5 ms·

> To the authors: Please drop TLS in front of your site. It's near trivial and free. Curious why you think it is needed in this case.

brownianemotion 6y ago
It's a trusted site, without https it's e.g. easier to perform a mitm attack that could expose users to attacks. Not only encryption is important, authentication too, you want to know to which party you are talking.
- pc86 6y ago
  What attacks is a malicious agent going to execute on a page of articles? I think HTTPS is all well and good, but I've yet to hear a compelling reason why pages of text and images need it.
  - brownianemotion 6y ago
    The thing is, once you man in the middle it, without https, you can serve whatever content you want. It is no longer a page of "text and images", but one with malicious scripts, malicious links, ... you name it.
MaxBarraclough 6y ago
This topic crops up occasionally. With very few exceptions, all web content sent over the public Internet should be protected with HTTPS. The question isn't Why?, but Why haven't they bothered yet? There are plenty of reasons to use HTTPS [0] relating to privacy, security, UI, and browser features, and there are virtually no good reasons not to. There are just 2 real exceptions I know of, neither of which apply here: 1. Using unprotected HTTP enables caching. In the context of something like an apt repo, or Steam, this could be a compelling advantage. (apt provides its own checksum-based security, and doesn't really aim for privacy.) 2. Very old smartphones might not support modern TLS. In some parts of the world this can be a real concern. Even here, HTTPS should be offered, just not required. [0] https://news.ycombinator.com/item?id=22147858 https://news.ycombinator.com/item?id=22147858
- trabant00 6y ago
  I know the general case for HTTPS. I am a system administrator. I was asking for this particular case where I for one see no need.
  - asdffdsa 6y ago
    mitm with an identical page but malicious links
  - criddell 6y ago
    To prevent things like the Great Cannon of China from performing a denial of service attack against a third party.
  - MaxBarraclough 6y ago
    > I for one see no need asdffdsa mentioned plain old MITM. I listed several other applicable reasons in my linked comment: 1. It allows an unscrupulous ISP to more easily track your browsing 2. Modern browsers will rightly warn users not to trust the site. This makes the site look bad. 3. It prevents MITM injection of ads, trackers, and most importantly malware. There will always be browser exploits, so they're worth blocking.
yjftsjthsd-h 6y ago
https://www.cloudflare.com/learning/ssl/why-use-https/ https://www.cloudflare.com/learning/ssl/why-use-https/

brownianemotion 6y ago

It's a trusted site, without https it's e.g. easier to perform a mitm attack that could expose users to attacks. Not only encryption is important, authentication too, you want to know to which party you are talking.

pc86 6y ago
What attacks is a malicious agent going to execute on a page of articles? I think HTTPS is all well and good, but I've yet to hear a compelling reason why pages of text and images need it.
- brownianemotion 6y ago
  The thing is, once you man in the middle it, without https, you can serve whatever content you want. It is no longer a page of "text and images", but one with malicious scripts, malicious links, ... you name it.

MaxBarraclough 6y ago

This topic crops up occasionally. With very few exceptions, all web content sent over the public Internet should be protected with HTTPS. The question isn't Why?, but Why haven't they bothered yet? There are plenty of reasons to use HTTPS [0] relating to privacy, security, UI, and browser features, and there are virtually no good reasons not to. There are just 2 real exceptions I know of, neither of which apply here: 1. Using unprotected HTTP enables caching. In the context of something like an apt repo, or Steam, this could be a compelling advantage. (apt provides its own checksum-based security, and doesn't really aim for privacy.) 2. Very old smartphones might not support modern TLS. In some parts of the world this can be a real concern. Even here, HTTPS should be offered, just not required. [0] https://news.ycombinator.com/item?id=22147858 https://news.ycombinator.com/item?id=22147858

trabant00 6y ago
I know the general case for HTTPS. I am a system administrator. I was asking for this particular case where I for one see no need.
- asdffdsa 6y ago
  mitm with an identical page but malicious links
- criddell 6y ago
  To prevent things like the Great Cannon of China from performing a denial of service attack against a third party.
- MaxBarraclough 6y ago
  > I for one see no need asdffdsa mentioned plain old MITM. I listed several other applicable reasons in my linked comment: 1. It allows an unscrupulous ISP to more easily track your browsing 2. Modern browsers will rightly warn users not to trust the site. This makes the site look bad. 3. It prevents MITM injection of ads, trackers, and most importantly malware. There will always be browser exploits, so they're worth blocking.

yjftsjthsd-h 6y ago

https://www.cloudflare.com/learning/ssl/why-use-https/ https://www.cloudflare.com/learning/ssl/why-use-https/