4 ms·

Well yeah but the GPG key is also served insecurely: http://www.tarsnap.com/tarsnap-signing-key-2020.asc http://www.tarsnap.com/tarsnap-signing-key-2020.asc

• cperciva 6y ago
  ... you know you can change that URL to start "https" if you like?
  • beervirus 6y ago
    With HSTS, you don't have to.
  • ifdefdebug 6y ago
    Of course you are right, but some commonly accepted procedure nowadays is to do that automatically with a redirect, as a service for the user. Sure, you may have a reason for not to do so, but instead of dismissing a valid argument you could maybe explain why not ... Edit: On second thought, I recognize this whole subthread started with the wrong tone ("ironic", "reckless"), kind of dismissive or patronizing and not calling for a constructive discussion, so please disregard this comment of mine, sorry.
    • _-___________-_ 6y ago
      I do think that a certain level of scrutiny is invited by using a term like "for the truly paranoid".