4 ms·
Unrelated: should a site like this be running ssl/https? What’s the case for not? It’s certainly not for a lack of skills and this is not meant to be a dig, jus
by social_quotient 7y ago
Unrelated: should a site like this be running ssl/https? What’s the case for not? It’s certainly not for a lack of skills and this is not meant to be a dig, just thought maybe I’m missing something and safari made sure to tell me that it was “not secure”.
- madiathomas 7y agoMine is running HTTPS. Even when I try to force it to use HTTP, it redirects me to HTTPS. I am on Chrome.
- tuukkah 7y agoChrome on Android says: "This site can’t provide a secure connection paulgraham.com uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH" Edit: This is when I try to load https://paulgraham.com/ycstart.html https://paulgraham.com/ycstart.html
- madiathomas 7y agoSorry. I thought you were talking about Hacker News. Maybe it doesn't require HTTPS because there is no transmission of any sensitive data.
- huseyinkeles 7y agoIt's not just about sensitive data, your ISP can easily inject some crap into the website if it's not on HTTPS for example. (it happened in the past many times) Here's an example; https://security.stackexchange.com/questions/157828/my-isp-bsnl-india-is-injecting-ads-using-phozeca-which-spoils-websites-and-mak https://security.stackexchange.com/questions/157828/my-isp-b...
- madiathomas 7y agoNow that's bad. I never thought of that possibility.
- wolco 7y agoIf possible change isp to another provider. If they are doing this I can imagine what else they are doing in private with your traffic.
- huseyinkeles 7y agoNot my ISP. I’m mostly on VPN anyway :)
- zcrackerz 7y agoThere's really no reason to secure a site if it's just informational or someone's blog. The worst that's going to happen in this case is someone might be able to see the blog sent to you in plain text, which is no big deal, because it's public anyway. Now if it has a form asking you to enter personal information or credit card numbers, you would definitely want SSL.
- htgb 7y agoThat's not entirely true though: plaintext doesn't only allow snooping but also man-in-the-middle attacks such as injecting malicious code or ads.