Hacker News Reader

Comment by onion2k | Hacker News Reader

You can't determine the file system structure from the URLs. The can map directly, but they don't have to

Also... http?

Why not http? Secure connections add overhead. It's not like this site contains any secrets?

I think the motivation for using HTTPS with static content is to prevent man-in-the-middle attacks that inject advertising or malware into pages. I have read about governments, ISPs and hotels doing that sort of thing.

One example of what can be done is to cause the users to DDoS a third party.

http is still susceptible to man in the middle attacks even if the site contains no secrets. You have no guarantee that the contents of the website haven't been tampered with (not that attackers would have much incentive to tamper with a blog).

That's pretty much my point, there is no reason to meddle with the contents here. It's different if you live in a country where your ISP automatically MiTMs you (as a sibling comment to yours pointed out), but that's not a thing here at least. If you know that's a threat and it bothers you, you would likely already have measures in place anyway?

But I admit it's a valid reason to have https.

> but that's not a thing here at least

Hackernews is a global website last time I checked so even if you don't face issues like that, many other users might.

You could have just cited the entire sentence, then my answer could be your answer to my answer. lol

Not sure why you're talking about HN though, the website in question was not HN.

> but that's not a thing here at least

By using http you are assuming your "here" (where ever that is) is the same as where your readers are.

And if your "here" is in the US then hotel WiFi providers in the US are well known to have done MiTM to insert ads.

The attacker might just wholesale inject malicious script into every http response it sees.

Why not http?

The man-in-the-middle attack potential other replies have mentioned is possible, but my reason is far simpler. Defaulting to https for everything removes the cognitive load of having to decide whether to trust a website and pushes users to believe everything should be secure by default. The environmental impact is, in my opinion, worth it.

I don't want anybody between me and the website to be able to read/monitor the stuff I read.

True, but forcing yourself to break that mapping just because you want URLs with less information in them seems like a false economy.

Reply on news.ycombinator.com