4 ms·
Yes. Browsers really should maintain HTTP support. There’s no reason to require every static site in the world to be encrypted in transit. And in particular, th
by jtbayly 5y ago
Yes. Browsers really should maintain HTTP support. There’s no reason to require every static site in the world to be encrypted in transit. And in particular, there’s no reason to block off all the actual good websites that are old static sites still serving their purpose.
- wayoutthere 5y agoStick an SSL proxy in front of them and be done with it. This was a solved problem 15 years ago.
- sneak 5y ago> There’s no reason to require every static site in the world to be encrypted in transit. Yes, there is. Encryption doesn't just provide privacy, it also provides authentication. Being able to tamper with downloadable code (i.e. javascript) in transit is a nonstarter. Everything needs to be authenticated, and the way we authenticate data from a webserver in 2021 is by using TLS. Ban port 80.
- phil294 5y agoHere [1] is an interesting article that advocates for not blindly enforcing SSL everywhere as it makes deliberate mitm caching impossible. Also discussed in 2018 [2] [1] https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites-made-them-less-accessible/ https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites... [2] https://news.ycombinator.com/item?id=17707187 https://news.ycombinator.com/item?id=17707187