2 ms·
Everyone else replying is a shill of one sort or another. Someone might inject javascript into the page? You should not be allowing RCE anyway. Someone might
by Am4TIfIsER0ppos 4y ago
Everyone else replying is a shill of one sort or another.
Someone might inject javascript into the page? You should not be allowing RCE anyway.
Someone might MITM? Cloudflare does this with https anyway.
Companies might spy on you? They already are. Cloudflare intercepts all the traffic going to them despite it being encrypted.
Government might spy on you? They already are. They have backdoors and frontdoors into every system.
- Rewrap3643 4y agoWhat would you propose then?
- Am4TIfIsER0ppos 4y agoSpecifically? Firefox to stop bitching that I enter my passwords into unencrypted pages on my local network. Browsers halt or even reverse their plans of deprecating unencrypted transport. Browsers stop bitching about loading unencrypted static resources on an encrypted page. Generally? Everyone I accused of being shills off the "everything encrypted" bandwagon. If you want to encrypt your websites go ahead. You don't have to believe my unhinged conspiracies from earlier.
- tredre3 4y ago> Browsers stop bitching about loading unencrypted static resources on an encrypted page. I tend to agree with you on other points but that one is a weird take. If I deliberately visit an https page I want to be reasonably confident that it wasn't tampered with and that I'm not leaking information. Allowing loading http resources in an https context breaks that trust. Scripts may be tampered with. The website URL is leaked via the referer. Cookies might be leaked. Note: Mitigations for all those worries do exist. Cookies can be flagged secure-only. Referer can be stopped using CORS, etc. But they all need the developer to be proactive about it and, for the most part, they aren't.