3 ms·

Why? What benefit would https provide over http when visiting a pure information (and I'm guessing statically generated) website?

by cogman10 10mo ago

fordsmith 10mo ago
If you are on a public network without using a VPN you open yourself up to MITM to inject something malicious
- cogman10 10mo ago
  Sure, but that's ultimately a pretty unlikely attack vector. An attacker still needs to exploit some unknown vulnerability of your web browser in order to get something malicious going. I basically expect that sort of attack to only be pulled off by a state actor or by a black hat convention for the lolz.
  - nine_k 10mo ago
    ISPs used to inject ads into HTTP-served pages as recently as 10 years ago, I personally remember that. Not only tiny ISPs. I'm not alone: https://superuser.com/questions/902635/isp-is-inserting-ads-into-web-pages https://superuser.com/questions/902635/isp-is-inserting-ads-... Ads injection is a relatively benign kind of tampering. It could be much more creative and sinister.
  - deleted 10mo ago
    [deleted]
bqmjjx0kac 10mo ago
Confidentiality, integrity, and authenticity :)
- cogman10 10mo ago
  > Confidentiality Reading a blog post about linux security? Do you actually care if the NSA/FBI/CIA/FDA/USDA or anyone else knows you read this particular blog post? I could understand this argument if we were talking about a social media site, or something more substantial. But a blog post? > authenticity It's a linux security blog post. While it's technically possible for a MITM to get in between an inject false information... about linux security? Is that really a real threat? > integrity Maybe a real problem, assuming a malicious MITM is trying to target you. But, I suspect, there are other avenues that'd be more fruitful in that case. Just hoping that someone would visit an http site seems like a far fetched concern.
Alupis 10mo ago
It is a valid thing to point out, when implementing https on gkh's site would take all of 15 minutes to set up (let's encrypt or cloudflare or whatever you wish). Things should be https by default these days. There's zero downside anymore.
ryanisnan 10mo ago
Great question. People answered already, but, yeah, basically what they said. For hobby sites, you could argue (I think the argument is still weak), about the MITM threat being low enough to not be worth doing something, but this is a security blog. Security blogs matter, because people follow their guidance. This makes them a potentially attractive target for some groups of people.

Why? What benefit would https provide over http when visiting a pure information (and I'm guessing statically generated) website?

fordsmith 10mo ago

If you are on a public network without using a VPN you open yourself up to MITM to inject something malicious

cogman10 10mo ago
Sure, but that's ultimately a pretty unlikely attack vector. An attacker still needs to exploit some unknown vulnerability of your web browser in order to get something malicious going. I basically expect that sort of attack to only be pulled off by a state actor or by a black hat convention for the lolz.
- nine_k 10mo ago
  ISPs used to inject ads into HTTP-served pages as recently as 10 years ago, I personally remember that. Not only tiny ISPs. I'm not alone: https://superuser.com/questions/902635/isp-is-inserting-ads-into-web-pages https://superuser.com/questions/902635/isp-is-inserting-ads-... Ads injection is a relatively benign kind of tampering. It could be much more creative and sinister.
- deleted 10mo ago
  [deleted]

bqmjjx0kac 10mo ago

Confidentiality, integrity, and authenticity :)

cogman10 10mo ago
> Confidentiality Reading a blog post about linux security? Do you actually care if the NSA/FBI/CIA/FDA/USDA or anyone else knows you read this particular blog post? I could understand this argument if we were talking about a social media site, or something more substantial. But a blog post? > authenticity It's a linux security blog post. While it's technically possible for a MITM to get in between an inject false information... about linux security? Is that really a real threat? > integrity Maybe a real problem, assuming a malicious MITM is trying to target you. But, I suspect, there are other avenues that'd be more fruitful in that case. Just hoping that someone would visit an http site seems like a far fetched concern.

Alupis 10mo ago

It is a valid thing to point out, when implementing https on gkh's site would take all of 15 minutes to set up (let's encrypt or cloudflare or whatever you wish). Things should be https by default these days. There's zero downside anymore.

ryanisnan 10mo ago

Great question. People answered already, but, yeah, basically what they said. For hobby sites, you could argue (I think the argument is still weak), about the MITM threat being low enough to not be worth doing something, but this is a security blog. Security blogs matter, because people follow their guidance. This makes them a potentially attractive target for some groups of people.