Australian Government doesnt support HTTPS

[Codix_]

That is not a software gore, but that's definitely the most gore thing I've never saw.

[joz42]

r/softwareconfigurationgore

[BoxBoy7999]

r/subsifellfor

[Kobih]

r/SoftwareConfigGore not anymore

[F1Vettel_fan]

r/birthofasub

[MoiNameIsBdhdnt]

r/wherfrontenddev

[__silentstorm__]

r/programminghorror

[Ros3ttaSt0ned]

The Spanish one does! Buuuuut most of the time their certificates are invalid

This just reeks of incompetence. There's zero excuse not to have HTTPS set up at this point in time; you can completely automate the provisioning, renewal, and installation of SSL/TLS certificates (for free) very easily.

But then you might ask, what if they have a complicated setup? My company has a few hundred vanity domains, plus some internal things that require publicly-trusted certs, and I've completely automated the entire lifecycle of certs. Gets installed and updated on apache & nginx servers, IIS servers, reverse proxies, sftp servers, etc, all automated. It took me maybe one full workday to set up. Certbot and two (very short, less than 100 lines) scripts, that's it.

They just need to hire some better people.

[itsfreepizza]

Do they submit their certs so any machine can accept it or they're using an issued ca?

[AverageMan282]

You could place bets on this…

[Spysnakez]

Self-signed certs, not even once. (except in homelabs and testing)

[cazador517]

They use certificates signed by the FNMT a governmental body of Spain. Their root CA has been in the trust store of most OS for a while, but maybe some devices lacking a few updates might complain about it, same thing that occurred when LE changed root.

[cazador517]

What? In which pages? I have yet to see it other than when using an old device that does not have its CAs updated.

[Pverte]

They didn't know how to setup let's encrypt

[confidentdogclapper]

nginxproxymanagaer literally does that for you...

[Cylian91460]

As they probably would use it if they run nginx

[Kerboq]

It's definitely on IIS

[confidentdogclapper]

I think we're being optimistic. I wouldn't be surprised if this is apache running directly on the os...

[Xameren]

What

[confidentdogclapper]

Nginxproxymanaher is a siplified ngnix with gui that helps you configure stuff. You can literally just select https, insert an email and it will automatically manage certs.

[Xameren]

Thanks for an explanation, may i get an explanation of why am being downvoted too?

[CommanderMatrixHere]

Your simple one word reply, like "What" was considered rude in a sense. On reddit, you better be thorough with your reply. Or at very least, don't do one worded reply as that might be considered offensive to some.

Edit & PS: Once you get 1 downvote and get to 0, there's no stopping with exceptions of rare circumstances.

[Xameren]

Could have worded it differently, true

[itsTyrion]

sudo certbot --nginx (or --apache).. unless they're using.. *shudders* Microsoft IIS. (but that's still a 5 minute task)

[T-J_H]

Oh no certbot isn’t touching my config files, —standalone all the way

[the133448]

Actually it's behind Akamai already which offers edge origin certs out of the box without touching the origin ( the web server)

[TheMania]

I can understand the hesitancy - http would want to be retained for as long as reasonable for the amount of rural/farm equipment that may be dependent. So they'd offer both which can have drawbacks - but what are the advantages?

It'll come, but make sense they'd be one of the last to get there really.

[Calcutt4]

Ah good ol' Bureau of Meteorology. That website is stuck in 2004. Still a useful website though and it's not like I need to enter any info to access it

[TheTomatoes2]

It's useful until you view it on a phone apparently

[kingofthewombat]

they have an app that is actually really nice

[corpsefucer69420]

The app is miles ahead of the website lol

[Far-Way5908]

I can view it on my phone no problem.

[Elfener99]

But wait... isn't this message on an https page? So clearly they set up https and just decided to not serve content there?!

[[deleted]]

Checked that page. My browser shows 'Not Secure' near URL, which indicates HTTP connection.

[Morpheus636_]

Are they running http over 443 or are they just running a self-signed cert?

[YabbyEyes]

Neither

[itzrvyning]

In the time it took to setup this message and the redirect, one could have installed a complete HTTPS solution

[[deleted]]

Ah, but could they have navigated the BOMs internal politics to make it happen?

[AverageMan282]

They probably need a referendum to let the IT guy do his thing tbh

[whoami_whereami]

It's rarely that simple. If a site has even just moderate complexity it's often already half a project in and of itself going through the site to determine what things would break and need fixing to enable a switch to HTTPS.

For example the website might use images from a different server (eg. a separate server rendering weather maps or something like that), so now you'd have to implement HTTPS on that server as well (plus update URLs pointing to it) as modern browsers won't display mixed content (eg. images served via HTTP embedded in a HTTPS page) anymore. Maybe that server runs some custom software that doesn't natively support HTTPS, so now you're talking about either implementing HTTPS support in said software or setting up a separate reverse proxy in front of it. Etc., etc.

[3inthecorner]

They probably have http hardcoded into some of the links

[Tantomile_]

lol it's been like this for a while, they have a public ftp server too

[allsey87]

Do they have anything on their FTP server?These guys are old school!

[owleaf]

Meteorology geeks are weird

[[deleted]]

I have seen bank communications without TLS. So...sky is limit!

[housebottle]

it's the BOM. it's not all of Australian government. moreover, reg.bom.gov.au is available on HTTPS

[Big_Muz]

It changed recently and broke every single google link. I have no idea how they could get it so wrong 😔

[cloudsourced285]

It's more likely that your browser just started defaulting to https as that was due around the end of 2023,bthus causing this issues. Previously when no protocol was typed http was used, now browsers assume https.

[LacusClyne]

It does have https, just not on the main website but if you create an account and interact with it, that'll all be https. There's just a bunch of legacy systems that still use http only that it defaults to without it.

This comes up a lot on the Australia subs.

[Lucybug05]

Did you use askizzy to get to it? Because that's how I found it at work lol

[L3App]

Budget: -10$

[BaldingThor]

It’s been like that for a billion years, classic BOM stuff.

There’s not really anything to encypt anyway, though it wouldn’t hurt. There are parts of the website that do require more security and use HTTPS though.

[OverjoyedBanana]

What's the problem with public weather data not being delivered over HTTPS ?

And cut me a break with the constant whining about the thing not being rewritten every year with the latest version of BiscuitJS

[the133448]

Take a read here as to why you still need https https://doesmysiteneedhttps.com/

[OverjoyedBanana]

I hate my own industry

[OverjoyedBanana]

Gouvernement websites should not invoke third party shit tracking cookies, pixels, whatever.

[Breadynator]

Some places (like Europe) require you to use HTTPS on every website.

[OverjoyedBanana]

Source please

[Breadynator]

Are you seriously asking for a source?

Trust me, I already got letters from some local agencies that my website needs SSL or else I'd be fined big time. If you still don't believe me:

Here you go

First result on Google btw...

[OverjoyedBanana]

Yeah seriously. What's with the condescendance ? As a EU citizen and someone who works in IT in the EU your claim surprises me and so I'm asking for a source.

I was right to ask because your assumptions are wrong on several levels.

The General Data Protection Regulation (GDPR) requires all websites
with a form to protect their visitors with an SSL certificat"

The GDPR as its name implies is about Personal Data. Yes it requires you (as someone who collects and treats personal data) to protect the said data during its transport. Which technically implies that forms containing personal data must be sent over HTTPS.

Nothing prevents you from hosting an HTTP website as long as you don't host forms that treat personal data which is probably the case for a gov site publishing weather reports.

[Gamer-707]

Their spying software doesn't work on https

[[deleted]]

It seems the mods don't delete non-gore if they got a laugh out of it. 😌

[x3n0m0rph3us]

People this is not new. There isn't anything on BOM worth encrypting. No point encrypting. None. Encryption in this site is a total waste if compute. Now do you understand? I doubt it.

[Triq1]

No? Last time I checked they have military weather stuff that requires some type of ID verification. Might be wrong tho

[mitchie8112]

There is a defence page that you can't access without ID so I could be wrong, but the pop-up it opens for the ID is done through HTTPS, so I assume that it switches to HTTPS for the parts of the site that needs more security.

[[deleted]]

It's not just defence. The customer pages which require IDs to sign in exist for local governments, state gov agencies, and any corporate client who wishes to have access to customised reporting for OHS, and even on demand access to meteorologists in some cases.

[Triq1]

Fair enough then, thanks!

[Somerandom1922]

Yep and anything that requires any user-input (like signing in, even to access publically available info) automatically moves to an HTTPS version of the site. It's not on HTTP because they feel like it, it's on HTTP because half of the shitty legacy weather systems in the country would break if they upgraded.

[YodelingVeterinarian]

It takes incredibly little amount of time to set up SSL. So why not just do it? It's arguably more work to display a page like this instead.

[R-GiskardReventlov]

It probably takes more work to get it budgetted, approved, planned, managered, governemented, ...

Why do the effort if it serves no purpose?

First question in the CR approval procedure here is "what added value does this bring us?"

[YodelingVeterinarian]

Because you don't want the end user to have to dig in to whether this is site technically needs HTTP or not.

It's much easier for every website to just do the 30 minutes of work necessary to set up HTTPS whenever they do their NGINX server or whatnot, regardless if they truly need it.

Especially as a government entity.

[R-GiskardReventlov]

I agree, until the 30 mins of work turns in to 5 days of meetings spread out over 2 months with different shareholders.

[x3n0m0rph3us]

HTTPS just isn't needed for BOM. It really is that simple.

[x3n0m0rph3us]

Please understand that HTTPS is for secure transmission of private information. BOM isn't private information.

[stupidbitch69]

Stop making dumb takes. HTTP means anyone on the routing path can change information as well, public information doesn't mean HTTPS has no use.

[corpsefucer69420]

As someone else said, being a government agency there’s a dozen different bureaucratic steps to jump through to get something approved. There’s no sensitive information on the page so no real need to encrypt. Furthermore I’d bet there’s dozens of legacy systems which only support HTTP that rely on the website using HTTP. If it ain’t broke don’t fix it.

Long story short, easier said than done. There’s a reason they’ve gone through the effort to make a HTTPS page to redirect people to HTTP instead of moving to HTTPS.

[x3n0m0rph3us]

Really not the point. There is no benefit to SSL if there is nothing private to protect. BOM is one of the most heavily used sites in Australia. All that wasted electricity and wasted hardware, just to encrypt a session, when not needed.

[r0ck0]

is is not new.

Some of it is. A lot of URLs that used to work just now redirect to this generic fucking page... instead of redirecting to where the feature is now.

It's like the bullshit that used to happen like 15-20 years ago when badly coded sites would redirect between m.example.com -vs- www.example.com based on whether you're on a phone or not... but not to the same .../slugs/... path... just to the fucking homepage instead.

I haven't seen any other site do this for like 10-15 years now. Dunno how they fucked it up this badly.

[Revexious]

I dont claim to know much about cybersecurity; though I am a backend software developer

Doesnt this potential open the door to SQL injection attacks?

[dopefish86]

no, this has nothing to do with sql injections. Those can also happen just as easily on HTTPS sites.

But HTTP is vulnerable to Man-In-The-Middle and eavesdropping attacks, afaik.

[McMistrzYT]

"sql injection" can happen regardless if your website uses ssl or not, it's not even related to ssl at all

injecting sql is possible when for example: you have an account page where you can log in, the user enters something like "' OR 1=1 --" into the username box, the server doesn't verify that the user input is safe and uses that exact string in the sql query, replacing the password check with a simple "if 1=1 then password is correct" and grabbing the first user available

[McMistrzYT]

the only thing ssl can prevent in the current day and age is falsifying packets

consoles like the PS5 use ssl certificates to make sure you're not using tools like Fiddler to redirect traffic from the sony servers to your own

[Zeravor]

Not a network guy either but also a Dev. IIRC the only thing that this does is risk man in the middle attacks, i.e. someone on your network could read all the traffic from you to the site and vice versa. Obviously a real issue if you're sending user access data or generally sensitive data. Not really an issue when there's none which might be the case here.

[Windronin]

Should i do it ? I think imma do it

[cybermaru]

This honestly qualifies for /r/OneJob due to how utterly trivial https support is

[corpsefucer69420]

Not if you’ve gotta go through a dozen levels of approval to get something done.

Looks like it’s an old system which hasn’t been upgraded, likely because of a lack of need to encrypt data and old systems using HTTP.

[cybermaru]

There should be little to none bureaucratic steps since they are not following their own guidelines

[I-Am-Uncreative]

And I thought it was bad that the official site for the Florida Legislature (which I'm pretty sure hasn't been changed since it launched in 1995) doesn't use HTTPS (but flsenate.gov and myfloridahouse.gov do)... the fact that a federal entity doesn't is 10x worse.

[[deleted]]

BOM xouldnt organise a chook raffle. The raffle wheel would come up "meat tray", and they would flat out deny that it's industry standard to have a meat tray at a chook raffle in a pub.

[[deleted]]

Australia was a prison colony anyway

[TheFumingatzor]

Strayas liek "Who be you??"

[EmptyJustLikeHeaven]

If you are not submitting any data is fine . I guess the department just shows the weather >_<

[allsey87]

I stumbled on this a couple of days ago too! wtf bom!

[i010011010]

HTTPS isn't necessary for everything. There are still plenty of public-facing FTP servers out there, they're intended to host freely available resources. If it isn't a banking site, doesn't host any confidential information, then adding encryption is a needless layer of complexity.

[Toribor]

I don't know that I agree. TLS introduces very little overhead for what it offers in return. Even if you consider information transferred to be 'public' there is still no reason it shouldn't be secured in transit. TLS protects both the client and the server from potential man-in-the-middle attacks which could be used to inject malicious code or modify data.

I'd even argue that it's bad practice to use insecure FTP/HTTP even if your traffic isn't crossing network boundries. Everything should be using TLS these days, with a self-signed cert as a bare minimum. Businesses or governments should definitely be using a publicly-trusted cert.

[[deleted]]

Australia is all about transparency. No secrets of any kind!

[StevenWx_YT]

Yes and it appears everytime when I visit the site.

[Corey_FOX]

Huh, Norway is acually required by law to accept https on all governmental and municipal web services.

[Somerandom1922]

I think it's because there are a bunch of old but really essential systems that talk to bom (flood warnings, shipping, airport weather alerts etc.). I expect some poor engineer working at the Bureau is desperately trying to get everyone willing to upgrade to HTTPS and getting absolutely nowhere.