I've been saying the same for at least a decade, e.g. in https://palant.de/2016/03/02/why-you-should-go-with-secure-by-default-for-your-web-application/ https:/

I've been saying the same for at least a decade, e.g. in https://palant.de/2016/03/02/why-you-should-go-with-secure-by-default-for-your-web-application/ https://palant.de/2016/03/02/why-you-should-go-with-secure-b.... It's ridiculous that somebody still has to explain it.