Heads up: nih.gov, etc. moving to https by default

[terrorist96]

https://www.ncbi.nlm.nih.gov/home/bulletins/https-tests.shtml

Could this have any effects on the https everywhere rulesets?

Seems like this will eventually affect all Federal sites:

https://www.whitehouse.gov/blog/2015/06/08/https-everywhere-government

Per the issuance of this Memorandum, all publicly accessible Federal websites must meet the HTTPS-Only Standard by December 31st of 2016.

[numismatika]

It could have, if they enable HSTS and get pre-seeded in firefox&Chrome all related rules could be removed.

[jeremyn]

Some thoughts:

The first link says only that:

To improve security and privacy, and by Federal government mandate, NCBI is moving all of its web sites and services, including web APIs, to HTTPS only by September 30, 2016. This change will provide you with greatly increased privacy and security on the NCBI site.

So this is just referring to a subgroup of NIH, not all of NIH. For reference: there are two rulesets for NIH: National-Institutes-of-Health.xml and NIH.gov-falsemixed.xml.

Issue #5047 is also about .gov.

It's great the (U.S.) government is making this initiative, but it's super unlikely that every single .gov site will be HTTPS by the end of 2016. Even if they are, they'll still have various mixed content issues etc. Take a look at #5265 (comment) and understand that some of those subdomains are probably managed by some small group of scientists with not enough funding. It'll take a while.

Also it's my understanding, though I don't have a reference, that the president doesn't have authority over Federal .gov sites managed by Congress and the Supreme Court due to separation of powers, so the White House memo requiring HTTPS has no force over them. Issue #2596 discusses senate.gov and describes how https://www.senate.gov weirdly returns a simple page advising the user to use the HTTP version of the site. There are also state .gov sites like https://www.nysenate.gov and I doubt the president's memo affects those either.

Anyway I don't think there's a specific takeaway or to-do here, other than that we will probably be able to add more .gov rulesets going forward.

[jeremyn]

It looks like the discussion is done so I'm closing this issue. Thanks for starting the discussion, @terrorist96 .