4 ms·
While this is obviously useful for anything with a login, there are many content and consumption sites that simply don't need HTTPS.
by notadoc 10y ago
While this is obviously useful for anything with a login, there are many content and consumption sites that simply don't need HTTPS.
- tdkl 10y agoYeah, can't wait till my CV and project descriptions (not hosted there) static Jekyll site is somehow insecure and dangerous. [edit] I'll guess I'll have to find a new host then, since Github pages doesn't support https on custom domains. Perhaps Netlify, seems to support Github hooks.
- charleslmunger 10y agoIf you're serving them over plaintext http, then they're already insecure. How dangerous that is might be debatable, but there's no doubt that it's insecure.
- gruez 10y agogitlab pages has https support built in
- nothrabannosir 10y agoFor custom domains? I doubt it. Op is not talking about https://<username>.github.io https://<username>.github.io.
- ben0x539 10y agoComment you're responding to said gitlab, not github. Maybe those code hosting sites need to become more creative in their naming...
- nothrabannosir 10y agoThe comment I was responding to was talking about gitlab having SSL on their <username>.gitlab.io pages. While correct, that is besides the point OP was making. Which was about custom domains. Gitlab doesn't offer that, either.
- Buge 10y agoWell China intercepts http traffic and inserts javascript malware joining users into a botnet that DDOSes github pages of human rights organizations. It depends on what you mean by insecure and dangerous.
- crooked-v 10y ago"Your users can't be easily MITM attacked when they visit your site" is a pretty big benefit to every site out there.
- kps 10y ago> Your users can't be easily MITM attacked Ha, ha. Your browser trusts your corporate/institutional/national proxy, or else.
- diafygi 10y agoYou are forgetting half of the benefit of HTTPS. Not only is content kept secret, but it is also kept unmodified. Even if your don't care about secrecy, you should use HTTPS to ensure your content doesn't have ads or malware injected into it by your ISP (which happens) or a WiFi hijacker (which happens). If a user of yours sees an ad or gets a virus from someone injecting it in your website, they are going to blame you. HTTPS protects the site owner just as much as the site user.
- notadoc 10y agoHmm, good point. The ad injection thing is quite relevant to developing markets, where many ISPs routinely inject ads onto sites. But it's certainly more overhead particularly for mom and pop businesses. I suppose it will drum up a lot of business for web developers though, a Chrome stimulus of sorts.
- robwormald 10y agothe other thing to note is that a lot of new APIs (and older ones which are being updated) require HTTPS - geolocation, webBT, webUSB, service workers, etc, all require HTTPS (or will, soon).