4 ms·

And it's OK. This "HTTPS everywhere" concept is damaging. I think it should be revised. The amount of overhead and the lack of ability to optimize encrypted con

And it's OK. This "HTTPS everywhere" concept is damaging. I think it should be revised. The amount of overhead and the lack of ability to optimize encrypted content for transferring over, say, satellite or other radio links, is bad. Lots of people still use very expensive (>$2,000 per Mbps) long-RTT connections that would benefit immensely from content optimization techniques. And most of them are cost-sensitive because they live in developing countries.

NhanH 10y ago
Wouldn't that be a whole new level of "premature optimization"? Serve https by default and also http for those still needs it for the reasons you outline.
Ueland 10y ago
Something like gzip that "all" browsers and servers support? Which i would belive more than makes up for any https overhead.
- sleepychu 10y ago
  They're proposing lossy compression. That'd be a neat feature though, during the negotiation (once your comms are encrypted) you could ask the server to perform lossy compression on certain resources, would save battery life on the mobile client as well!
  - Buge 10y ago
    That's kind of what mobile sites do. They shrink the size of the site making it simpler and smaller.
mike-cardwell 10y ago
The trade-off is worth it. By a large margin.
- throwaway16385 10y ago
  YMMV. In my consistent experience over 5+ years, https always performs worse on poor-quality mobile connections here in the UK. In rural areas with EDGE or poor 3G, a given site will simply not load over https but it will (slowly) over http. So the trade-off for me is between "senate.gov doesn't load, at all" and "senate.gov does load, but may leak the information to someone that I was looking at senate.gov, or may potentially be MITMed to give me misleading information about the US senate". The balance of probabilities is such that the trade-off of enforced HTTPS everywhere, on sites like that, is _not_ worth it for me. I obviously don't object to people using HTTPS who want to. Nor do I object to sites where a MITM attack would be catastrophic (e.g. banks) requiring it. What I object to is that, where there's a balance-of-probabilities decision, I am increasingly no longer empowered to take that decision for myself, and the result is that I simply can't view many websites in particular circumstances. Throwaway because being anything other than 100% supportive of HTTPS is the surest way to burn karma on HN.
  - blowski 10y ago
    In this case, the site is enforcing HTTP - you can't view it on HTTPS.
viraptor 10y ago
You mean that super costly 1KB in front of a request that pulls extra megabyte of data on a typical website? I really hope you missed a /s
- blackhaz 10y ago
  I can save about 30% of traffic by optimizing content via HTTP. Can't do that with HTTPS without MITM or similar questionable practices breaking the purpose of HTTPS. While you're sitting on a 100+ Mbps DSL, somebody in the middle of Africa is struggling on an ISDN-like link.
  - blowski 10y ago
    Optimise for the most common case. I imagine there are far more people in the US with broadband connections being put at risk of MITM attacks than people in Kenya with very slow internet trying to look at the US governments website.
    - blackhaz 10y ago
      I am not against HTTPS per se. Use it for sensitive content.
      - blowski 10y ago
        How do you get around the risk of MITM attacks? It's a sensitive site, given the level of authority it carries for the average user.
      - mborch 10y ago
        If you live in a country where you can't trust your ISP then there is a very real MITM risk.
  - boomlinde 10y ago
    What exactly are these techniques that work in plain HTTP but not in HTTPS? It seems like the difference between the two does not pertain to the actual content at all, but I am more curious than knowledgeable in this case.
beedogs 10y ago
This is almost as bad as when people were arguing against long signatures on Usenet. https is the least of your worries in terms of overhead.
- sleepychu 10y ago
  > benefit immensely from content optimization techniques. And most of them are cost-sensitive because they live in developing countries You can't optimise the size of encrypted content until you've downloaded it. It could go through a third party on your behalf but then they argue, what's the point in the encryption at all.
- cdevs 10y ago
  Frameworks everywhere! :)
blowski 10y ago
So serve the same content over both http and https and let the user choose. That said, if making the site very low bandwidth were the goal I would start by removing the pointless images.

NhanH 10y ago

Wouldn't that be a whole new level of "premature optimization"? Serve https by default and also http for those still needs it for the reasons you outline.

Ueland 10y ago

Something like gzip that "all" browsers and servers support? Which i would belive more than makes up for any https overhead.

sleepychu 10y ago
They're proposing lossy compression. That'd be a neat feature though, during the negotiation (once your comms are encrypted) you could ask the server to perform lossy compression on certain resources, would save battery life on the mobile client as well!
- Buge 10y ago
  That's kind of what mobile sites do. They shrink the size of the site making it simpler and smaller.

mike-cardwell 10y ago

The trade-off is worth it. By a large margin.

throwaway16385 10y ago
YMMV. In my consistent experience over 5+ years, https always performs worse on poor-quality mobile connections here in the UK. In rural areas with EDGE or poor 3G, a given site will simply not load over https but it will (slowly) over http. So the trade-off for me is between "senate.gov doesn't load, at all" and "senate.gov does load, but may leak the information to someone that I was looking at senate.gov, or may potentially be MITMed to give me misleading information about the US senate". The balance of probabilities is such that the trade-off of enforced HTTPS everywhere, on sites like that, is _not_ worth it for me. I obviously don't object to people using HTTPS who want to. Nor do I object to sites where a MITM attack would be catastrophic (e.g. banks) requiring it. What I object to is that, where there's a balance-of-probabilities decision, I am increasingly no longer empowered to take that decision for myself, and the result is that I simply can't view many websites in particular circumstances. Throwaway because being anything other than 100% supportive of HTTPS is the surest way to burn karma on HN.
- blowski 10y ago
  In this case, the site is enforcing HTTP - you can't view it on HTTPS.

viraptor 10y ago

You mean that super costly 1KB in front of a request that pulls extra megabyte of data on a typical website? I really hope you missed a /s

blackhaz 10y ago
I can save about 30% of traffic by optimizing content via HTTP. Can't do that with HTTPS without MITM or similar questionable practices breaking the purpose of HTTPS. While you're sitting on a 100+ Mbps DSL, somebody in the middle of Africa is struggling on an ISDN-like link.
- blowski 10y ago
  Optimise for the most common case. I imagine there are far more people in the US with broadband connections being put at risk of MITM attacks than people in Kenya with very slow internet trying to look at the US governments website.
  - blackhaz 10y ago
    I am not against HTTPS per se. Use it for sensitive content.
    - blowski 10y ago
      How do you get around the risk of MITM attacks? It's a sensitive site, given the level of authority it carries for the average user.
    - mborch 10y ago
      If you live in a country where you can't trust your ISP then there is a very real MITM risk.
- boomlinde 10y ago
  What exactly are these techniques that work in plain HTTP but not in HTTPS? It seems like the difference between the two does not pertain to the actual content at all, but I am more curious than knowledgeable in this case.

beedogs 10y ago

This is almost as bad as when people were arguing against long signatures on Usenet. https is the least of your worries in terms of overhead.

sleepychu 10y ago
> benefit immensely from content optimization techniques. And most of them are cost-sensitive because they live in developing countries You can't optimise the size of encrypted content until you've downloaded it. It could go through a third party on your behalf but then they argue, what's the point in the encryption at all.
cdevs 10y ago
Frameworks everywhere! :)

blowski 10y ago

So serve the same content over both http and https and let the user choose. That said, if making the site very low bandwidth were the goal I would start by removing the pointless images.