planet.fedoraproject.org was moved to fedoraplanet.org because it cannot be made to work with https properly as long as included content is not available via https. See ticket:4670 - therefore I guess this ticket needs to be closed as wontfix, unless you have a better idea. In theory fedoraplanet.org could now proxy content that is available only via plain http using https, but this does not appear to be a proper solution. Another option would be to get a certificate for fedoraplanet.org and just add a redirect to plain http. wonder, why is duckduckgo using https in the first place?

I was just about to suggest the TLS -> plain redirect yeah.
I think that might be a reasonable compromise here, and the only thing I can see us doing in the short to medium term. (unless we require all blogs to use TLS from now on, but I don't think that'll fly).

wonder, why is duckduckgo using https in the first place?

This might not actually be DDG's fault?

I just tried going to http://www.fedoraplanet.org and was redirected to https://www.fedoraplanet.org

Maybe that's what's happening to DDG as well?

unless we require all blogs to use TLS from now on, but I don't think that'll fly

Honestly, now that we have LetsEncrypt, it's getting harder to justify not having an https-enabled website.

Now, to try and make this more constructive, I'm attaching a quick and dirty script which parses a feed, and lists the aggregated blogs which don't have https.

Running it on the Fedora Planet feed, here's the output:

{{{
$ python check-https.py http://fedoraplanet.org/atom.xml

Non https-enabled blogs with articles since 2016-02-29 23:30:47+00:00

• Adam Young: http://adam.younglogic.com/feed/
• Adam Šamalík: http://blog.samalik.com/category/fedora/feed/
• Alexander Todorov: http://atodorov.org/blog/categories/fedoraplanet/atom.xml
• Chris: http://blog.christophersmart.com/category/foss/fedora-foss/feed/
• Dan Vrátil: http://www.dvratil.cz/category/kde/feed/
• Fedora Infrastructure Status: http://status.fedoraproject.org/changes.rss
• Joerg Simon (noreply@blogger.com): http://www.blogger.com/feeds/8389377946641295557/posts/default
• Josh Boyer: http://jwboyer.livejournal.com/data/rss?tag=fedora
• Laura Abbott: http://www.labbott.name/blog/category/fedora/feed/index.xml
• Marcin Juszkiewicz: http://marcin.juszkiewicz.com.pl/tag/fedora/feed/
• Michele Baldessari: http://acksyn.org/rss.xml
• Nemanja Milosevic: http://nmilosev.svbtle.com/feed
• Pavlo Rudyi: http://tlhp.cf/tag/linux/feed/
• Peter Hutterer (noreply@blogger.com): http://feeds.feedburner.com/Who-t
• Pierre-Yves: http://blog.pingoured.fr/index.php?feed/tag/Fedora-planet/atom
• Remi: http://blog.famillecollet.com/feed/en/rss2
• ankur: http://feeds.feedburner.com/ankursinha/tags/fedora
• nullr0ute: http://nullr0ute.com/feed/
  }}}

A few observations:

• That's much more than I thought! :o
• these are the non-https-enabled blogs that have posted recently. I have no idea about those who haven't posted anything since an earlier date.
• Some of them might already serve on https://, but their planet subscription points to their http:// address.

I guess a possible way forward is to try and get as many folks to move over to https as possible, and keep running this script regularly, to see how things improve?

Eventually, requiring https for subscription to the planet might appear less of a hassle, if more and more contributors have moved to https.

List blogs without https in the recent articles on the Planet
check-https.py

So I had a quick look at fedorapeople, since that's where the feeds for the Fedora Planet are declared.

I'm attaching a second script that I used:

{{{
$ python check-https-fedorapeople.py
[... snip long list of http:// feeds ...]
648/698 feeds are not https-enabled
}}}

It does seem like it might be a bit early to require https. :)

Of course, some of these might not have posted anything for a while, some might be inactive or have left the community, etc...

Maybe we could email folks regularly until they move to https?

Get the feeds that are not https-enabled (run on fedorapeople)
check-https-fedorapeople.py

I'd be happy if someone wanted to try and get folks to move their blogs to https, but I think it's going to take a while before we could require it. One quick win might be to look for any blogs that trivially just work now with https (ie, re-run the script above and see what ones work with s/http/https/)

I'm not a fan of redirect to http... if someone wants https (all be it with http elements) thats kind of their choice.

So, I'd be inclined to close this wontfix for now, and once we have a critical mass of https blogs we could revisit?

Do note that one of the reasons people might not have TLS enabled for their blog is because they host it at a place that doesn't allow them to put certificates in, like GitHub Pages or a normal (non-paid) openshift account.

I would vote wontfix as well for now.

ok, so, lets try and get folks to switch their blogs to https and revist this down the road when we have more of a critical mass.

I have just written up: https://www.scrye.com/wordpress/nirik/2016/03/09/encrypt-all-the-things-blogs/
and other folks could do likewise. Perhaps we could update the wiki docs to strongly suggest https for planet?

Thanks for bringing this up and discussion...

2015 called, they want their insecure HTTP back ;) :unlock:

Jokes aside, I think it's time to revisit this. Enforcing HTTPS as a mandatory requirement for all source blogs should be no issue since we have Let's encrypt. A HTTP only Fedoraplanet looks very unprofessional imo. (Shutting down the site would be an acceptable alternative to me personally, but others may disagree.)

Should this issue be reopened or should i create a new one?

@bochecha any chance you still have those scripts and can re-upload them?

I'd be ok for someone to make a push for moving all planet blogs to ssl. That said, I can commit no time to this as I have eleventy-million more important things to work on. ;)

I'd suggest the first thing to do would be open a thread on the infrastructure list and see if folks are all ok with doing this.
Then, we need someone to drive it: run scripts, email people and nag them (politely), keep nagging and then at some final cuttoff drop the non ssl ones.

In ansible repo we have roles/people/files/check-broken-planet.py to check for broken ones, likely it could be modified to look for ssl/no ssl.