{"action":"created","issue":{"url":"https://api.github.com/repos/isaacs/github/issues/156","labels_url":"https://api.github.com/repos/isaacs/github/issues/156/labels{/name}","comments_url":"https://api.github.com/repos/isaacs/github/issues/156/comments","events_url":"https://api.github.com/repos/isaacs/github/issues/156/events","html_url":"https://github.com/isaacs/github/issues/156","id":29023915,"number":156,"title":"Add HTTPS support to Github Pages","user":{"login":"konklone","id":4592,"avatar_url":"https://avatars.githubusercontent.com/u/4592?v=3","gravatar_id":"","url":"https://api.github.com/users/konklone","html_url":"https://github.com/konklone","followers_url":"https://api.github.com/users/konklone/followers","following_url":"https://api.github.com/users/konklone/following{/other_user}","gists_url":"https://api.github.com/users/konklone/gists{/gist_id}","starred_url":"https://api.github.com/users/konklone/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/konklone/subscriptions","organizations_url":"https://api.github.com/users/konklone/orgs","repos_url":"https://api.github.com/users/konklone/repos","events_url":"https://api.github.com/users/konklone/events{/privacy}","received_events_url":"https://api.github.com/users/konklone/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":208,"created_at":"2014-03-08T15:44:36Z","updated_at":"2015-10-24T16:23:22Z","closed_at":null,"body":"Github obviously takes HTTPS very seriously. It was early to switch to HTTPS everywhere in the site, and @dbussink has already made some [great](https://github.com/blog/1734-improving-our-ssl-setup) [strides](https://github.com/blog/1727-introducing-forward-secrecy-and-authenticated-encryption-ciphers) in shoring it up for Github. \r\n\r\nRecently, Github has given Pages a [proper home](http://pages.github.com/) and place in the Github suite of offerings. I was extremely happy to see that, because Github Pages is one of my favorite things on the Internet and has amazing potential. It's being used for more than simple project pages, and that's only going to continue as Github's reach and accessibility improves.\r\n\r\nGiven all that, **Github should figure out how to support HTTPS on Pages**. Encryption is becoming the standard for the entire web, for many obvious reasons -- to the point that [Chrome and Firefox will require HTTP 2.0 requests to be encrypted](http://www.mnot.net/blog/2014/01/04/strengthening_http_a_personal_view).\r\n\r\nThis is an issue I've brought up with @benbalter from Github before, on a few occasions. We talked about it a bit last month on Twitter, and [he raised the dual point](https://twitter.com/BenBalter/status/412735715706167296) that most people wouldn't turn on HTTPS, yet turning it on by default would wreck a lot of unsuspecting people's sites with mixed content warnings.\r\n\r\nThese are good points, but this can be addressed by:\r\n\r\n* making HTTPS the default for new Github Pages *going forward*\r\n* provide an option for existing Pages to opt-in to HTTPS\r\n* provide an option for future Pages to opt-out of HTTPS\r\n\r\nIn other words: a checkbox, defaulting to on for all future Github Pages.\r\n\r\nThis is the best of both worlds: no one gets surprised with mixed content warnings, and Github gets to proceed with a strong HTTPS policy that will bring a lot of content into the encrypted Internet (aka the future). People who really have to deal with non-HTTPS content can continue to use Pages by unchecking the box.\r\n\r\nSo how would this work? Covering *.github.io domains is comparatively straightforward - install a wildcard certificate.\r\n\r\nHowever, if custom domains weren't supported at the same time, this could pose its own problems: I'm unsure how that would impact automatic redirects to custom domains -- it's not considered best practice to redirect from an HTTPS URL to an HTTP one, and I've seen Chrome flag such a redirect *as a mixed content warning*. \r\n\r\nAdditionally, it would require potentially confusing language and settings to handle different cases, as people add and remove CNAME files. So, it's probably worth tackling both situations at once.\r\n\r\nWhile there are a few solutions, realistically, I believe this means building a dedicated settings pane for managing private keys and certificates. Certificates would need to be handled at the project level, but private keys could be managed at the user level.\r\n\r\nI believe the infrastructure of web hosting can and will rework itself to make encryption on every wire standard and easy for publishers and consumers alike. Github is in a position to really help move that needle, and get huge praise for doing so -- not to mention a competitive edge in site hosting.\r\n\r\nThis is a non-trivial feature request, but the challenge it poses is why I'm not aware of any major option right now for simple, free, secure web hosting -- and why Github meeting this challenge would be so important. Making it easier for people to do powerful things is what Github is all about."},"comment":{"url":"https://api.github.com/repos/isaacs/github/issues/comments/150831216","html_url":"https://github.com/isaacs/github/issues/156#issuecomment-150831216","issue_url":"https://api.github.com/repos/isaacs/github/issues/156","id":150831216,"user":{"login":"TomasLife","id":15079464,"avatar_url":"https://avatars.githubusercontent.com/u/15079464?v=3","gravatar_id":"","url":"https://api.github.com/users/TomasLife","html_url":"https://github.com/TomasLife","followers_url":"https://api.github.com/users/TomasLife/followers","following_url":"https://api.github.com/users/TomasLife/following{/other_user}","gists_url":"https://api.github.com/users/TomasLife/gists{/gist_id}","starred_url":"https://api.github.com/users/TomasLife/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TomasLife/subscriptions","organizations_url":"https://api.github.com/users/TomasLife/orgs","repos_url":"https://api.github.com/users/TomasLife/repos","events_url":"https://api.github.com/users/TomasLife/events{/privacy}","received_events_url":"https://api.github.com/users/TomasLife/received_events","type":"User","site_admin":false},"created_at":"2015-10-24T16:23:22Z","updated_at":"2015-10-24T16:23:22Z","body":"+1 :+1: "}}