“Users will only be able to view patents via HTTP. HTTPS will no longer work” (opens in new tab)

FWIW, you're often better off not searching, or looking at, patents. If you end up in a patent case, your liabilities will be much higher if they can sufficiently claim you knowingly infringed. Evidence that you searched for patents can weigh against you / your employer. Even if you weren't associated with the infringing product itself.

The bizarre practice of assigning session keys to visitors and somehow storing the page they're viewing in the server instead of in the URL is pretty common in Brazilian government, which is dominated by Java programmers.

Thank goodness for Google patents and patents.justia.com (which is HTTP, by the way). Regardless, much more usable than the Patent Office website.

If you look at the url, you notice they are using CGI and Win32 EXEs

Also, once you get your patent search results, clicking on one of the links takes an amount of time that seems to scale with the complexity of the search. So I suspect that they actually re-run the search every time you request a result.

Has anyone built an open index, legal or otherwise? Doesn't seem like it would be too hard to script the downloads and build a real search tool for it.

Wow.

Question: if it's really this bad, this site is going to have incredibly poor ratelimiting or per-IP analytics/access controls, if it has these things at all.

So, it probably wouldn't be too impossible for someone to build a new site (maybe even an API) that talks to this and prettifies the results, lets you copy URLs (most likely via caching¹), and so forth. (The case in point about my previous paragraph is that the new site would generally hitting the old one, possibly several times a second, from one IP.)

You'd just need a strong mind to handle the inanities of talking to this system. :P

¹ But with the caching thing, you'd absolutely have to have a disclaimer stating that the services don't replace the USPTO website, yada yada (along with some wording buried in a policy document that carefully points out that the data is cached). I mean you'd need that anyway, but yeah.

For patents what about: https://assignment.uspto.gov/patent/index.html#/patent/searc...

they actually recommend google on their search page! [1] "You can also try this same search on Google."

[1] https://www.uspto.gov/blog/ebiz/search?q=

> to release system resources allocated for you

Jesus christ.

See also the HTTP shopping cart: http://ebiz1.uspto.gov/vision-service/ShoppingCart_P/ShowSho...

Probably the only thing keeping this from being abused is that it's the government, it's a low-value target, and they're paying millions upon millions for someone to support this trainwreck with security patches.

You think they have a free hand, but they don't. People who work are federal agencies are hemmed in by a thicket of rules that prevent them from just entering into an agreement with a private vendor who has not been through a qualification process. Likewise technicians and administrators are enjoined from spending money on their own initiative, eg you can't just see the problem, sign up for a renewable SSL certificate, and then shoot the bill over the accounts payable.

I don't want to speculate about what's going on at the managerial/administrative level, but I notice the current administration is committed to the goal of slashing most government spending by some huge amount while simultaneously cutting taxes. It may be that the head of the USPTO got a phone call telling them not to spend a single damn penny. Now, iirc the USPTO is actually self-financing on patent application fees, but I don't think they're so independent that they can just ignore directives from higher up in the executive branch.

Maybe they fired or lost the only person left who understood how it works, it broke, and whoever they yanked across the hall to get it going again could only do it this way. I think there's still a govt-wide hiring freeze.

Maybe someone sued them over some highly-innovative encryption patent they've previously granted? :) /s

Well if you put on your tinfoil hat - maybe someone wants to track who's viewing which patents, which they can't do when it's encrypted. You're right, it doesn't make any sense to do this, so there must be an ulterior motive.

I would assume that they do it because HTTPS does complicate the pipeline on several different levels. If you want to tcpdump the https traffic, for example, you need to do SSL/TLS termination at the load balancer to get something readable. Most web servers don't make it easy to inject on the other side of the decryption; I remember having to enable some very verbose debug logs in nginx to accommodate this. Third-party tooling is necessary to take a dump of encrypted traffic and decrypt it for analysis.

It's also possible that their configuration was causing them performance problems and decreasing overhead by killing HTTPS for "unnecessary" endpoints was seen as a potential solution. Requesting a public record about a patent is not something that, at first glance, seems like it should need to be transferred over a secure protocol.

Of course, none of these are really good reasons to disable HTTPS, but they're some potential explanations.

-----

Separately, I think some people who remember HTTPS being used to secure "true secret" pages kind of resent the "HTTPS must be used anywhere and everywhere" trend that has taken hold. It's not that there aren't good reasons to do that, but it's also silly to pretend there aren't side effects of doing it.

From some perspectives, the need to encrypt all communication can be seen as an external concern for something like a VPN tunnel to handle. End-to-end crypto is good because it, theoretically, precludes reception from anyone who can get in the middle of the server and the VPN, but it needs to be more transparent before everyone is willing to consider that a worthwhile/important tradeoff.

One side effect of HTTPS everywhere is that the site can no longer really designate some portion of traffic as "secret". If every admin in your org needs to be able to decrypt all HTTPS traffic to debug issues, you're giving some access away. Maybe some of them would've been able to get to that data anyway, but probably many of them would not.

Again, this is not to say that that HTTPS shouldn't be used, but just some musings into why someone would not necessarily be enthusiastic about it. Working to integrate HTTPS more transparently to admins and working toward the ability to mark specific information for extra "app-layer secrecy" instead of just relying on transport-layer secrecy seem like they'd be good steps.

That _might_ help in a criminal case (IMO unlikely unless you can show some requests were actually modified), but any civil case is going to be decided on balance of probabilities. A slight chance of interception probably wouldn't swing that either way.

HTTPS isn't bulletproof either, the argument could still be made with TLS

You also can't verify that the CA isn't rogue.

Or that the browser vendors that trust the CA the signed the certificate aren't just puppets for our lizard overlords.

Even if the courts allowed this to be a valid defense, it could only protect you from willful infringement. Not having knowledge of an existing patent does not stop the other party from claiming damages. If they can prove you knew that your work infringes the patent, they can sue you for treble damages from willful infringement.

The law doesn't work like that. Sorry.

Don't you only need to be 51% confident? As long as fewer than 50% of all HTTP requests are modified by malicious adversaries in transit, you'd still have to pay up.

Drupal is all over government sites. So is Wordpress. Do you expect them to be using closed source CMSs or something? (I get that Drupal is insecure, but no, it's not "illegal" to use Drupal...)

> Also, at the bottom of the page "This page is owned by Service Desk." What does that mean?

It indicates what department of the USPTO manages that page of the website. All pages have a "page-owner" tag in the footer.

Of course it is. What's the alternative? Writing all the websites, and the web servers hosting them, along with the operating systems, with hand-written assembly or something like that?

Drupal used to run Whitehouse.gov for a long time...

Its not just the US government using Drupal. The Australian Government loves it and pays its contractors very well.

That should be considered a non-fun fact :)

They are basically going to be DOSing a huge segment of users who've previously had that header set on their browsers...they're also violating the OMB mandate that requires TLS for all government sites...it is a rather strange move, I can't imagine there is a good reason for it.

EDIT If it is for portal.uspto.gov then HSTS is a non-issue but still a very bad move.

Removal of HTTPS is on http://portal.uspto.gov/

chrome://net-internals/#hsts

doesn't seem to show anything for the domain

The patent system has evolved in a way that has practically inverted its original intents. You're exactly right, practitioners in a given field (ex: engineers in the tech industry) often avoid looking at patents, because no good can come of it. Most are too vague to be useful for licensing, but it opens one up to willful infringement claims later on.

They are a public storehouse of technologies. We have a right to read them. Some are well written and have useful information for reproducing them rather than just a lot of BS fluff. I just ran across the TMDS encoding patents (DVI & HDMI signaling) a few weeks ago. My thought was "wow, this is a pretty good patent" and conveniently just expired.

Patent lawyers read them and check if your work doesn't infringe. In my company that's standard procedure.

> Immediately after the maintenance, users will only be able to access Public PAIR through URLs beginning with HTTP, such as http://portal.uspto.gov/pair/PublicPair. Past URLs using HTTPS to access Public Pair, such as https://portal.uspto.gov/pair/PublicPair, will no longer work.

So it seems that the maintenance will turn of HTTPS, not that it's unavailable during the maintenance.

I don't think you read the whole thing.

> Immediately after the maintenance, users will only be able to access Public PAIR through URLs beginning with HTTP, such as http://portal.uspto.gov/pair/PublicPair. Past URLs using HTTPS to access Public Pair, such as https://portal.uspto.gov/pair/PublicPair, will no longer work.

I think that's the maintenance period, after which https won't be available.

Immediately after the maintenance, users will only be able to access Public PAIR through URLs beginning with HTTP, such as http://portal.uspto.gov/pair/PublicPair. Past URLs using HTTPS to access Public Pair, such as https://portal.uspto.gov/pair/PublicPair, will no longer work.

> During the maintenance period, Public PAIR will be unavailable.

> Immediately after the maintenance, users will only be able to access Public PAIR through URLs beginning with HTTP,

The USPTO has a bulk download option[0]. The datasets are available from ReedTech[1].

[0] https://www.uspto.gov/learning-and-resources/bulk-data-produ... [1] http://patents.reedtech.com/Public-PAIR.php

Legal issues from mirroring something that's sort-of government property? I have no idea if it is or not, but I'd guess it's some sort of grey area.

The gap between those two technologies is larger than you suggest.

Horse carraiges: 1400 Automobiles: 1890

> Meatspinned quite a few coworkers using it.

Don't do this.

An excellent question. I tried looking up the current policies, but the "IT Policy Library" [1] is provided in an iframe that doesn't load for me ("The connection to the server was reset while the page was loading.").

[1] https://cio.gov/resources/it-policy-library/

To be pickier, they never said that all URLs beginning with 'HTTP' would be enabled, merely that URLs beginning with something other than HTTP would be disabled, and also that URLs beginning with 'HTTPS' would be disabled. They never stated that HTTPS was part of the "doesn't begin with HTTP" group.

I see what you did there.

Does TLS termination cost extra for BigIP? Maybe their license expired or something?

Not sure if it's everything, but the USPTO provides this http://patents.reedtech.com

I wouldn't use the word "illegal" - it's a directive of OMB (the White House's management and budget office), not a law or a regulation or an executive order. The only true enforcers are OMB themselves.

But to answer your other question, as part of the Department of Commerce, a "CFO Act" agency, USPTO would not be exempt.

HTTPS Everywhere*

* except uspto.gov

Are there any other .gov sites doing this? Can anyone shed more light on this?

Never mind that HTTP can easily be man in the middled and tampered with and I have no way to ensure I am communicating to who I think I am.