Re: Proposed patch for web site: update most links to HTTPS

[Warren Young <wyml@etr-usa.com>]

On May 20, 2016, at 10:36 AM, Corinna Vinschen <corinna-cygwin@cygwin.com> wrote:
> 
> On Apr 24 17:18, Brian Clifton wrote:
>> 
>> This patch (see below) will update most of the urls to HTTPS.
> 
> Since Cygwin.com redirects http requests to https anyway, all links
> to cygwin.com (or, FWIW, sourceware.org) will end up as https requests
> anyway.

Additionally, cygwin.com is using HSTS with a half-year expiration time, which means you’ll only visit via HTTP *once*, ever, unless you stop visiting cygwin.com for over half a year.  Excepting that case, any HSTS-compliant web client will use HTTPS even if you type HTTP.

  https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

You can fix the remaining TOFU problem with the EFF’s “HTTPS Everywhere” plugin for Firefox, Chrome, and Opera:

  https://www.eff.org/HTTPS-everywhere
  https://en.wikipedia.org/wiki/Trust_on_first_use
  https://www.eff.org/https-everywhere/atlas/domains/cygwin.com.html

> wouldn't it make sense then to avoid absolute links
> to cygwin.com and rather convert them to relative links

Internal links within the docs should always use relative URLs, but external links should be absolute.

Why?  Install cygwin-doc, then say:

    $ info cygwin-ug-net

Now drill down to Cygwin Overview > A brief history of the Cygwin project.  The first cygwin.com link (to the ML) should be absolute, but the second (to using-utils.html) should be relative so info(1) can follow it.

(Actually, the problem with the second link is that it’s probably using the wrong DocBook link type, so it’s forced to consider it a web link, instead of realizing that it can resolve it as an internal cross-reference.)
--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple