4 ms·
This site serves executables and script files via HTTP. Those potentially dangerous files are thus neither encrypted nor - and that's the bad part - authenticat
by Kenji 7y ago
This site serves executables and script files via HTTP. Those potentially dangerous files are thus neither encrypted nor - and that's the bad part - authenticated, meaning that any man in the middle can inject content that infects your machine.
I draw the line at this point. Serve with HTTP if you just have some text. Serve with HTTPS if you have logins, sensitive information or executables and scripts.
- pixl97 7y agoIf I mitm you, your plain txt website now serves scripts. That's what everybody seems to miss. I can change your content type headers online. In theory the only way this would work is if browsers would not do javascript at all, or any other type of executable content on http sites.
- bulatb 7y agoOr modify a TIFF or JPEG or whatever to attack the parser. That ancient system with no modern crypto that can only do HTTP is fully patched, right?