logoalt Hacker News

tomtomtom777today at 4:52 PM4 repliesview on HN

Please use HTTPS.

I use HTTPS only. I don't think HTTP is acceptable for anyone let alone a technical blog post. It takes a few minutes, and it prevents me and all your visitors from getting all kinds of MITM injections.

Thanks.


Replies

Fwirttoday at 5:05 PM

It also prevents all kinds of clients who (for various reasons) can't implement SSL from visiting your website. I'm sure this is a "small web" blog, whose author wants to be visited by e.g. a Commodore 64, an OS 9 iMac, or somebody who just wants to telnet in. If the sensitivity of the information on this page was critical or you were going to be submitting information then by all means yes, SSL is important, but if you're going to be reading a personal blog about calendars then http is probably fine. Of course the ideal solution is offering both and letting the client choose.

voidfunctoday at 4:56 PM

MITM attack on a read-only text webpage... okay.

More annoying is the slightly shiny/shaded text that is supposed to highlight something. Who chose this style palette?

show 1 reply
himata4113today at 5:03 PM

I think you would have a better argument if you said something like: "I don't want my ISP knowing about the content I read" or something along those lines. MITM for a text download is like saying we have to have https for dns (yes DoH exists now), but the point still stands. You aren't sending any sensitive data to the website, MITM is unlikely.

show 2 replies
hamdingerstoday at 6:22 PM

Surprised this is downvoted. Chrome forces me to click through a warning to even visit HTTP sites nowadays.

show 1 reply