4 ms·
Should static content be encrypted over https? I think it's fair for chrome to call out with an x as I've literally seen local lunch joints take orders with cre
by ninjakeyboard 11y ago
Should static content be encrypted over https? I think it's fair for chrome to call out with an x as I've literally seen local lunch joints take orders with credit card info over http but to serve mostly static pages like the new yorker over http only means that the user's privacy is compromised in that people can see what you're reading - does that warrant down ranking searches? I'm just curious - I work mostly on platforms so I'm not too aware of all of the incentives for trying to move everyone to https as it's not my problem domain necessarily.
- eknkc 11y agoOne issue is content injection. You never know what transparent proxies are between you and the server, any one of them can add / remove content, scripts, tracking stuff etc to the static pages. You can't even be sure if your current DNS server resolved to the actual server and not some shady proxy. I believe Comcast has been accused of doing something shady like that but I don't live in US and have no idea. Just read the news.
- Spooky23 11y agoBecause mobile carriers are given broad discretion to do whatever they want to do to your traffic. They cheerfully modify content, and have built infrastructure to do it even more.
- ninjakeyboard 11y agohmm ya this is a good point.