bug#37348: [PATCH] hydra: berlin: Redirect HTTP to HTTPS by default.

[Tobias Geerinckx-Rice via Bug reports for GNU Guix <bug-guix@gnu.org>]

[-- Attachment #1: Type: text/plain, Size: 1208 bytes --]

Damn,

Tobias Geerinckx-Rice via Bug reports for GNU Guix 写道：
> This is a conservative patch: it only redirects guix.gnu.org and
> issues.guix.gnu.org, the most (potential-)user-facing sites, to 
> HTTPS.
>
> CI should probably remain reachable over HTTP indefinitely.
>
> Subprojects like GWL, friends like Bootstrappable, and anything 
> else
> retain ‘user choice’, until they opt in.

The current situation is actually more horked than that:

  ~ λ curl -LI https://gnu.org
  HTTP/1.1 301 Moved Permanently
  […]
  Strict-Transport-Security: max-age=63072000; includeSubDomains; 
  preload

This is a great security policy!  It also announces to the modern 
world that *all* HTTP connections to *any* subdomain of gnu.org 
should be silently upgraded to HTTPS.

If your UA honours this header and has ever visited gnu.org, 
visiting http://ci.guix.gnu.org should not be possible.  It will 
immediately upgrade to HTTPS.  Certificate errors can no longer be 
bypassed.  guix.gnu.org cannot relax this policy.

Now, for some reason, current Firefox doesn't seem to do any of 
this (compatibility?) but it may only be a matter of time.

Kind regards,

T G-R

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 247 bytes --]