3 ms·
In a conflict between HTTP vs HTTPS, why solve it by settling on HTTP? Switching to all HTTPS usually seems like the better option.
by recursive 4y ago
In a conflict between HTTP vs HTTPS, why solve it by settling on HTTP? Switching to all HTTPS usually seems like the better option.
- Tobu 4y agoIndeed, here's GitHub doing exactly that (fixing mixed content warnings by reverse-proxying third-party HTTP content), back in 2010: https://github.blog/2010-11-13-sidejack-prevention-phase-3-ssl-proxied-assets/ https://github.blog/2010-11-13-sidejack-prevention-phase-3-s...
- superkuh 4y agoIt depends on who you are and who you are trying to reach. If you are a for-profit business or institutional "person" then you only really need to reach people who are the type that give you money or who you provide services too. That means blocking people due to HTTPS CA or cert issues is okay. If you're a human person or government then you want the information or service to be available to as many people as possible and that means HTTP+HTTPS even if it means allowing older versions of HTTPS.
- kevincox 4y agoBecause HTTPS is harder. The user could be loading HTTP content from another host on their page. In order to support this you would basically need to modify their page (including scripts) to rewrite all URLs to HTTPS. This is nearly impossible to do perfectly. I think they are right to give their customers this option if desired.