> There is still risk, but this is a form of risk which is not neccessary and can be reduced. It reduces it a little bit. But if you drop the risk of a random

> There is still risk, but this is a form of risk which is not neccessary and can be reduced. It reduces it a little bit. But if you drop the risk of a random site being malicious by 25% that's not a very important change. The user still has to be wary. That reduction is not worth anything as drastic as blocking the site. > We are talking about blogs that don't use https because they don't sell things. Expired certificates are out of scope of this comment thread. I got the impression we were primarily talking about broken https. It's definitely not out of scope entirely: "If it says the certificate for your bank is expired, you need to stop. If it says the certificate for the 10 year old public blog post that was linked by a 5 year old Reddit post as describing the solution to your problem, that should not matter, and you just want to read the non-secret contents of whatever is on that page regardless of whether the site's maintainer turned on HTTP to HTTPS redirects and then neglected to renew the certificate."