3 ms·
Requiring HTTPS is one thing, though it's a little disappointing it doesn't offer it at all, even something retro like SSL. I figure this is an unpopular opinio
by spijdar 4y ago
Requiring HTTPS is one thing, though it's a little disappointing it doesn't offer it at all, even something retro like SSL. I figure this is an unpopular opinion among the target audience, but I prefer keeping traffic SSL/TLS encrypted, even with broken versions or self-signed certs, because anything at all discourages opportunistic packet capture and tomfoolery.
I agree it's good for resources like this to not require it or force redirect, but it'd be nice to have something optional. Sure, there's nothing to hide here, but that's a bad excuse for not encrypting...
- account42 4y agoExcept there is no way to support HTTPs without ending up with people sharing https:// https:// links that won't work for non-HTTPs users. I really wish SSL/TLS would have used something like starttls. And yes, that means needing HSTS preload (or better yet a DNS-based alternative) to prevent downgrade attacks, but we do need that with https:// https:// anyway.
- prmoustache 4y agoLike non https users cannot remove the s manually?