 |
 |
Thank you, Andrew, for answering the question. What Stuart wrote, however, is misleading: On Tue, Aug 18, 2015 at 02:59:37PM +1200, Stuart A. Yeates wrote: > On Tue, Aug 18, 2015 at 10:08 AM, Andrew Anderson <[log in to unmask]> wrote: > > > That said, there is a big push recently for dropping non-SSL connections > > in general (going so far as to call the protocol relative URIs an > > anti-pattern), so is it really worth all the potential pain and suffering > > to make your links scheme-agnostic, when maybe it would be a better > > investment in time to switch them all to SSL instead? This dovetails > > nicely with some of the discussions I have had recently with electronic > > services librarians about how to protect patron privacy in an online world > > by using SSL as an arrow in that quiver. > > > > Dropping non-SSL connections is almost certainly a mistake for two classes > reasons: > (i) a number of very widely used tools and standards (OAI-PMH, web > cacheing, monitoring, etc.) are HTTP-only Let me give you a counter example: Of 4810 OAI-PMH providers currently known to BASE <https://base-search.net>, 147 use a HTTPS base URL. Of the 3632 OAI-PMH sources BASE actively harvests at this time, 107 use HTTPS. > (ii) assumptions about the proportion of our users who have access > to a certain level tech (i.e. HTTP vs HTTPS) systematically disadvantages > already disadvantaged groups of users, perpetuating the kind of > social ills that libraries are traditional held to be the cure of. I fail to see how continuing to use insecure, obsolete software is serving social justice. Excellent cryptographic software is available freely and openly. Cheers, Chris -- Christian Pietsch · http://purl.org/net/pietsch LibTec (Library Technology and Knowledge Management) department of Bielefeld University Library, Bielefeld, Germany