OK! Uncle! Just let's do something! I don't care *that* much about it!

-Ross.
On Nov 6, 2013 11:34 PM, "Chad Fennell" <[log in to unmask]> wrote:

> On Wed, Nov 6, 2013 at 8:49 PM, Ross Singer <[log in to unmask]> wrote:
>
> > I guess I just don't see why http and https can't coexist.
> >
> >
> They can definitely coexist, but there is a corresponding maintenance cost
> and a slightly higher risk profile (e.g. session hijacking is still
> possible in a variety of mixed http/https configurations). I noticed a a
> pretty good, if a bit dated, run-down of the tradeoffs for various secure
> setups in Drupal
>
> http://drupalscout.com/knowledge-base/drupal-and-ssl-multiple-recipes-possible-solutions-https
> .
> Even if the solutions have somewhat changed, it does get at the idea of
> what some of the tradeoffs are between security, usability and maintenance.
>
> Just today, I noticed a security alert (https://drupal.org/node/2129381)
> for the Drupal 6 Secure Pages module where theoretically secured pages and
> forms could be transmitted in the clear. This is the module you'd most
> likely use to achieve a mixed http/https site in Drupal.
>
> I have personally tended to just put everything behind https because of the
> added work/modules/maintenance associated to running it along side of http
> (in Drupal, specifically), but I am a lazy person with access to free certs
> and ferncer servers.
>
> HTH
> --
> Chad Fennell
> Web Developer
> University of Minnesota Libraries
> (612) 626-4186
>