11

When editing a post and clicking on the chain image to add a new hyperlink, a popup appears to enter the link, with a selected default of http://

This may be insignifiant but at the same time this is not a big change either: could it be possible to provide a default of https:// in this popup instead of http://?

This may have a benefit of fostering more and more HTTPS links since the world is moving towards that, and browsers will soon label each HTTP connection as "insecure". Also, often the same resource is available today through both HTTP and HTTPS protocols, so better to nudge people towards the secure version.

6
  • One possible argument against this is that requesting an HTTP-only site via HTTPS will usually return an error, but requesting an HTTPS-only site via HTTP will usually redirect seamlessly. May 21, 2018 at 17:30
  • @plasticinsect "usually" because today we are still "migrating" towards HTTPS. But there are many works under way to just make HTTP a thing of the past. See HSTS/HSTS preloading for example, or the future explicit labeling as "insecure" of all HTTP accesses by browsers. May 21, 2018 at 17:33
  • I know efforts are being made to move the web away from HTTP and towards 100% HTTPS, but my point is that this is not happened yet. I am against implementing a change that will break things right now. The fact that we are moving towards a world in which this change would be useful is not enough, IMHO. May 21, 2018 at 19:32
  • @plasticinsect please explain how it "breaks" anything? It is just a default value, anyone is free to change it. Also since most of the time you just copy and paste a link, and since this default is selected, when you do the paste this default is completely overwritten by what you just pasted. May 21, 2018 at 19:54
  • To answer your question about what it would break: With this change, if a user absent-mindedly types in a domain that does not support HTTPS, using the (proposed) default scheme, it will lead to a broken URL. Will this happen often? Probably not. But the total number of broken links that will happen with the change is likely to be be larger than the total number of broken links without the change. May 21, 2018 at 20:22
  • @plasticinsect Do you think many users type URLs by hand, character by character? I really do not think so... Also you suppose it would break but why? The site could exist as HTTPS too, even if the user does not know it. The opposite is true too: you can input an HTTP:// link and it will not work because the site ONLY listens on 443... So the http:// default also breaks stuff... A default is just the default... it points in some direction, users are free to go in whatever direction they want. May 21, 2018 at 20:42

1 Answer 1

0

There are still some sites out there which don't have proper HTTPS set up, or even worse, a proper redirect back to HTTP where they don't have it set up. On the contrast, it is standard practice to enforce a redirect to HTTPS should you only wish to offer traffic over that, and an HTTP link will normally be okay*.

In such, making HTTPS the default may add a lot of unnecessary confusion for users who hyperlink in this fashion.

*: Someone who has done this in the last three years can speak better to this than I can; last time I did this was in 2013!

5
  • It is only a default, so anyone is free to just replace it with whatever it needs, including http://. Redirection from HTTP to HTTPS still leaves one vulnerable to MITM, hence HSTS and HSTS preloading. So it is better to influence people to just do HTTPS everywhere with no HTTP instead of saying to do a redirection from HTTP to HTTPS. May 21, 2018 at 17:31
  • Yes, but 100% of the time I've ever wanted to embed a link, I've just copied the link from the URL I want to use and pasted into Stack Overflow. I totally get that the intention is to get everyone moving over to HTTPS, but it's not really our fault/place that not everyone has it set up. Those that do would have some kind of fallback or system to direct users to the HTTPS side of their site.
    – Makoto
    May 21, 2018 at 17:37
  • I am under the opinion that the redirect must die too (but this is orthogonal to what SE does), in the sense that nothing should listen on :80 anymore. When you copy the link, you may take the extra 2 seconds to check if it works under HTTPS too and then embed this version and not the HTTP one even if it works. That way you have a better knowledge base and you are better future-proof (if we believe HTTP will go extinct, hence no more redirection either) May 21, 2018 at 17:41
  • My point is more concise. If someone links to a Wordpress site without any HTTPS enabled, then setting the default has accomplished less. Letting the end user copy the link as it is in its natural environment is preferable since this guarantees that the URL they put in is the URL they want without us having to worry or fiddle with their redirect ecosystem. I suppose I'm using this to say I'm unconvinced that this is a necessary feature.
    – Makoto
    May 21, 2018 at 17:42
  • 1
    If you copy a link, you have the scheme in it, so it overrides the default in any case (which is selected so as soon as you type a character it gets deleted). So whatever the default is does not change anything in that case. It is not a necessary feature, it is just a nice future-proof and future-looking change. May 21, 2018 at 17:45

Not the answer you're looking for? Browse other questions tagged .