HTTPS brings complexity. In lots of cases I dont want that complexity. Sometimes that complexity gives rise to (heartbeat) bugs, problems and stability issues.

HTTPS brings complexity. In lots of cases I dont want that complexity. Sometimes that complexity gives rise to (heartbeat) bugs, problems and stability issues. When it doesn't, it always leads to more work. I want to be able to setup a website, access that website instantly without having to meddle with getting SSL-certs, or creating my own self-signed certs. Sometimes you want consumers to be software, components (IoT thingies) which doesn't always have an up to date crypto-stack or have a crypto-stack at all. Getting them to accept the HTTPS website can result in all kinds of issues (ref wget --no-check-certificate, even on modern Linux systems)... In general, getting HTTPS up and running is about an order of magnitude more work than plain HTTP. And if you don't need it, why should you be forced to put in the effort? The answer is obvious: You shouldn't. Because you don't need HTTPS everywhere. You don't. That's a purely factual statement. I cannot for the life of me see how anyone has a problem accepting that.