Moving the Washington Post to HTTPS
developer.washingtonpost.com
developer.washingtonpost.com
I would gladly pay a netflix-like subscription that gives me a "pass" to top news sites with no advertising. I just don't want to manage a dozen subscriptions to sites and it's difficult to choose between the different options that they offer like "tablet, web, paper" "web, paper" "tablet only" etc. Just take the difficulty away and give me access to the content in whatever format I want, with an addon fee for print delivery.
I'd like the subscription, as you mention too!
What I'd like even more (for voluntary payment) is a subscription that divvies up my monthly 'budget' according to the % of the time I spent on different sites. Say I spend 50% of my browsing time on Nytimes, 30% on HN and 20% on New Yorker, and my monthly allocated budget is $20. Then NYT gets $10, HN gets $6, NYer $4, etc.
Or perhaps, a monthly budget where the money is deducted for subscription sites, per article/time whatever. Once my budget is finished, I see 'normal' web like everyone else does.
I don't really care about ads, but maybe people who don't want to see ads could pay like, 2x as much, etc.
There doesn't seem to be a lot of innovation in this field. Perhaps it's the difficulty of integrating everything in one place?
Edit after reading the comments: Google contributor just removes ads instead of getting you 'special pass' right? Do the site owners get paid for the 'eyeballs' from the subscribers?
Flattr is a Sweden-based microdonation provider founded by Peter Sunde and Linus Olsson and launched in March 2010.[1]
https://en.wikipedia.org/wiki/Flattr
Also, different countries in Europe solve this problem differently. Some have this system, such as Piano.
The criticism that was made of Kachingle is actually relevant for this whole category of startup. You should read "The Limits Of Tip Jar Journalism":
http://www.theatlantic.com/technology/archive/2011/02/kachin...
There are 3 main problems:
1.) there is an abundance of news sites in English
2.) there are not enough people who want to pay for news
3.) Google takes about 45% of all online global advertising
The situation is different for non-English publications. I know, for instance, there are limited number of fashion/news magazines aimed at women in Poland, and Polish women, all over the world, are willing to pay to support those magazines. So there are 5 or 6 fashion/news magazines in Polish that are doing well.
But in English? There are tens of thousands of such publications and there is not enough money for them all.
Assume registration includes specifying a list of "preferred publishers" (like what aggregated news apps ask on sign up in order to curate your feed)
Add a client side tracker (i.e. browser plugin) with the ability to track the page views on each site.
One of three options:
1) no tracking - split the distribution evenly among your preferred sites
2) offline/batch tracking - at the end of the month, submit an aggregated percentage breakdown of your sites
3) online tracking - sent to the server in real time (i.e. Central scrutiniser)
And if you're really particular about tracking, it could just be an API, and you can write to it whatever data you want to share.
Google contributor basically puts you in the same position advertisers are, you bid to advertise to yourself, and if you win, you don't see any ads :)
1) Google Contributor requires you to whitelist Google ads
2) AFAIK - you will see at least 50% of the ads
I did a back-of-the-envelope-style calculation at one point (I can't recall my source data anymore now though), and basically you'd need to pay something like $120 a month for websites to end up with the same amount of cash as with ads.
I wonder how much such big organizations spend on selling advertising (I'm now conflating with the likes of NYT that has ads in its paper version etc). If one truly went for ad-free, one would of course let all the ad-selling staff go (or let them do something else).
The future will be better very soon.
This has been tried without much adoption (e.g. https://www.google.com/contributor/welcome/).
Really the problem is that newspapers make very little online, even with high numbers of ads, compared to print.
It isn't cost effective to run an online-only newspaper (with all of the extraneous costs that go into producing "news", and not "blogs"). Thus, they have a strong incentive to crazy subscription models instead of streamlining everything.
- 5-50% fewer ads isn't good enough, it needs to remove all ads.
- It's too expensive. There is no way my ad impressions add up to $10 a month.
- How is the money divided? How big is Google's cut? Needs to be clarified, ideally made user-configurable.
I remember when Contributor was in an internal beta (back then I worked at Google). Initially there were no tiers. I recall being completely shocked at how high my 'budget' had to be to stop seeing just most ads, not even all of them. It was much, much higher than $10 per month.
When I looked at the per-site breakdown it was obvious why: I spent a lot of time on sites that advertisers were willing to pay a lot to be on, like (oddly enough) Slashdot. Presumably due to the affluent, IT-budget-controlling and very tightly defined audience. My eyeballs were literally worth a lot of money and to buy them back, would therefore cost a lot of money.
It was when I started to see those figures, and I wasn't even getting an ad free web, that I realised the whole dream of using micropayments to clear the web of advertising was a non starter. Hardly anyone is going to be willing to double or triple the price of their internet subscription just to get rid of some ads, some of the time. We really have no idea just how much the web economy relies on advertising to survive.
Presumably Contributor uses tiered budgets to avoid sticker-shock and people blowing through their budget in the first few days of the month. It makes sense but they can never get rid of all ads that way.
P.S. I don't use ad blockers.
They do though. Online advertising is a ~$60 billion a year (domestic US) business undergoing very rapid ~50%/year growth rates (estimates vary wildly).
Over around 120 million households, that's about $42 per month per household.
Over 20 million households with at least an upper-middle-class income, it's even higher.
Most people aren't willing to pay their equal share of the numbers, but most people also don't have the money to pay it now.
It would be hilarious if you took the 20% of the country with plenty of disposable income and made them the subscription base for destroying advertising: it results in ads shown only to the people without the money to justify them, or sites which go subscription-only.
And the space where those ads would have appeared, as well.
Do you believe that Google's description of the way it works is inaccurate, then?
"Instead of bidding on behalf of an advertiser, Contributor bids on your behalf, with the budget you set up. The Google ad auction determines when a thank you message will appear in an ad space, and how much it will cost. In the ad auction, advertisers and Contributor bid for a given ad space in real time." [0]
Why is Netflix, Spotify ok for $10 but not a constant stream of content from any source online? People spend 10x more on coffee every month in some areas.
(If the ecological cost of all of that unread paper bothers you, you can put in long-duration vacation stops or, in the case of the NYT, have your paper copy sent to a school instead)
Since there's no way to buy an ad-free copy of the NYT, all of their existing customers have been trained to think of the fair price as what a paper subscription costs with little thought about how much of that is subsidized by advertisers.
Even high-income people are sensitive to these effects – Doc Searls wrote about a similar problem where the New Yorker's intro pricing made him feel like he was being ripped off, even though I'm certain the cost isn't a noticeable financial issue for him:
https://blogs.law.harvard.edu/doc/2015/05/23/dear-magazines-...
In practice, I think you'd be limited to selling network ads, which don't pay very much and rely on tracking users and building profiles to serve them targeted ads.
Are you speaking from experience and/or data, or based on logical reasoning? I'm honestly curious, so I hope this doesn't come across as a digital call-out of some kind.
To elaborate, I feel like a lot of people don't pay for news, or written content, because they expect (and can get it) for free. That doesn't mean they're not good potential widget customers.
I'm curious as to what kind of inferences advertisers make / have made about users based on their specific spending patterns. For example, while I'm sure that generally speaking someone who pays for service X may be more likely than average to pay for service Y, I would also expect that variance to grow or shrink a lot depending on the specific circumstances.
> I feel like a lot of people don't pay for news ... That doesn't mean they're not good potential widget customers.
I'm having a hard time thinking of any advertiser who would be happy about excluding the sort of dedicated reader who is willing to pay for content online. I'm not saying the remaining ad impressions are "bad" just that they are objectively less valuable. That's why this scheme disproportionately devalues ad impressions: you remove the direct impressions from people who buy a pass and you also make the remaining impressions less valuable.
Look at how washingtonpost.com positions itself to advertisers: http://www.washingtonpost.com/wp-adv/mediacenter/html/ad_was... and then imagine how much harder it would be to buy into that story if it excluded many wealthy and loyal readers.
[0]https://launch.blendle.com [1]http://www.niemanlab.org/2015/12/micropayment-platform-blend...
- Free, obviously
- No willpower/decision required
- Faster (due to no decision as above)
- More equal access (as wealth/income don't determine how much content you get)
- Anonymous (yes more than payments which come with your cc number, address, etc)
I do think online ad formats have gotten worse but the model itself works. It's the implementation that needs a severe restructuring today and is finally in progress due to the growing consumer power through adblocking.
I'd kill for a Netflix/Spotify/choose-your-newspaper all in one bundle.
SSLLabs grades WP's HTTPS support "A" [1].
I can see that they don't set HSTS headers and there's no OCSP stapling.
Also, their cookies are not set as "secure".
[1] - https://www.ssllabs.com/ssltest/analyze.html?d=www.washingto...
If an expert like Google can't even ensure that ads don't auto play or include sound effects, what hope is there that they can protect against malware and other dangerous content leaking in?
If an expert like Google can't even ensure that ads don't auto play
The latter answers the former. They are concerned, but there is basically nothing they can do about it if they want to continue to earn money.
Many years ago, ads were very bad. Then Google got into the business and enforced clean, tasteful ads and things were good for quite some time. But then they started deteriorating again, worse every year until I finally installed adblock early this year.
Did something cause the power balance to swing back away from Google or something? If so, what?
Yet it is becoming more and more useless everyday because of HTTPS. I used to be able to quickly fly through google maps because most of the images were in cache, even with only 1mbs internet. Then it went HTTPS only. So I started using mapquest, then it too did the same. Bing maps still allows some non HTTPS images, so I now use that sometimes.
I can see how some sites might want to be more private in nature. But news and maps websites I am not seeing the point.
Don't forget to weigh those other two factors when judging https adoption. Your goals are understandable and worthwhile. They're also still achievable with appropriate client management software.
Consider this: in a world without https, your children could visit a valid, approved domain and be served malicious or undesirable content because someone modified the content in flight or intercepted the connection. There is literally no way for you to have any guarantee what's served to your children.
In a world with https (and appropriate client management software), you can be confident they really are only receiving approved content because the connection is authenticated and traffic cannot be modified in flight. (And your children are less easily tracked by unknown 3rd parties, to boot.)
Authentication and integrity are often forgotten when discussing https, which is unfortunate because those are two incredibly important benefits that further motivate widespread https deployment.
The fact that some open-source software can't do what you want it to do doesn't mean that there's anything wrong with other people trying to be secure. The most obvious solution would be to fix Squid, pay someone to fix it if you can't, or at the very least write a bug report to let other people know that you need it fixed.
How is that related? Your browser caches files if the right headers are set. The protocol doesn't make any difference here.
The only thing you gain via external cache is potentially sharing that cache with other devices at home. But I'm not sure how realistic the improvement is - either you're looking at a one-off location, or multiple times at the same one. In the first case no caching can help, in the second you're looking at stuff multiple times anyways - just let it load the first time.
Her argument is that we don't expect parents to police their children all the time in real life, shop owners have legal responsibilities to stop children accessing inappropriate products, children are stopped from purchasing alcohol in bars, etc. and yet on the internet somehow it's the parent's responsibility all the time all of a sudden. And if your child is with other people, those restrictions may be totally waived.
The problem is, it is trivial for a child to access incredibly disturbing and PTSD inducing material that is accessible to any child with ease, beheadings, murders, the most vile and disturbing porn you couldn't even imagine, all two clicks of a button away from your 11 year old.
She definitely has a point. I'm not sure what the solution is as I love the internet being open, but a huge proportion of the planet is made up of children and they can go watch ISIS behead someone or a woman shit in the mouth of a man whenever their classmate dares them.
I'd much rather have my children see that and talk to me about it because they trust me rather than not mentioning it because they worked around a web filter (which is inevitable [check out my ubuntu live usb stick, or my ssh tunnel]) and are afraid of getting in trouble.
Up until the child starts hitting double-digit ages, we actually do expect just that. Long gone are the days of society being okay with parents letting 7-year-olds roam free and play.
The old saying used to just be "have the family computer in a public room (living room,ect) and don't allow private access". But with every phone, tv, game console, alarm clock, whatever, all having their own web browsers, the only way to truly filter is from the single source of the ISP connection.
7 years ago I had an idea to make web filtering routers and ethernet bridges. But even then it was becoming too hard to reliably do. And I didn't want to market something for family protection that I couldn't 100% reliably guarantee works.
And most recently, a somewhat home constrained neighbor that lived by me wanted me to secure his internet "the way mine is". He was tired of fighting porn addictions. I set him up the best I could, but within a year I had gotten word that he had convinced another friend/relative to buy him a smart phone with unlimited internet access...
I'd probably be more worried about all the porn that your 11 year old watch, than the beheadings. Staying ahead of the curve wrt healthy sex ed. is a real challenge.
Filtering - this can still be done by just using SNI (server names) which are part of the https handshake.
How about NO.
I am sure everyone that went to ashleymadison.com used proxies, wiped their history, and used HTTPS. But HTTPS didn't really help all that much did it? And how many of your "private" websites that you use are vulnerable to the same?
How do you know some sysadmin at Google isn't right now reading your gmail emails sitting on a backed up filesystem somewhere?
I am trying to do something right here, protect my family and myself. Oh and make my internet faster. But because of a huge push of people that need to do (mostly) wrong, I can no longer do what is right. Yes I am aware that some privacy is probably good. Passwords shouldn't be clear text or CC numbers. But SSL for map images and random text from a news site? Just not seeing the point. Oh and HTTPS isn't the magic bullet either: https://youtu.be/WhKBPwzhAZ4?t=4m40s
> But because of a huge push of people that need to do (mostly) wrong, I can no longer do what is right
This is just unspeakably wrong about the importance of HTTPS. You're basically equating HTTPS to criminal activity.
1. If you allow any website which has a login/payment/refer link to download over HTTP, you potentially lost the security game. It doesn't matter that the payment site is secure if the site that directed you to the shop was on plain HTTP and changed in flight. Making things secure by default is not solving everything, but definitely helps.
2. For keeping privacy, imagine you're doing 99% of your browsing via the default HTTP. Only connections to 1-2 servers ever go over HTTPS. Which are the connections you're trying to keep private? Now compare that to browsing 99% of the time via the default HTTPS. Which are the connections you're trying to keep private?
Also, this site would disagree with you on the speed question: http://www.httpvshttps.com/
However, HTTP/2 is here, and it is HTTPS only. The dream is over. We're lucky -- only lucky -- that someone decided to do Let's Encrypt so I can still run a personal website without paying thousands on certificates.
[1] https://support.google.com/adxbuyer/answer/3016708?hl=en
A real modern ad network focused on clean, static, seamless ads. We're also probably the fastest ad network around, and soon to be one of the most privacy conscious as well.
Most typical ad networks aren't actually that capable even though the industry is called "adtech". They're built using the same copy/paste software with outsourced teams and no attention to detail other than how to jam the biggest and loudest ad on a page. Needless to say, that model isn't working anymore.
Their certificate doesn't look EV to me. (I checked both developer. and www.)
It looks like they are using instart logic, and are on the same cert as a bunch of their other enterprise customers now.
> Official Business Name (Colloquial Business Name)
Which in the case of two very long names...
Which is a great way to know who Instant Logic's customers are, if you're in the CDN business and looking for customers to poach...
EV adds value over a domain verified certificate by claiming to verify the identity of the organisation. This is done through a background check when an EV certificate is applied for.
So if an organisation uses a non-standard domain (e.g. Microsoft purchased "SpecialXBoxPromotion.net" for some holiday discount) you could still see, via EV, that that organisation controlled that domain.
The CA system has a few warts, but Certificate Transparency, revocation lists, and oversight are helping combat that. But none of this helps or hurts EV as a concept either way.
The real issue with EV isn't with the EV concept or EV process, it is that end users don't understand EV or why it matters.
I consider the CA model as it exists for browsers fundamentally broken even in a world where everyone configured things perfectly and no bugs exist. It "works" today insofar as (for instance) I don't really fear using my bank, Amazon, etc. But the protection doesn't come because the CA model offers any technically strong way for you to be certain of the identity of the server on the other end. Any assurance you have is based on human factors (thus the push to EV certs - more human verification).
I'm pretty sure there isn't more wide-scale cert forgery only because it is more useful to target individuals, and possibly because those who have the ability to forge, say, Google's certs have an interest in not loudly demonstrating how broken the system is.
Given the number of root certs in everyone's browser right now from entities completely unknown to the users, I really don't understand how people have more confidence than I do.
EV's biggest problem is DV certificate: it's hard to communicate the nuance between "controls Amazon.com" and "controls Amazon".
EV's were a positive step forward, especially with the introduction of the CA/B Forum, as after Let's Encrypt DVs only value is as an encryption mechanism (i.e. not as security, see phishing).
Those "human factors" are unavoidable - identity is a "human factor".
The integrity of EV is down to the integrity of the CA who are regulated (now) by a strict set of guidelines. So the set of CAs who can administer EVs are a much smaller subset of CAs who can give out DVs.
Comodo is the CA that issued the biggest percentage of certificates worldwide, they even won an award that year or the year after at RSA conference! If you take a closer look though, as Moxie did[1] - we ’re all grateful - you find out that it takes a douchebag with questionable skillset to bring down the entire infrastructure down to it’s knees. It's hilarious and tragic at the same time.
I will question the relevance of the first half of the talk (about CAs and SSL) in 2015, with TLS and the CA/B Forum.
But his main thesis about trust agility is quite spot on. I'd never considered it before, and am going to look into Convergence and TACK. He raises a fantastic question - the duration of trust is a real concern.
Chrome DevTools timing said: 2.71s Scripting; 636ms Rendering; 210ms Painting
WashingtonPost.com crashes my iPad Safari, see: https://news.ycombinator.com/item?id=10697235
It's a sad reality of the advertising world—the people building the ads simply don't care, and the ad networks can't (or won't) do good QA.
The big clients and agencies who do ad buys have thousands of requirements including 3rd party verification, tracking, conversion pixels, etc.
We run one of the fastest ad networks available with everything optimized to the fewest network requests, yet a single campaign from someone like ATT will mean a dozen other tags that needed to be loaded if we run their ads.
It's a lack of trust, standards and actually technical understanding that's hurting this industry the most.
I can replicate this behavior in Chrome on Ubuntu, Chrome on El Capitan, and Safari on El Capitan.
So what are the .9% of traffic that aren't? Web crawler bots?
Maybe some pages don't work on https due to mixed content and stuff like that.
I've just given up giving a full explanation and now just point to this:
http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-f...
And this:
https://www.eff.org/deeplinks/2014/11/verizon-x-uidh
If they still aren't convinced then they weren't convincible to begin with. There's other arguments too, but if the above doesn't sway them then none of the other arguments would either.