3 ms·

Because it's only the correct version of the web site that comprises "HTML, CSS, and JPG". The problem isn't about what the correct version of site contains, it

Because it's only the correct version of the web site that comprises "HTML, CSS, and JPG". The problem isn't about what the correct version of site contains, it's about what the intercepted version contains. Anyone in the middle can change the web site into anything they like. They could add a "donate link", saying that the author needs money to sustain the site.

prepend 5y ago
I don’t think this is not a likely enough situation to affect design. I think the author is stating that it is an acceptable risk, and users shouldn’t care.
- notafraudster 5y ago
  As I mention in my top-level comment, it seems reasonable to say "I don't really care about surveillance risk of my low traffic blog", but it's a bit incongruous when it's combined with "I care a great deal that Big SSL might be rope-a-doping me and five years from now they'll charge me money for my SSL cert for my low traffic blog, and if you don't like it, it's your problem!" We're talking about a free thing that on one hand takes five minutes to set up and on the other hand provides almost no benefit! It's hard to imagine lower stakes for anyone involved.
  - prepend 5y ago
    My time is very valuable as I need to spend it commenting on HN. 5 minutes every two months isn’t a great amount, but it’s great compared to the benefit to this blogger. I can imagine lower stakes with something that takes zero minutes.
    - AstralStorm 5y ago
      Maintaining your own web server costs more than that. Zero minutes would use an external provider. Otherwise you're opening an unmaintained insecure webserver - a potential bounce for all sorts of illegal activity.
bjourne 5y ago
The site happens to have a donate page: http://misc-stuff.terraaeon.com/donate.html http://misc-stuff.terraaeon.com/donate.html From my perspective, it doesn't matter much if that page was added through a MITM attack or not - I neither know nor trust the author of the site and have no inclination of donating money to them.

prepend 5y ago

I don’t think this is not a likely enough situation to affect design. I think the author is stating that it is an acceptable risk, and users shouldn’t care.

notafraudster 5y ago
As I mention in my top-level comment, it seems reasonable to say "I don't really care about surveillance risk of my low traffic blog", but it's a bit incongruous when it's combined with "I care a great deal that Big SSL might be rope-a-doping me and five years from now they'll charge me money for my SSL cert for my low traffic blog, and if you don't like it, it's your problem!" We're talking about a free thing that on one hand takes five minutes to set up and on the other hand provides almost no benefit! It's hard to imagine lower stakes for anyone involved.
- prepend 5y ago
  My time is very valuable as I need to spend it commenting on HN. 5 minutes every two months isn’t a great amount, but it’s great compared to the benefit to this blogger. I can imagine lower stakes with something that takes zero minutes.
  - AstralStorm 5y ago
    Maintaining your own web server costs more than that. Zero minutes would use an external provider. Otherwise you're opening an unmaintained insecure webserver - a potential bounce for all sorts of illegal activity.

bjourne 5y ago

The site happens to have a donate page: http://misc-stuff.terraaeon.com/donate.html http://misc-stuff.terraaeon.com/donate.html From my perspective, it doesn't matter much if that page was added through a MITM attack or not - I neither know nor trust the author of the site and have no inclination of donating money to them.