<story><title>HTTPS on Stack Overflow: The End of a Long Road</title><url>https://nickcraver.com/blog/2017/05/22/https-on-stack-overflow/</url></story><parent_chain><item><author>y4mi</author><text>Some people don&amp;#x27;t spy on their customers and don&amp;#x27;t have these kinds of information available for analyses&lt;p&gt;They&amp;#x27;re admittedly few though and their moral high ground is debatable considering that there are self hosted FOSS alternatives around nowadays</text></item><item><author>mattmanser</author><text>I know it&amp;#x27;s hindsight and all that, but why didn&amp;#x27;t you check your website analytics first? Seems a fairly massive assumption that should have taken 10 seconds to check.</text></item><item><author>mrunkel</author><text>At $previous_job we once turned on HTTPS for our entire customer website and online store, only to have our customer support team be bombarded by phone calls claiming that our &amp;quot;website was down.&amp;quot;&lt;p&gt;After much teeth gnashing and research, we determined that a large segment of our user base was still using WinXP and the encryption protocols we offered weren&amp;#x27;t available to them.&lt;p&gt;We didn&amp;#x27;t think this would be a problem because the current version of the software wasn&amp;#x27;t compatible with WinXP any longer.&lt;p&gt;There was some debate internally whether the better fix was to including the legacy encryption protocols or just leave the HTTP version of the site running and use Strict-Transport-Security to move capable browsers to HTTPS.&lt;p&gt;In the end we had to include the legacy protocols so those customers could use our online store.</text></item></parent_chain><comment><author>beefsack</author><text>I completely understand where you&amp;#x27;re coming from, but the User-Agent string is included in regular HTTP requests and you don&amp;#x27;t need to resort to overbearing client-side analytics to aggregate it; it&amp;#x27;s right there in the access logs on the server.</text></comment>
<story><title>HTTPS on Stack Overflow: The End of a Long Road</title><url>https://nickcraver.com/blog/2017/05/22/https-on-stack-overflow/</url></story><parent_chain><item><author>y4mi</author><text>Some people don&amp;#x27;t spy on their customers and don&amp;#x27;t have these kinds of information available for analyses&lt;p&gt;They&amp;#x27;re admittedly few though and their moral high ground is debatable considering that there are self hosted FOSS alternatives around nowadays</text></item><item><author>mattmanser</author><text>I know it&amp;#x27;s hindsight and all that, but why didn&amp;#x27;t you check your website analytics first? Seems a fairly massive assumption that should have taken 10 seconds to check.</text></item><item><author>mrunkel</author><text>At $previous_job we once turned on HTTPS for our entire customer website and online store, only to have our customer support team be bombarded by phone calls claiming that our &amp;quot;website was down.&amp;quot;&lt;p&gt;After much teeth gnashing and research, we determined that a large segment of our user base was still using WinXP and the encryption protocols we offered weren&amp;#x27;t available to them.&lt;p&gt;We didn&amp;#x27;t think this would be a problem because the current version of the software wasn&amp;#x27;t compatible with WinXP any longer.&lt;p&gt;There was some debate internally whether the better fix was to including the legacy encryption protocols or just leave the HTTP version of the site running and use Strict-Transport-Security to move capable browsers to HTTPS.&lt;p&gt;In the end we had to include the legacy protocols so those customers could use our online store.</text></item></parent_chain><comment><author>HalfwayToDice</author><text>Calling aggregate anonymous analytics &amp;quot;spying on your customers&amp;quot; is absurd nonsense.</text></comment>