4 ms·
Why is dropping HTTP valuable? CA HTTPS is extremely fragile and will eventually break over even just a few years without mantainence. HTTP sites have no expira
by superkuh 2y ago
Why is dropping HTTP valuable? CA HTTPS is extremely fragile and will eventually break over even just a few years without mantainence. HTTP sites have no expiration date(s). HTTP+HTTPS is the best of both worlds. Unless your threat model includes targeted MITM attacks and your website requires the execution of javascript code.
- aboardRat4 2y agoIPSs constantly inject ads and trackers into plain http. Maybe less so in the West, but on a permanent basis in the East.
- ForTheKidz 2y agoI cannot overemphasize how dumb it is to allow your isp to see what you're doing.
- superkuh 2y agoI feel the same way about letting a corporation control who can visit your site and when (CA TLS only). I personally tunnel to a VPS for browsing because my ISP, Comcast, will do MITM injections of javascript into HTTP pages. This notably used to break the Steam browser. So the best solution is HTTP+HTTPS on the server and using HTTPS till it inevitably breaks (for legal, technical, social, or other reason), then the HTTP is there to keep things accessible. I'm not anti-HTTPS. I'm anti-HTTPS-only. And you should be too if you care about human persons over corporate use cases.