short answer is - yes, we've reached that point. https by default is a reasonable default, in part because cpu and latency costs of https are basically zero fo

short answer is - yes, we've reached that point. https by default is a reasonable default, in part because cpu and latency costs of https are basically zero for most implementations. And the implementations where it's not zero can afford the cost. Given the almost-no-cost of the choice, why default to the less-secure alternative?