> Of course there is. If they're HTTP, they're insecure, which makes them an open attack vector. If so they are only insecure because malicious JS can be MITMe

> Of course there is. If they're HTTP, they're insecure, which makes them an open attack vector. If so they are only insecure because malicious JS can be MITMed into them, and realistically speaking browsers can’t defend against malicious JS. > Modern computer security is about removing as many known possible attack vectors as possible. So let’s remove enabled-by-default JS permissions instead of removing HTTP-content. Most old websites don’t depend on JS and would in fact be just fine. Even better: make JS opt-in only for HTTP websites, and let users like me refuse the “upgrade” to HTTPS.