5 ms·
Other than the notion that all traffic should be served over HTTPs, if you have purely static site, why the big fuss?
by ryanisnan 7y ago
Other than the notion that all traffic should be served over HTTPs, if you have purely static site, why the big fuss?
- thethirdone 7y agoWithout HTTPs links could be replaced and executable file downloads could be replaced with malware.
- ryanisnan 7y agoRight, I wasn't thinking about mitm concerns.
- ummonk 7y agoYou can enable HSTS preload and prevent spoofing.
- dumboluzz 7y agopeople sniffing on what kind of static content you are consuming. think public unsecured wifis or sensitive material.
- ryanisnan 7y agoTrue. I suppose for many types of content that could be a legitimate concern.
- woogley 7y agoThere are plenty of reasons even beyond privacy and MITM content changes. Supposedly HTTPS is better for SEO and also there are browser APIs[1] that only work in HTTPS context [1]: https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts/features_restricted_to_secure_contexts https://developer.mozilla.org/en-US/docs/Web/Security/Secure...
- ryanisnan 7y agoIf you're building an application that requires the uses of these APIs, I'd hardly call that a static site, but maybe that's just me.
- thethirdone 7y agoStatic site generally just refers to the server serving static files. I have several simple games hosted on Github Pages using the storage API which is on that list.
- Avamander 7y agoHTTP/2 is one of those things that only works over HTTPS so it can absolutely be a static site being served over it.