4 ms·

Why? Http is simpler, less fragile, not dependent on good will of third parties, the content is public, and proving authenticity of text on Internet is always h

by effie 4y ago

Why? Http is simpler, less fragile, not dependent on good will of third parties, the content is public, and proving authenticity of text on Internet is always hard, even when served via the https scheme. I bet Bernstein thinks there is little point in forcing people to use https to read his page.

z9znz 4y ago
MITM could change what the client receives, right?
- effie 4y ago
  Yes. But if you worry about being a target for MITM attacks, https alone does not fix that problem. You need some reliable verification mechanism that is hard to fool. The current CA system or "trust on first use" are only partial, imperfect mechanisms.
oittaa 4y ago
That's just wrong on so many levels. Troy Hunt has an excellent explanation: https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs...
- effie 4y ago
  Troy Hunt points out that HTTP traffic is sometimes MITMed in a way that clients and servers do not like, and HTTPS sometimes prevents that. I never said otherwise. I am saying for certain kinds of pages, it's not a major concern. Like for djb website. Why not use HTTPS for everything? Because it also has costs, not just benefits.
  - oittaa 4y ago
    > Because it also has costs, not just benefits. That's not really true. Certificates have been free for a long time and every CPU made within the last 10 years has AES acceleration. You can google white papers from companies like Cloudflare and Google, which actually show speedups with HTTP 2 or 3.
    - effie 4y ago
      There are other costs, with deployment and maintenance. Well built HTTP site works on its own until browsers intentionally stop accepting it. HTTPS site works for few months and then a new certificate needs to be obtained and deployed. This has real cost in additional risk of outages, support requests, and not the least, becoming dependent on the goodwill of the certificate issuer.

by effie 4y ago

z9znz 4y ago

MITM could change what the client receives, right?

effie 4y ago
Yes. But if you worry about being a target for MITM attacks, https alone does not fix that problem. You need some reliable verification mechanism that is hard to fool. The current CA system or "trust on first use" are only partial, imperfect mechanisms.

oittaa 4y ago

That's just wrong on so many levels. Troy Hunt has an excellent explanation: https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs...

effie 4y ago
Troy Hunt points out that HTTP traffic is sometimes MITMed in a way that clients and servers do not like, and HTTPS sometimes prevents that. I never said otherwise. I am saying for certain kinds of pages, it's not a major concern. Like for djb website. Why not use HTTPS for everything? Because it also has costs, not just benefits.
- oittaa 4y ago
  > Because it also has costs, not just benefits. That's not really true. Certificates have been free for a long time and every CPU made within the last 10 years has AES acceleration. You can google white papers from companies like Cloudflare and Google, which actually show speedups with HTTP 2 or 3.
  - effie 4y ago
    There are other costs, with deployment and maintenance. Well built HTTP site works on its own until browsers intentionally stop accepting it. HTTPS site works for few months and then a new certificate needs to be obtained and deployed. This has real cost in additional risk of outages, support requests, and not the least, becoming dependent on the goodwill of the certificate issuer.