Who decides what’s non-critical? I’d prefer my news articles not be rewritten by the government for example. Catering security to the absolute lowest common denominator (“can’t set a clock”) is not a path to success.
Suppose also that I am an underprivileged individual whose only device is a 10-year-old tablet I happened to find in the closet.
I'm searching for a crucial piece of information, e.g. how to receive a subsidy benefit or health symptoms.
This is a real-world scenario I have myself witnessed, and have also read about online many times.
Are you REALLY arguing for denying this human being access to the information in the name of "security"?
Comcast used to (and maybe still does) inject JavaScript into HTTP requests when users were approaching their transfer caps, so that a warning banner would be shown to let them know they are almost at their terabyte limit.
ISP's have been and continue to be caught playing tricks like this. T-Mobile for instance used to rewrite the playlists that YouTube would send down for HSL to remove the higher bitrates to reduce network traffic.
Just because you are in the US does not mean you are immune from this sort of shenanigans, currently it is used mostly in the name of network management, but it could also be used for nefarious purposes.
I also fully believe this is why public libraries should exist. The library near me has new computers, help that can help the person navigate those sites and even has tablets available for loan.
ISP may inject bandwidth cap limit
-or-
No access to information at all
What do you think the person looking for critical information would choose?
By the way, libraries are scarce in the U.S., and library computers have been some of the most out-of-date and poorly maintained machines I've used. This is a problem I have no chance of solving, while allowing HTTP access is something I can do today.
Also you could disable expiration as a much safer measure.
There are many reasons someone may not be able to access.
Furthermore, some of those reasons can be known ahead of time, and some cannot even be predicted before they happen.
But the ones I do know of, I try to accommodate, just like i try to accommodate visually impaired, those with slow devices, etc.
And I have found that the more known scenarios I accommodate, the more unknown scenarios are also accommodated, just from raising the accessibility bar.
Of course, this is not something everyone cares about. You probably won't gain many profitable customers with deep pockets accommodating the edge cases. They're all using the latest and greatest.
But if you care about allowing access to as many as possible to your resource, serving both HTTP and HTTPS is the way.
It's the impression your post gives. Either I pick insecurity -or- it breaks.
The real version is I pick insecurity -or- the number of ways it can break goes from 73 to 74.
And I care about accessibility too. That doesn't mean I indiscriminately want to increase access. The downsides of certain methods are important.
Usually I don't.
Case in point: Firefox 93 now issues gratuitous scary warnings when a .PDF is downloaded over a non-https connection. [1] Right now it only seems to happen if you arrive at the link via a search engine, but it would be silly to pretend they'll stop there. There is nothing OK about this. It literally breaks the whole idea of decentralized Internet protocols.
The obsession with "https everywhere" needs to stop, now. Otherwise, not only will our future landfills groan under the weight of megatons of e-waste that didn't need to stop working when it did, but our collective cultural history online will eventually consist of nothing but undecodable random numbers.
Not everything needs unbreakable encryption. The vast majority of online content doesn't.
If those devices can't even update certs, they absolutely should not be online because they're solid blocks of vulnerable software that will just contribute to botnets.
And the only way for this to contribute to losing history is if you're somehow archiving content by grabbing it off the wire, which seems inefficient anyways.
Ah, yes, the presumption of guilt. "You're going to do a bad thing at some point, I just know it. This is probably because you're a moron, while I'm not. Fortunately, I have the solution."
We hear that a lot these days.