←back to thread

569 points todsacerdoti | 1 comments | | HN request time: 0s | source
Show context
imoreno ◴[] No.42599386[source]
I agree with most of this. If every website followed these, the web would be heaven (again)...

But why this one?

>I don't force you to use SSL/TLS to connect here. Use it if you want, but if you can't, hey, that's fine, too.

What is wrong with redirecting 80 to 443 in today's world?

Security wise, I know that something innocuous like a personal blog is not very sensitive, so encrypting that traffic is not that important. But as a matter of security policy, why not just encrypt everything? Once upon a time you might have cared about the extra CPU load from TLS, but nowadays it seems trivial. Encrypting everything arguably helps protect the secure stuff too, as it widens the attacker's search space.

These days, browser are moving towards treating HTTP as a bug and throw up annoying propaganda warnings about it. Just redirecting seems like the less annoying option.

replies(10): >>42599423 #>>42599448 #>>42599461 #>>42599916 #>>42600279 #>>42601148 #>>42605479 #>>42605998 #>>42609172 #>>42627972 #
bigs ◴[] No.42600279[source]
Why should web browsers treat http like a bug? Many sites don’t need https.
replies(4): >>42600325 #>>42605366 #>>42605406 #>>42605561 #
542458 ◴[] No.42605366[source]
I used to have an ISP that would inject ads into HTTP sites. Every site needs HTTPS.
replies(1): >>42607475 #
dijit ◴[] No.42607475[source]
Or, your ISP does not deserve to exist.
replies(1): >>42608093 #
FredPret ◴[] No.42608093[source]
True but you can’t build distributed systems that rely on every single actor being a good one. Hence encryption, the police, etc.
replies(1): >>42608840 #
dijit ◴[] No.42608840[source]
The police is a good example, instead of reinventing basal language, we instead have a body of people who enforce the law.

It’s not like ISPs are unknown entities.

replies(1): >>42609309 #
1. homebrewer ◴[] No.42609309[source]
What about governments? In my country they perform MITM attacks against unencrypted HTTP, while the best they can do with HTTPS is to block the site. I'd much prefer everyone enforcing HTTPS at all times.