4 ms·

I like how the blog page itself is on http.

• nicexe 6y ago
  It is also served for https
• superkuh 6y ago
  HTTP and HTTPS are not mutually exclusive. They're synergistic. The idea that a hypothetical downgrade attack is enough justification to kill off HTTP everywhere is incredibly business-centric and stupid. Most sites are not transacting currency or private information. A centralized cert is just that, centralized. Even if it's LetsEncrypt that's still a single point of failure for organizational corruption (ie, what happened to dot org), accidents (as cert providers mess up regularly) and government control. It's a long leash but if HTTPS is the only option (as is the trend) it's still a leash. Almost all sites should be HTTP and HTTPS.
  • cnst 6y ago
    > Most sites are not transacting currency or private information. > Almost all sites should be HTTP and HTTPS. This. Most people aren't even aware that Google.com is still both HTTP and HTTPS; you can easily test with curl or lynx to verify yourself. If your browser doesn't support HTTPS (e.g., maybe its blocked in your library or another free wifi), then Google.com would still work just fine. (Another question is that many other sites aren't as easily available, sadly.)
    • account42 6y ago
      Yet chrome doesn't let others on the HSTS preload list if you don't force all users onto HTTPS.