3 ms·

Why not create a non-SSL virtualhost? http://plain.news.ycombinator.com http://plain.news.ycombinator.com or similar.

• oneeyedpigeon 12y ago
  Or just have each protocol do what it's supposed to, rather than redirecting one to another? In general, aren't advanced users supposed to like having the option to make their own decisions?
  • innocenat 12y ago
    Yeah. How many users (not power users) actually type https:// https:// into address bar? To my knowledge, if you don't include the protocol, browser default to HTTP.
    • pizzeys 12y ago
      Not on Hacker News (and many other sites) with a modern browser. The first time you visit http://news.ycombinator.com http://news.ycombinator.com, it will redirect to https:// https://, and you're correct, if the first time you visit happens to be the time you are MITM'd, this is a weak point. However, after the first visit, your browser learns through HSTS (the Strict-Transport-Security header) that accessing news.ycombinator.com without TLS is not supported, and won't attempt to access it again except via TLS. (For a year, in HN's case - this is configurable by the site administrator.)
      • vertex-four 12y ago
        Point is that your grandparent comment was suggesting that visiting http://news.ycombinator.com http://news.ycombinator.com should not redirect to HTTPS.