Hacker News Reader

Comment by davidjgraph | Hacker News Reader

Because it's only the correct version of the web site that comprises "HTML, CSS, and JPG". The problem isn't about what the correct version of site contains, it's about what the intercepted version contains.

Anyone in the middle can change the web site into anything they like. They could add a "donate link", saying that the author needs money to sustain the site.

View on HN

The site happens to have a donate page: http://misc-stuff.terraaeon.com/donate.html From my perspective, it doesn't matter much if that page was added through a MITM attack or not - I neither know nor trust the author of the site and have no inclination of donating money to them.

I don’t think this is not a likely enough situation to affect design. I think the author is stating that it is an acceptable risk, and users shouldn’t care.

As I mention in my top-level comment, it seems reasonable to say "I don't really care about surveillance risk of my low traffic blog", but it's a bit incongruous when it's combined with "I care a great deal that Big SSL might be rope-a-doping me and five years from now they'll charge me money for my SSL cert for my low traffic blog, and if you don't like it, it's your problem!"

We're talking about a free thing that on one hand takes five minutes to set up and on the other hand provides almost no benefit! It's hard to imagine lower stakes for anyone involved.

My time is very valuable as I need to spend it commenting on HN.

5 minutes every two months isn’t a great amount, but it’s great compared to the benefit to this blogger.

I can imagine lower stakes with something that takes zero minutes.

Maintaining your own web server costs more than that.

Zero minutes would use an external provider. Otherwise you're opening an unmaintained insecure webserver - a potential bounce for all sorts of illegal activity.

Reply on news.ycombinator.com