3 ms·

I don't understand the holy war against http. Let those who want https use it. Forcing the additional friction of certificates on every site and use case is dum

I don't understand the holy war against http. Let those who want https use it. Forcing the additional friction of certificates on every site and use case is dumb. Not even touching on the fundamentally flawed trust model behind https, here's a sample of recent stories about expired certificates: https://news.ycombinator.com/item?id=25132182 https://news.ycombinator.com/item?id=25132182 https://news.ycombinator.com/item?id=24237400 https://news.ycombinator.com/item?id=24237400 https://news.ycombinator.com/item?id=24187920 https://news.ycombinator.com/item?id=24187920 https://news.ycombinator.com/item?id=22227266 https://news.ycombinator.com/item?id=22227266 https://news.ycombinator.com/item?id=18649932 https://news.ycombinator.com/item?id=18649932 https://news.ycombinator.com/item?id=16541235 https://news.ycombinator.com/item?id=16541235

spartanatreyu 5y ago
1. Can you give a use case for a website that needs no security what so ever? 2. Don't. Your web host should be doing it for you.
- netr0ute 5y ago
  > 1. Can you give a use case for a website that needs no security what so ever? http://neverssl.com http://neverssl.com
  - tialaramex 5y ago
    But, when was the last time you needed that? My phone and my laptops both seem to correctly notice (via services for the purpose) when there isn't proper Internet access and give me access to some awful Captive Portal to fix that, for which they do not need neverssl.com. This desktop never leaves my home, which doesn't have any such nonsense. The services they use to do that do involve plaintext HTTP, but importantly they aren't trying to just be something you type into a web browser, and so aren't affected by automatic upgrades of stuff you type into a web browser.
    - iso1631 5y ago
      > But, when was the last time you needed that? Sunday, thanks to a broken middlebox
- inshadows 5y ago
  1. http://n-gate.com/ http://n-gate.com/ 2. You sure place a lot of trust into third parties.
  - cmeacham98 5y ago
    The site links a Patreon, probably not something you want messed with in transit.
    - Arnavion 5y ago
      Actually I think that website's owner will be delighted if a MITM leads to you wasting your money by sending it to the wrong person.
notatoad 5y ago
it's not a "war against http". it's a shift from indicating that http is the normal state and https is the abnormal state, to https being the normal state and non-https being abnormal. which is just a reflection of reality.

spartanatreyu 5y ago

1. Can you give a use case for a website that needs no security what so ever? 2. Don't. Your web host should be doing it for you.

netr0ute 5y ago
> 1. Can you give a use case for a website that needs no security what so ever? http://neverssl.com http://neverssl.com
- tialaramex 5y ago
  But, when was the last time you needed that? My phone and my laptops both seem to correctly notice (via services for the purpose) when there isn't proper Internet access and give me access to some awful Captive Portal to fix that, for which they do not need neverssl.com. This desktop never leaves my home, which doesn't have any such nonsense. The services they use to do that do involve plaintext HTTP, but importantly they aren't trying to just be something you type into a web browser, and so aren't affected by automatic upgrades of stuff you type into a web browser.
  - iso1631 5y ago
    > But, when was the last time you needed that? Sunday, thanks to a broken middlebox
inshadows 5y ago
1. http://n-gate.com/ http://n-gate.com/ 2. You sure place a lot of trust into third parties.
- cmeacham98 5y ago
  The site links a Patreon, probably not something you want messed with in transit.
  - Arnavion 5y ago
    Actually I think that website's owner will be delighted if a MITM leads to you wasting your money by sending it to the wrong person.

notatoad 5y ago

it's not a "war against http". it's a shift from indicating that http is the normal state and https is the abnormal state, to https being the normal state and non-https being abnormal. which is just a reflection of reality.