{"action":"created","issue":{"url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/214","repository_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge","labels_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/214/labels{/name}","comments_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/214/comments","events_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/214/events","html_url":"https://github.com/linuxfoundation/cii-best-practices-badge/issues/214","id":131501368,"number":214,"title":"Should HTTPS (SSL/TLS) be MUST?","user":{"login":"david-a-wheeler","id":813150,"avatar_url":"https://avatars.githubusercontent.com/u/813150?v=3","gravatar_id":"","url":"https://api.github.com/users/david-a-wheeler","html_url":"https://github.com/david-a-wheeler","followers_url":"https://api.github.com/users/david-a-wheeler/followers","following_url":"https://api.github.com/users/david-a-wheeler/following{/other_user}","gists_url":"https://api.github.com/users/david-a-wheeler/gists{/gist_id}","starred_url":"https://api.github.com/users/david-a-wheeler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/david-a-wheeler/subscriptions","organizations_url":"https://api.github.com/users/david-a-wheeler/orgs","repos_url":"https://api.github.com/users/david-a-wheeler/repos","events_url":"https://api.github.com/users/david-a-wheeler/events{/privacy}","received_events_url":"https://api.github.com/users/david-a-wheeler/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/labels/criteria","name":"criteria","color":"fbca04"},{"url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-02-04T23:05:57Z","updated_at":"2016-04-05T18:57:02Z","closed_at":null,"body":"Currently using HTTPS (SSL/TLS) for the project and repo is a SHOULD, not a MUST.  Should we change it to a MUST?\r\n\r\nHanno Böck says:\r\n> This should be a MUST. We have 2016, all sane people on the Internet are moving to HTTPS. Also I think this should not only involve the website, but also providing a secure download *and* providing a secure way to check out source repos. I am super annoyed how many people out there use git and the only public ways to check it out they provide are unencrypted (savannah, I'm looking at you).\r\n\r\nNote that if this is accepted, this would eliminate the need for #143."},"comment":{"url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/comments/205948681","html_url":"https://github.com/linuxfoundation/cii-best-practices-badge/issues/214#issuecomment-205948681","issue_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/214","id":205948681,"user":{"login":"david-a-wheeler","id":813150,"avatar_url":"https://avatars.githubusercontent.com/u/813150?v=3","gravatar_id":"","url":"https://api.github.com/users/david-a-wheeler","html_url":"https://github.com/david-a-wheeler","followers_url":"https://api.github.com/users/david-a-wheeler/followers","following_url":"https://api.github.com/users/david-a-wheeler/following{/other_user}","gists_url":"https://api.github.com/users/david-a-wheeler/gists{/gist_id}","starred_url":"https://api.github.com/users/david-a-wheeler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/david-a-wheeler/subscriptions","organizations_url":"https://api.github.com/users/david-a-wheeler/orgs","repos_url":"https://api.github.com/users/david-a-wheeler/repos","events_url":"https://api.github.com/users/david-a-wheeler/events{/privacy}","received_events_url":"https://api.github.com/users/david-a-wheeler/received_events","type":"User","site_admin":false},"created_at":"2016-04-05T18:57:00Z","updated_at":"2016-04-05T18:57:00Z","body":"On a related topic, we might also add a third URL, \"download_url\".  In a number of projects, the project URL, repo URL, and download URL are distinct.  if we mandate HTTPS, we need to make sure it covers all three kinds of URLs.  Many projects use a single URL (the repo URL) for all 3, and that's fine, but if they differ they should be covered.\r\n"}}