5 ms·
PG's website pretty much does this e.g. from 2003: http://www.paulgraham.com/hundred.html http://www.paulgraham.com/hundred.html most recent post in 2022: htt
by chubot 4y ago
PG's website pretty much does this
e.g. from 2003: http://www.paulgraham.com/hundred.html http://www.paulgraham.com/hundred.html
most recent post in 2022: http://www.paulgraham.com/heresy.html http://www.paulgraham.com/heresy.html
I'm not sure I would want to have all my writing in a single directory, but I guess you can't argue with 20 years of longevity ... on both sivers' site and PG's.
- onion2k 4y agoYou can't determine the file system structure from the URLs. The can map directly, but they don't have to Also... http?
- cinntaile 4y agoWhy not http? Secure connections add overhead. It's not like this site contains any secrets?
- andai 4y agoI think the motivation for using HTTPS with static content is to prevent man-in-the-middle attacks that inject advertising or malware into pages. I have read about governments, ISPs and hotels doing that sort of thing. One example of what can be done is to cause the users to DDoS a third party.
- xmprt 4y agohttp is still susceptible to man in the middle attacks even if the site contains no secrets. You have no guarantee that the contents of the website haven't been tampered with (not that attackers would have much incentive to tamper with a blog).
- cinntaile 4y agoThat's pretty much my point, there is no reason to meddle with the contents here. It's different if you live in a country where your ISP automatically MiTMs you (as a sibling comment to yours pointed out), but that's not a thing here at least. If you know that's a threat and it bothers you, you would likely already have measures in place anyway? But I admit it's a valid reason to have https.
- xmprt 4y ago> but that's not a thing here at least Hackernews is a global website last time I checked so even if you don't face issues like that, many other users might.
- cinntaile 4y agoYou could have just cited the entire sentence, then my answer could be your answer to my answer. lol Not sure why you're talking about HN though, the website in question was not HN.
- nl 4y ago> but that's not a thing here at least By using http you are assuming your "here" (where ever that is) is the same as where your readers are. And if your "here" is in the US then hotel WiFi providers in the US are well known to have done MiTM to insert ads.
- quickthrower2 4y agoThe attacker might just wholesale inject malicious script into every http response it sees.
- onion2k 4y agoWhy not http? The man-in-the-middle attack potential other replies have mentioned is possible, but my reason is far simpler. Defaulting to https for everything removes the cognitive load of having to decide whether to trust a website and pushes users to believe everything should be secure by default. The environmental impact is, in my opinion, worth it.
- ycuser2 4y agoI don't want anybody between me and the website to be able to read/monitor the stuff I read.
- oneeyedpigeon 4y agoTrue, but forcing yourself to break that mapping just because you want URLs with less information in them seems like a false economy.