3 ms·

> Because plenty of unscrupulous ISPs and governments log unencrypted web traffic. Ok. Not relevant here. I don't care if my ISP knows I'm learning SELinux. An

> Because plenty of unscrupulous ISPs and governments log unencrypted web traffic. Ok. Not relevant here. I don't care if my ISP knows I'm learning SELinux. And they would know that even with HTTPS. > Some ISPs use that information for advertising, or inject custom javascript into unencrypted web pages Sounds like an ISP problem. Buy service from a better one. No need to impose SSL on the website for this. > HTTPS is free Absolutely not. It takes time and effort to set up. And then maintain forever. Plus you're introducing an unnecessary dependency on multiple third parties. > HTTPS is fast HTTP is faster.

Hikikomori 5y ago
>Sounds like an ISP problem. Buy service from a better one. No need to impose SSL on the website for this. Just move I guess.
- perryizgr8 5y ago
  Or don't. It's not a problem that needs to be solved server-side.
  - josephg 5y ago
    It is a problem to solve over the wire, because we should assume at this point that bytes over the internet are monitored. Both in the east (Great Firewall of China) and the west (NSA + Snowden). I don't want my ISP or my government knowing which websites I'm visiting, what apps I open on my phone or, really anything else about me without a court order. Insecure-by-default is a bad default. To protect users, traffic over the internet should always be encrypted. Even if you don't care, as a user I care. And thankfully the people in charge of our software, protocols and ecosystem are slowly forcing the issue on our behalf: - Unencrypted http will eventually be deprecated from web browsers. (Newer browser features are already banned in insecure contexts). - iOS forbids applications from making unencrypted HTTP connections. - The IETF more or less requires new protocols to be secure. We'll see more of this over time. Its a good thing. Get on board.
josephg 5y ago
> HTTP is faster. Thats not always true, thanks to awful middleware boxes. Especially inside corporate networks. Also TLS is required for http2 - which is much faster than HTTP1.1 in almost every case. > It takes time and effort to set up. And then maintain forever. People level the exact same accusations at SELinux. Some would say SELinux doesn't add a lot of security, and its a pain to set up and maintain. HTTPS is much easier to set up than SELinux thanks to letsencrypt and certbot. And it adds real security for your users. Its weird to promote SELinux but not bother with TLS. But all these complaints are moot in this case anyway because this website is hosted by github pages[1]. Github will do all the heavy lifting to make HTTPS work. The owner just needs to set DNS up: https://docs.github.com/en/pages/configuring-a-custom-domain-for-your-github-pages-site/troubleshooting-custom-domains-and-github-pages#https-errors https://docs.github.com/en/pages/configuring-a-custom-domain... Oh yeah and you know what I was saying about http2 being faster than http1.1? Github enables http2 automatically on github pages. But only, y'know, if you set your site up correctly. [1] At least according to the invalid cert warnings I'm seeing

Hikikomori 5y ago

>Sounds like an ISP problem. Buy service from a better one. No need to impose SSL on the website for this. Just move I guess.

perryizgr8 5y ago
Or don't. It's not a problem that needs to be solved server-side.
- josephg 5y ago
  It is a problem to solve over the wire, because we should assume at this point that bytes over the internet are monitored. Both in the east (Great Firewall of China) and the west (NSA + Snowden). I don't want my ISP or my government knowing which websites I'm visiting, what apps I open on my phone or, really anything else about me without a court order. Insecure-by-default is a bad default. To protect users, traffic over the internet should always be encrypted. Even if you don't care, as a user I care. And thankfully the people in charge of our software, protocols and ecosystem are slowly forcing the issue on our behalf: - Unencrypted http will eventually be deprecated from web browsers. (Newer browser features are already banned in insecure contexts). - iOS forbids applications from making unencrypted HTTP connections. - The IETF more or less requires new protocols to be secure. We'll see more of this over time. Its a good thing. Get on board.

josephg 5y ago

> HTTP is faster. Thats not always true, thanks to awful middleware boxes. Especially inside corporate networks. Also TLS is required for http2 - which is much faster than HTTP1.1 in almost every case. > It takes time and effort to set up. And then maintain forever. People level the exact same accusations at SELinux. Some would say SELinux doesn't add a lot of security, and its a pain to set up and maintain. HTTPS is much easier to set up than SELinux thanks to letsencrypt and certbot. And it adds real security for your users. Its weird to promote SELinux but not bother with TLS. But all these complaints are moot in this case anyway because this website is hosted by github pages[1]. Github will do all the heavy lifting to make HTTPS work. The owner just needs to set DNS up: https://docs.github.com/en/pages/configuring-a-custom-domain-for-your-github-pages-site/troubleshooting-custom-domains-and-github-pages#https-errors https://docs.github.com/en/pages/configuring-a-custom-domain... Oh yeah and you know what I was saying about http2 being faster than http1.1? Github enables http2 automatically on github pages. But only, y'know, if you set your site up correctly. [1] At least according to the invalid cert warnings I'm seeing