Hacker News Reader

Comment by jbb555 | Hacker News Reader

Still not changing my websites to https. They don't need to be "secure", they are not going to be "secure".

I consider this a broken stupid change.

Why? Without HTTPS, anyone between a user and your server can modify your page, without you noticing.

There are certain types of sites where that doesn't really matter. My personal blog, for instance, I don't see the need for HTTPS there.

In saying that, HTTPS is easier than ever to deploy to a website. This will only increase adoption of 'secure by default'

People modifying your page can include ISPs injecting ads or reducing the resolution of images to save bandwidth.

I'm not the parent, but I say "let them".

How about injecting malware?

And this isn't a "it could happen some day" threat, it's already a thing.

There are simple one-click setup programs that can monitor a wifi network, and inject malware into any downloads of executable or zip files that it can find.

With things like Stagefright still affecting a scary large amount of android users, what happens when someone starts injecting malware into images which can compromise an entire phone without so much as a hiccup.

What if they inject hate speech / child porn / <any illegal content> and tell the authorities on you?

Like I said, "let them". The authorities will see nothing wrong with the content on the server, and look somewhere else. What happens "in transport" is absolutely not my responsibility.

It could even serve as a sort of plausible deniability...

Which has long been my suspicion why Google is so keen on promoting HTTPS.

If all sites are HTTPS, Google kills ISPs' ability to inject ads and to profile customers.

Not through any sense of altruism, but because Google is only interested in one megacorp being able to sell ads and track browsing: Google.

It's good business for Google, but let's not pretend it's about "making the web better". It's about keeping commerce on the web as a Google monoculture.

@symbiote

I'm also unwilling to switch to https. If your ISP is attacking you then you should be tunneling things. I personally like the image compression and caching that they do and think it's somewhat important for my site and others like it.

Good luck explaining to a non-expert user how they should be "tunneling things" in order to avoid their shitty ISP's non-features.

If your ISP is attacking you, then you should think about switching to a different one.

If you're not using https, you have no idea if your ISP, or someone e.g. sitting in your cafe, is attacking you.

If you have the luxury of multiple ISPs to choose from.

Someone could modify a link in your blog to go to malware. Example: "Hi guys, I like software X, download it here"

Me too. Google can do what they want but they don't own the Internet.

I am with you. In many use cases HTTP 1 is fine. And as we have seen with the Hearthbleed bug, if you cannot devote resources to keep your HTTPS up-to-date all the time 24x7, it makes your server and the user sessions more insecure. And often providing HTTP and HTTPS makes sense too. So I am against labeling HTTP as "evil" or legacy. We should look who has an interest in doing just that, and why they are forming initiatives. Beside all that pretty much all ad-networks serve HTTP ads, so if you want to loose much of your ad revenue, please go with the HTTPS-only route and face the real world surprise.

Reply on news.ycombinator.com