3 ms·

The visitor cannot be sure that he really is connected to git.cypherpunks.ru. But doesn't encryption work anyway?

• rakoo 6y ago
  Encryption is active with a host you don't know. It's TOFU, which is OK if you can verify the identity through persistent uses (ie with SSH you'll have connections with the same server over a long period of time, or with IM you'll talk to those people over a long period of time). In the case of HTTP you'll only get the content now and potentially not visit the site anymore for a long time, especially if it's a personal site. A few years ago self-signed certificates made some sense, today with Let's Encrypt there is absolutely no good reason to continue doing this on the open web