43

Many features of the browsers are starting to require HTTPS which means they don't work on Stack Overflow snippets. Please consider using HTTPS for Stack Overflow snippets.

I recently tried to answer a question about using the mic in HTML5/JavaScript. I tried to use a snippet but Chrome gave an error because the snippet was not HTTPS so I had to post the example offsite.

20
  • 88
    Better solution: use HTTPS for the entire site, including snippets. Jul 9, 2016 at 10:05
  • 4
    @JonasCz it's a work in progress nickcraver.com/blog/2013/04/23/…
    – jonrsharpe
    Jul 9, 2016 at 11:50
  • 4
    @jonrsharpe Is there a roadmap or similar for it? (Considering the post is 3 years old.) Is letsencrypt.org or a similar solution to automate fetching of certs per domain? .
    – kb.
    Jul 9, 2016 at 14:49
  • 6
    @kb We're going to be switching to the *.meta.stackexchange.com path scheme, and it's actively being worked on. We were waiting for the new CDN to go live before working on the structure change.
    – animuson StaffMod
    Jul 9, 2016 at 15:21
  • 4
    It's the year of <s>linux on the desktop<s> stack overflow respecting its users privacy!
    – PeeHaa
    Jul 9, 2016 at 20:07
  • 16
    This strikes me as rather contrary to the https promise. You'd expect the certificate to prove where the code comes from. On a site that accepts code from anybody without any proof of identity at all, isn't that a rather gross violation? Would you want to click the Run Snippet button when you have no real idea what it does and requires https to do something? Bad idea. Jul 10, 2016 at 7:55
  • 4
    What Hans said. Please don't do this. I fear there's a "ohmergerd HTTPS!!!11" fad going on at the moment where people are setting up HTTPS left right and centre without actually applying any thought to the question of whether they should be doing so. Because it's more "secure", right? Sigh. Jul 10, 2016 at 12:44
  • 23
    @HansPassant: I disagree. These are clearly marked as user-generated content. The only requirement you have to follow to get an HTTPS certificate is don't share your private key. Everything else is a matter of good (or bad) web design. So either you allow user-generated scripts to run, or you don't. But HTTPS is totally orthogonal to that decision.
    – Kevin
    Jul 11, 2016 at 2:41
  • 5
    Note that HTTPS-only features actually require the entire context to be secure: so not only must the snippets be delivered via HTTPS, but the page itself must be. (Without this restriction, the insecure remainder of the page could be MITMed to manipulate and/or eavesdrop on the "secure" snippet.) So you might as well incorporate @JonasCz's comment into your question: it's not just a "better solution", but rather, it's actually necessary for what you want.
    – ruakh
    Jul 11, 2016 at 3:45
  • 5
    StackOverflow has worked for years without executable snippets, and continues to work with plain code listings in any non-web language. Your example code should speak for itself, not just demonstrate to be working.
    – Bergi
    Jul 11, 2016 at 3:48
  • or just use cloudflare's SSL? with some performance degration ...
    – YOU
    Jul 11, 2016 at 4:45
  • 2
    FYI, Stack Snippets are already available over HTTPS; you get the HTTPS version just as long as the containing page is also loaded over HTTPS. This also means that its a little late to say we should all PANIC because user-created code is loaded over HTTPS. Jul 11, 2016 at 8:22
  • 2
    Can we stop discussion if it's secure or not? The whole FR is about features that are disabled by the client if it's not HTTPS.
    – Braiam
    Jul 11, 2016 at 13:31
  • 1
    @gman: No, I'm not against snippets (and not against HTTPS either), I'm arguing with "…so I had to post the example offsite", which isn't really necessary for a good answer with a good example. I think it's just a minor nuisance if the very few secure-only features don't work in snippets, the majority of answers on SO (with non-web languages) has the same problem, and the majority of web answers still works as snippets. Also I hope (it's not clear from the wording) you didn't post the example only offsite, as that would be against our good practices.
    – Bergi
    Jul 11, 2016 at 14:48
  • 1
    @LightnessRacesinOrbit: “I fear there's a […] fad going on at the moment where people are setting up HTTPS […] without actually applying any thought to the question of whether they should be doing so.” With very few exceptions, they should always be doing so. This is not one of those exceptions. “Because it's more "secure", right?” Yes, that’s why.
    – Ry- Mod
    Jul 12, 2016 at 9:26

0

You must log in to answer this question.

Browse other questions tagged .