<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<div style="16px" text-align="left">In this case there are two things - motivation for spending time on edit and effects of actual changes.<br></div><div style="16px" text-align="left"><br></div><div style="16px" text-align="left">Motivation is not really important - it is not important whatever someone loves letter s or wants to<br></div><div style="16px" text-align="left">improve security (and even if security is improved there was no point in mentioning it).<br></div><div style="16px" text-align="left"><br></div><div style="16px" text-align="left">No matter what is the motivation, result is that really boring update work will be done<br></div><div style="16px" text-align="left">and OSM database will be sligthly more up to date.<br></div><div style="16px" text-align="left"><br></div><div style="16px" text-align="left">I do not really care about "latest edit date will change" problem - this is only heurestic and <br></div><div style="16px" text-align="left">extremely poor one to measure anything.<br></div><div style="16px" text-align="left"><br></div><div style="16px" text-align="left">Feb 26, 2019, 3:39 PM by iknowjoseph@gmail.com:<br></div><blockquote class="tutanota_quote" style="border-left: 1px solid #93A3B8; padding-left: 10px; margin-left: 5px;"><div dir="ltr"><div style="16px" text-align="left">Hi Rory,<br></div><div><br></div><div>Sure, so my point is: If someone wants to encourage https adoption in the wider world, the OSM database is not the place to do it. Security mechanisms exist for website operators to implement if they so desire, and they may need help making the most appropriate decisions.<br></div><div><br></div><div>Cheers, Joseph<br></div></div><div style="16px" text-align="left"><br></div><div class=""><div dir="ltr" class="">On Tue, 26 Feb 2019 at 14:30, Rory McCann <<a href="mailto:rory@technomancy.org" rel="noopener noreferrer" target="_blank">rory@technomancy.org</a>> wrote:<br></div><blockquote class="" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="16px" text-align="left">On 26/02/2019 14:45, Joseph Reeves wrote:<br></div><div style="16px" text-align="left"> > As an aside, HSTS is interesting here because the website operator is<br></div><div style="16px" text-align="left"> > saying "only use this domain over https", but at that point, we don't<br></div><div style="16px" text-align="left"> > need to make changes to the database because the web client should be<br></div><div style="16px" text-align="left"> > aware of the HSTS preload list; the protocol listed in the referrer<br></div><div style="16px" text-align="left"> > is not relevant.<br></div><div style="16px" text-align="left"> <br></div><div style="16px" text-align="left"> I don't think we can rely totally on HSTS. I'm sure not all sites are on <br></div><div style="16px" text-align="left"> HSTS preload lists. I think OSM has more "website=http://*" tags (965k)¹ <br></div><div style="16px" text-align="left"> than Firefox² & Chrome³ have in their HSTS preload lists...<br></div><div style="16px" text-align="left"> <br></div><div style="16px" text-align="left"> [1] <a href="https://taginfo.openstreetmap.org/keys/website#values" rel="noopener noreferrer" target="_blank">https://taginfo.openstreetmap.org/keys/website#values</a><br></div><div style="16px" text-align="left"> <br></div><div style="16px" text-align="left"> [2]<br></div><div style="16px" text-align="left"> <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security#Preloading_Strict_Transport_Security" rel="noopener noreferrer" target="_blank">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security#Preloading_Strict_Transport_Security</a><br></div><div style="16px" text-align="left"> <a href="https://hg.mozilla.org/mozilla-central/raw-file/tip/security/manager/ssl/nsSTSPreloadList.inc" rel="noopener noreferrer" target="_blank">https://hg.mozilla.org/mozilla-central/raw-file/tip/security/manager/ssl/nsSTSPreloadList.inc</a><br></div><div style="16px" text-align="left"> <br></div><div style="16px" text-align="left"> [3]<br></div><div style="16px" text-align="left"> <a href="https://www.chromium.org/hsts" rel="noopener noreferrer" target="_blank">https://www.chromium.org/hsts</a><br></div><div style="16px" text-align="left"> <a href="https://cs.chromium.org/codesearch/f/chromium/src/net/http/transport_security_state_static.json?cl=5b2537d89ea5994d27bba5735961b0be1095c54c" rel="noopener noreferrer" target="_blank">https://cs.chromium.org/codesearch/f/chromium/src/net/http/transport_security_state_static.json?cl=5b2537d89ea5994d27bba5735961b0be1095c54c</a><br></div></blockquote></div></blockquote><div style="16px" text-align="left"><br></div> </body>
</html>