4 ms·

Why? Without HTTPS, anyone between a user and your server can modify your page, without you noticing.

madeofpalk 10y ago
There are certain types of sites where that doesn't really matter. My personal blog, for instance, I don't see the need for HTTPS there. In saying that, HTTPS is easier than ever to deploy to a website. This will only increase adoption of 'secure by default'
- Symbiote 10y ago
  People modifying your page can include ISPs injecting ads or reducing the resolution of images to save bandwidth.
  - userbinator 10y ago
    I'm not the parent, but I say "let them".
    - andybak 10y ago
      How about injecting malware?
      - Klathmon 10y ago
        And this isn't a "it could happen some day" threat, it's already a thing. There are simple one-click setup programs that can monitor a wifi network, and inject malware into any downloads of executable or zip files that it can find. With things like Stagefright still affecting a scary large amount of android users, what happens when someone starts injecting malware into images which can compromise an entire phone without so much as a hiccup.
    - crottypeter 10y ago
      What if they inject hate speech / child porn / <any illegal content> and tell the authorities on you?
      - userbinator 10y ago
        Like I said, "let them". The authorities will see nothing wrong with the content on the server, and look somewhere else. What happens "in transport" is absolutely not my responsibility. It could even serve as a sort of plausible deniability...
  - throwaway6845 10y ago
    Which has long been my suspicion why Google is so keen on promoting HTTPS. If all sites are HTTPS, Google kills ISPs' ability to inject ads and to profile customers. Not through any sense of altruism, but because Google is only interested in one megacorp being able to sell ads and track browsing: Google. It's good business for Google, but let's not pretend it's about "making the web better". It's about keeping commerce on the web as a Google monoculture.
- swiley 10y ago
  @symbiote I'm also unwilling to switch to https. If your ISP is attacking you then you should be tunneling things. I personally like the image compression and caching that they do and think it's somewhat important for my site and others like it.
  - majewsky 10y ago
    Good luck explaining to a non-expert user how they should be "tunneling things" in order to avoid their shitty ISP's non-features.
    - mnw21cam 10y ago
      If your ISP is attacking you, then you should think about switching to a different one.
      - startling 10y ago
        If you're not using https, you have no idea if your ISP, or someone e.g. sitting in your cafe, is attacking you.
      - majewsky 10y ago
        If you have the luxury of multiple ISPs to choose from.
- witty_username 10y ago
  Someone could modify a link in your blog to go to malware. Example: "Hi guys, I like software X, download it here"

There are certain types of sites where that doesn't really matter. My personal blog, for instance, I don't see the need for HTTPS there. In saying that, HTTPS is easier than ever to deploy to a website. This will only increase adoption of 'secure by default'

Symbiote 10y ago
People modifying your page can include ISPs injecting ads or reducing the resolution of images to save bandwidth.
- userbinator 10y ago
  I'm not the parent, but I say "let them".
  - andybak 10y ago
    How about injecting malware?
    - Klathmon 10y ago
      And this isn't a "it could happen some day" threat, it's already a thing. There are simple one-click setup programs that can monitor a wifi network, and inject malware into any downloads of executable or zip files that it can find. With things like Stagefright still affecting a scary large amount of android users, what happens when someone starts injecting malware into images which can compromise an entire phone without so much as a hiccup.
  - crottypeter 10y ago
    What if they inject hate speech / child porn / <any illegal content> and tell the authorities on you?
    - userbinator 10y ago
      Like I said, "let them". The authorities will see nothing wrong with the content on the server, and look somewhere else. What happens "in transport" is absolutely not my responsibility. It could even serve as a sort of plausible deniability...
- throwaway6845 10y ago
  Which has long been my suspicion why Google is so keen on promoting HTTPS. If all sites are HTTPS, Google kills ISPs' ability to inject ads and to profile customers. Not through any sense of altruism, but because Google is only interested in one megacorp being able to sell ads and track browsing: Google. It's good business for Google, but let's not pretend it's about "making the web better". It's about keeping commerce on the web as a Google monoculture.
swiley 10y ago
@symbiote I'm also unwilling to switch to https. If your ISP is attacking you then you should be tunneling things. I personally like the image compression and caching that they do and think it's somewhat important for my site and others like it.
- majewsky 10y ago
  Good luck explaining to a non-expert user how they should be "tunneling things" in order to avoid their shitty ISP's non-features.
  - mnw21cam 10y ago
    If your ISP is attacking you, then you should think about switching to a different one.
    - startling 10y ago
      If you're not using https, you have no idea if your ISP, or someone e.g. sitting in your cafe, is attacking you.
    - majewsky 10y ago
      If you have the luxury of multiple ISPs to choose from.
witty_username 10y ago
Someone could modify a link in your blog to go to malware. Example: "Hi guys, I like software X, download it here"