←back to thread

Web page annoyances that I don't inflict on you

(rachelbythebay.com)
569 points todsacerdoti | 4 comments | 05 Jan 25 01:54 UTC | HN request time: 0.736s | source
Show context
imoreno ◴[05 Jan 25 02:56 UTC] No.42599386[source]▶
I agree with most of this. If every website followed these, the web would be heaven (again)...

But why this one?

>I don't force you to use SSL/TLS to connect here. Use it if you want, but if you can't, hey, that's fine, too.

What is wrong with redirecting 80 to 443 in today's world?

Security wise, I know that something innocuous like a personal blog is not very sensitive, so encrypting that traffic is not that important. But as a matter of security policy, why not just encrypt everything? Once upon a time you might have cared about the extra CPU load from TLS, but nowadays it seems trivial. Encrypting everything arguably helps protect the secure stuff too, as it widens the attacker's search space.

These days, browser are moving towards treating HTTP as a bug and throw up annoying propaganda warnings about it. Just redirecting seems like the less annoying option.

replies(10): >>42599423 #>>42599448 #>>42599461 #>>42599916 #>>42600279 #>>42601148 #>>42605479 #>>42605998 #>>42609172 #>>42627972 #
bigs ◴[05 Jan 25 07:15 UTC] No.42600279[source]▶
Why should web browsers treat http like a bug? Many sites don’t need https.
replies(4): >>42600325 #>>42605366 #>>42605406 #>>42605561 #
yjftsjthsd-h ◴[05 Jan 25 07:29 UTC] No.42600325[source]▶
> Many sites don’t need https.

Maybe intranet sites. Everything else absolutely should.

https://doesmysiteneedhttps.com/

replies(2): >>42600520 #>>42606893 #
1. muppetman ◴[05 Jan 25 08:35 UTC] No.42600520[source]▶
Those are some of the most pedantic grasping at straws reasons I've ever read. It's like they know there's nothing wrong with http so they've had to invent worst case nightmare scenarios to make their "It's so important" reasons stick. Https is great. I use it. That website is pathetic though.
replies(2): >>42601637 #>>42605638 #
2. fractallyte ◴[05 Jan 25 13:32 UTC] No.42601637[source]▶
The source footer ("View Page Source") summarizes it perfectly:

Sites that need HTTPS: - all of them

If you like it, you better put a lock on it.

And, BTW, the website is as delightfully simple and unobtrusive as the one in the article.

3. TRiG_Ireland ◴[05 Jan 25 22:33 UTC] No.42605638[source]▶
ISPs injecting ads into HTTP websites isn't a weird edge case. I've seen it happen.
replies(1): >>42691291 #
4. muppetman ◴[13 Jan 25 23:57 UTC] No.42691291[source]▶
And so what if my webpage about an obscure 1994 Australian rock band get a few ads injected into it? Everything else in my life gets ads injected into it (TV, Music, Movies) Such a silly argument.