org/
>