Switch URLs from http to https

[guillemj]

The web site is now available via https, let's switch the documentation to use it.

Fixes #12

[david-a-wheeler]

@potch - would you be willing to merge this soon? The CII Best Practices badge is discussing referring to unmaintained.tech, but suggesting the use of http instead of https could be a blocker for us.

Thanks!

[scy]

Using a protocol-relative URL like //unmaintained.tech/badge.svg might even be better. If the embedding website is using HTTP, the badge will be loaded via HTTP; if it's accessed via HTTPS, HTTPS will be used.

[guillemj]

@scy I'm not sure I understand your suggestion. Why would it be good to access the external resources using https a problem if the embedding website is accessible via http (and I assume https)? (Given current mainstream browsers where using http will be penalized, I'd say that's in general a bad idea?)

[scy]

There might be a good reason why the user is accessing the embedding website using plain HTTP, for example due to network restrictions, for performance reasons, or because their browser doesn't support HTTPS. In these cases, if you embed the badge always via HTTPS, it probably won't load.

If, on the other hand, the embedding website is accessed via HTTPS, the badge will be loaded via HTTPS, too. There's no penalty.

[david-a-wheeler]

scy:

There might be a good reason why the user is accessing the embedding website using plain HTTP, for example due to network restrictions, for performance reasons, or because their browser doesn't support HTTPS.

The "//" prefix does not work when referring to an external site, which in many cases is what's happening. The "//" prefix will only work if it's the same site. By contract, "https:" works everywhere (presuming your browser supports https, and if it doesn't, you shouldn't be accessing the public Internet with it). Also, if you use "//" and you started with "http:", you allow an attacker to intercept the data & replace it with anything.

For many years, using https: was something special you only did on special sites. At this point, https:, is the norm, and using http: is just like using telnet - something you should avoid in most circumstances if the data might traverse the public Internet.

[mrimann]

I tried to imagine a use case of "cannot use HTTPS" in combination with this badge but didn't come up to one...

I'd use the badge inserted in README.md files on Github-Repositories. Visiting Github repos (and displaying the rendered output of the file) happens via HTTPS anyway - so loading the badge via HTTPS will not be the problem I guess.