Hacker News Reader

Comment by crazygringo | Hacker News Reader

Of course there is. If they're HTTP, they're insecure, which makes them an open attack vector.

Modern computer security is about removing as many known possible attack vectors as possible.

So that's the benefit.

EDIT: to those saying browsers are sandboxed or that there's nothing sensitive, it projects against e.g. Comcast injecting JavaScript into pages from other sites. [1] There are all sorts of types of bad actors out there. Surely I don't need to list them all here.

[1] https://thenextweb.com/insights/2017/12/11/comcast-continues...

View on HN

There's no point having a web browser that doesn't browse just because it's more secure that way! Browsers have never had better sandboxes. Firefox disables certain features for sites served via plain HTTP. It's safer now to browse unencrypted sites than it was five years ago. There's no reason to remove functionality now.

Here I disagree. HTTPS gives guarantee to visitors of the site that they can trust the information being served to them.

A malicious actor hijacking plain HTTP connections does not necessarily have to inject code that harms the user's computer directly. He/she could also just alter bits and pieces of the served content to trick the user into doing something not in his/her interest.

So while having better browser sandboxing and protection is good (and welcome), HTTPS is still necessary.

Old and unmaintained websites are not collecting any information, let alone sensitive information. They’re mainly read-only, informative content that the web would be infinitely worse-off without.

The Internet Archive helps maintain that information far more reliably than a 20-year-old unpatched webserver could.

The internet archive is unfortunately poorly indexed/searchable bordering on not at all.

> If they're HTTP, they're insecure, which makes them an open attack vector.

No it doesn't. HTTPS ensures that the data is not spied on or tampered with by those in the middle (so it does protect against what Comcast does), but does not prevent any other sorts of attacks (e.g. the server operator adding malicious files into their own server).

> it projects against e.g. Comcast injecting JavaScript into pages from other sites.

I should add a script to detect such things then, and if it finds one, display its own message to the user, to tell the user to disable JavaScript, with instructions about how to do so.

> Of course there is. If they're HTTP, they're insecure, which makes them an open attack vector.

If so they are only insecure because malicious JS can be MITMed into them, and realistically speaking browsers can’t defend against malicious JS.

> Modern computer security is about removing as many known possible attack vectors as possible.

So let’s remove enabled-by-default JS permissions instead of removing HTTP-content. Most old websites don’t depend on JS and would in fact be just fine.

Even better: make JS opt-in only for HTTP websites, and let users like me refuse the “upgrade” to HTTPS.

Reply on news.ycombinator.com