5 ms·
Maybe we could use a doctype that allows for plain websites (no js, no forms, no inputs) to be accessed without a warning from the browser when not using https.
by preommr 6y ago
Maybe we could use a doctype that allows for plain websites (no js, no forms, no inputs) to be accessed without a warning from the browser when not using https.
- toyg 6y agoThat would be nice, but not even wikipedia would use it.
- the8472 6y agoAll of that can be achieved with CSP headers. But I think browser vendors will ratchet up their rhetoric and claim it's still unsafe and must be warned about because someone may learn which site a user visited.
- nicbou 6y agoThat would still open you up to MITM attacks
- marcosdumay 6y agoMITM attacks aren't much of a problem if you are just displaying some static HTML from a random blog, can't show anything else, and the user has a large confidence his browsing history won't be used against him by any large internet party (any telecom, government, your hotel, etc, even the ones not on the obvious path). I guess that last one is a pretty big dealbreaker, but I can understand somebody saying "it's just a site full of old jokes, I don't care about it".
- discreditable 6y ago> displaying some static HTML from a random blog Hard ask given how many don't work with JS disabled.