https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs... - MITM attacks - Ad/message

https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs... - MITM attacks - Ad/message injection - Malware injection - Censorship > Furthermore, because it is self hosted there are several physical machines at different locations which serve as backups and are selected by updating the DNS records, which I believe is incompatible with a basic lets encrypt system. Sure. But it's not that much more harder to do it. Use something like the caddy server and have it manage certificate deployment for you. Unless there's a client that you intend to serve that absolutely cannot handle SSL/TLS, I cannot see a reason why you'd want to stick with HTTP. And no, I don't consider IE6 as a valid excuse. You can always use an older version of Firefox on Windows 2k and it'll solve this problem. I honestly don't think I can trade all the above for more compatibility with ancient machines. > but I am solidly in the camp that if you believe your ISP is attacking you you need to use a VPN for all of your traffic, because injecting ads is the least of your worries at that point. I don't understand this. If your resistance to switch is to make it easy for anyone with any browser to use your web page, then expecting them to use a VPN because they have a terrible ISP because you refuse to use HTTPS makes their life more difficult. Surely, they don't see this problem with other websites that use HTTPS but now need to go get a VPN service just to use yours. Also, we're assuming VPNs are absolute saints here. Not really true. But even if it were true, a VPN is eventually someone else's ISP. You're hoping nothing and absolutely nothing in the routing topology will ever look at your data or bother to inject into it.