<story><title>Mozilla HTTP Observatory</title><url>https://observatory.mozilla.org/</url></story><parent_chain></parent_chain><comment><author>marginalia_nu</author><text>I have really mixed feelings about deprecating HTTP for HTTPS. There are a lot of websites that are never going to migrate, websites with quality content. There&amp;#x27;s also a lot of clients that are never going to support HTTPS. There&amp;#x27;s nothing wrong with them otherwise, the hardware is still good, but they can&amp;#x27;t be used anymore and it&amp;#x27;s not the owners choice to decide, but a few big tech companies pushing this change.&lt;p&gt;Even if we do care about these nefarious men in the middle, the elephant in the room is that a large part of the encrypted traffic these days go through major CDNs, and for them to actually pages and and route requests and be anything more than a glorified NAT, they need to inspect what&amp;#x27;s being sent, and keep track of who is sending it. Even if they totally pinky swear they aren&amp;#x27;t doing anything nefarious with their position of being able to inspect and analyze a huge portion of the Internet&amp;#x27;s traffic, and even if we believe them, that can change.&lt;p&gt;Remember SourceForge? Remember when they were the heroes of open source, the go-to host for source code and binaries? Remember when they were bought up and subsequently were caught with their fingers in the cookie jar bundling malware in said open source packages?&lt;p&gt;All I&amp;#x27;m saying is that there sure is a lot of eggs in that basket. Is a lot easier to lean on one or two CDN operators than it is to lean on every ISP in the country.</text></comment>
<story><title>Mozilla HTTP Observatory</title><url>https://observatory.mozilla.org/</url></story><parent_chain></parent_chain><comment><author>weinzierl</author><text>It is an excellent tool. For a bit more background I found [1] (from 2016) quite insightful.&lt;p&gt;In addition here are a few notes that I collected using it, no criticism - just (hopefully) constructive feedback:&lt;p&gt;- The &lt;i&gt;SSH&lt;/i&gt; (H not L) Observatory part seems to be broken for a long time (months at least). Not exactly sure what it was supposed to do anyway and how useful it would have been.&lt;p&gt;- I find the nomenclature for the &lt;i&gt;Compatibility Level&lt;/i&gt; a bit unfortunate. As far as I understand, the highly secure and practically useful configurations recommended by Mozilla and elsewhere, all end up classified as &lt;i&gt;Intermediate&lt;/i&gt;. The more desirable sounding &lt;i&gt;Modern&lt;/i&gt; seems to be unachievable for any real world site. I&amp;#x27;d love to see counterexamples if I&amp;#x27;m wrong.&lt;p&gt;- It seems not to be very actively maintained since its main (and original?) author April King left Mozilla. About a half a year ago I filed an issue where the Observatory scan hung forever for certain sites [2], but apparently no one ever looked at it. (Maybe it is not an issue with the Observatory, but I think I wrote a decent report and hoped for &lt;i&gt;some&lt;/i&gt; feedback).&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;pokeinthe.io&amp;#x2F;2016&amp;#x2F;08&amp;#x2F;25&amp;#x2F;observatory-by-mozilla-a-new-tool&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;pokeinthe.io&amp;#x2F;2016&amp;#x2F;08&amp;#x2F;25&amp;#x2F;observatory-by-mozilla-a-new...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;mozilla&amp;#x2F;http-observatory-website&amp;#x2F;issues&amp;#x2F;244&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;mozilla&amp;#x2F;http-observatory-website&amp;#x2F;issues&amp;#x2F;2...&lt;/a&gt;</text></comment>