{"id":18065,"date":"2017-05-31T15:00:09","date_gmt":"2017-05-31T19:00:09","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=18065"},"modified":"2019-09-25T15:11:37","modified_gmt":"2019-09-25T19:11:37","slug":"https-on-stack-overflow","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2017\/05\/31\/https-on-stack-overflow\/","title":{"rendered":"HTTPS on Stack Overflow"},"content":{"rendered":"

Nick Craver<\/a> (via Joel Spolsky<\/a>, Hacker News<\/a>):<\/p>\n

We began thinking about deploying HTTPS on Stack Overflow back in 2013<\/a>. \nSo the obvious question: It’s 2017. What the hell took 4 years?<\/strong>\nThe same 2 reasons that delay almost any IT project: dependencies and priorities. \nLet’s be honest, the information on Stack Overflow isn’t as valuable (to secure) as most other data. \nWe’re not a bank, we’re not a hospital, we don’t handle credit card payments, and we even publish most of our database both by HTTP and via torrent once a quarter<\/a>. \nThat means from a security standpoint, it’s just not as high of a priority as it is in other situations. \nWe also had far more dependencies than most, a rather unique combination of some huge problem areas when deploying HTTPS.\nAs you’ll see later, some of the domain problems are also permanent.<\/p>\n

The biggest areas that caused us problems were:<\/p>\n