5 ms·

Kinda unforgivable to be on front page of HN in 2021 without https

bellyfullofbac 5y ago
Why exactly? Other than a lot of "potential problems" security theater? People still send postcards, where they don't care if people read what's written on it..
- jimmygrapes 5y ago
  Practically speaking, it is because some modern browsers (and extensions) will throw up an error (either by-passable or not) if it's HTTP only. Yeah it's not necessary in many cases, but it's growing to be the standard expected behavior.
  - benatkin 5y ago
    Which ones, pray tell?
    - hollerith 5y ago
      I've seen the warnings in both Chrome and Firefox.
  - generalizations 5y ago
    I'm sure the readers of hacker news can deal with that.
- unnouinceput 5y ago
  Because of ISP's between me and the target http awful track record of injecting their code full of crap, that's why.
- deleted 5y ago
  [deleted]
- alexander-litty 5y ago
  People also expect their postcards to arrive untampered. ISPs, Comcast in particular, inject ad-loading javascript into HTTP pages. https://arstechnica.com/tech-policy/2014/09/why-comcasts-javascript-ad-injections-threaten-security-net-neutrality/ https://arstechnica.com/tech-policy/2014/09/why-comcasts-jav... https://www.reddit.com/r/technology/comments/9b5ikd/ https://www.reddit.com/r/technology/comments/9b5ikd/
  - ipaddr 5y ago
    In fairness isn't that a result of your relationship with your isp? If you remain because of price or no other services available why wouldn't you use a vpn knowing your isp is a hostile actor and probably trying to deeply inspect packets, etc?
    - hutrdvnj 5y ago
      Because if you use HTTP over VPN, then you really have to trust your VPN provider. Why should you do that?
      - ipaddr 5y ago
        You can be your own vpn provider if thats a big concern. Your isp knows you visited a certain domain with https. That's a concern.
        hutrdvnj 5y ago
        > You can be your own vpn provider if thats a big concern. You just shift the trust around. Now I have to trust the hoster, e.g. OVH instead of my local ISP. Really the best thing you can do is end-to-end encryption, don't send plaintext over the internet. > Your isp knows you visited a certain domain with https. That's a concern. How about DNS over HTTPS?
    - deleted 5y ago
      [deleted]
    - 5y ago
- spoonjim 5y ago
  Because it’s the expected behavior. If you showed up to an interview for an attorney position and your interviewer was shirtless you’d think they’d lost their mind.
  - bellyfullofbac 5y ago
    Was it normal to go to job interviews shirtless 10-15 years ago? Please come up with a better analogy ;-) Grandparent said "unforgivable".. sheesh, over the top much?
chrismorgan 5y ago
Info for the curious: There tend to be about 0–2 http: entries on the front page. A fairly large fraction of those are old things. http: submissions on domains that support https: (whether or not they redirect to it by default) are very uncommon.
tomcooks 5y ago
Yes beware of the friendly dragon stealing your credit card info

Why exactly? Other than a lot of "potential problems" security theater? People still send postcards, where they don't care if people read what's written on it..

jimmygrapes 5y ago
Practically speaking, it is because some modern browsers (and extensions) will throw up an error (either by-passable or not) if it's HTTP only. Yeah it's not necessary in many cases, but it's growing to be the standard expected behavior.
- benatkin 5y ago
  Which ones, pray tell?
  - hollerith 5y ago
    I've seen the warnings in both Chrome and Firefox.
- generalizations 5y ago
  I'm sure the readers of hacker news can deal with that.
unnouinceput 5y ago
Because of ISP's between me and the target http awful track record of injecting their code full of crap, that's why.
deleted 5y ago
[deleted]
alexander-litty 5y ago
People also expect their postcards to arrive untampered. ISPs, Comcast in particular, inject ad-loading javascript into HTTP pages. https://arstechnica.com/tech-policy/2014/09/why-comcasts-javascript-ad-injections-threaten-security-net-neutrality/ https://arstechnica.com/tech-policy/2014/09/why-comcasts-jav... https://www.reddit.com/r/technology/comments/9b5ikd/ https://www.reddit.com/r/technology/comments/9b5ikd/
- ipaddr 5y ago
  In fairness isn't that a result of your relationship with your isp? If you remain because of price or no other services available why wouldn't you use a vpn knowing your isp is a hostile actor and probably trying to deeply inspect packets, etc?
  - hutrdvnj 5y ago
    Because if you use HTTP over VPN, then you really have to trust your VPN provider. Why should you do that?
    - ipaddr 5y ago
      You can be your own vpn provider if thats a big concern. Your isp knows you visited a certain domain with https. That's a concern.
      - hutrdvnj 5y ago
        > You can be your own vpn provider if thats a big concern. You just shift the trust around. Now I have to trust the hoster, e.g. OVH instead of my local ISP. Really the best thing you can do is end-to-end encryption, don't send plaintext over the internet. > Your isp knows you visited a certain domain with https. That's a concern. How about DNS over HTTPS?
  - deleted 5y ago
    [deleted]
  - 5y ago
spoonjim 5y ago
Because it’s the expected behavior. If you showed up to an interview for an attorney position and your interviewer was shirtless you’d think they’d lost their mind.
- bellyfullofbac 5y ago
  Was it normal to go to job interviews shirtless 10-15 years ago? Please come up with a better analogy ;-) Grandparent said "unforgivable".. sheesh, over the top much?

chrismorgan 5y ago

Info for the curious: There tend to be about 0–2 http: entries on the front page. A fairly large fraction of those are old things. http: submissions on domains that support https: (whether or not they redirect to it by default) are very uncommon.

tomcooks 5y ago

Yes beware of the friendly dragon stealing your credit card info