On May 20, 2016, at 10:36 AM, Corinna Vinschen <corinna-cyg...@cygwin.com> wrote: > > On Apr 24 17:18, Brian Clifton wrote: >> >> This patch (see below) will update most of the urls to HTTPS. > > Since Cygwin.com redirects http requests to https anyway, all links > to cygwin.com (or, FWIW, sourceware.org) will end up as https requests > anyway.
Additionally, cygwin.com is using HSTS with a half-year expiration time, which means you’ll only visit via HTTP *once*, ever, unless you stop visiting cygwin.com for over half a year. Excepting that case, any HSTS-compliant web client will use HTTPS even if you type HTTP. https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security You can fix the remaining TOFU problem with the EFF’s “HTTPS Everywhere” plugin for Firefox, Chrome, and Opera: https://www.eff.org/HTTPS-everywhere https://en.wikipedia.org/wiki/Trust_on_first_use https://www.eff.org/https-everywhere/atlas/domains/cygwin.com.html > wouldn't it make sense then to avoid absolute links > to cygwin.com and rather convert them to relative links Internal links within the docs should always use relative URLs, but external links should be absolute. Why? Install cygwin-doc, then say: $ info cygwin-ug-net Now drill down to Cygwin Overview > A brief history of the Cygwin project. The first cygwin.com link (to the ML) should be absolute, but the second (to using-utils.html) should be relative so info(1) can follow it. (Actually, the problem with the second link is that it’s probably using the wrong DocBook link type, so it’s forced to consider it a web link, instead of realizing that it can resolve it as an internal cross-reference.) -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
