Hacker News Reader

Comment by TedDoesntTalk | Hacker News Reader

http://discmaster.textfiles.com/

Refreshingly no https because why would this site need it?

Requiring HTTPS is one thing, though it's a little disappointing it doesn't offer it at all, even something retro like SSL. I figure this is an unpopular opinion among the target audience, but I prefer keeping traffic SSL/TLS encrypted, even with broken versions or self-signed certs, because anything at all discourages opportunistic packet capture and tomfoolery.

I agree it's good for resources like this to not require it or force redirect, but it'd be nice to have something optional. Sure, there's nothing to hide here, but that's a bad excuse for not encrypting...

Except there is no way to support HTTPs without ending up with people sharing https:// links that won't work for non-HTTPs users.

I really wish SSL/TLS would have used something like starttls. And yes, that means needing HSTS preload (or better yet a DNS-based alternative) to prevent downgrade attacks, but we do need that with https:// anyway.

Like non https users cannot remove the s manually?

To prevent your ISP/public wifi provider/other jokers from inserting ads and malware into the sites your visit.

I’ll accept the risk and not live in fear.

It's not an idle fear. Before https there were ISPs that would literally insert ads and other javascript into returned pages. Beyond security itself, that kind of thing can break the content.

There was also content filtering. Imagine your home internet being scanned and filtered like some locked down corporate network. Ewh.

This is also what CloudFlare is doing, is it not?

> It's not an idle fear. Before https there were ISPs that would literally insert ads and other javascript into returned pages.

In some countries known for lacking consumer rights.

Sadly, that's most countries. (or at least, most people live in such a country)

To be fair, a lot of those consumer rights had to be realized and invented first - after the corporations went too far. Think GDPR and co, if companies weren't so thirsty for danger and loading webpages full of trackers, it would never have (needed to) be made.

(France) When I was a kid, 40 years ago, we had a good consumer protection. The warranty period was 1 year.

Now we have the same good protections, the warranty period is 2 years.

So some countries had it for a very long time, it is rather a matter of culture I believe.

In some countries (Australia for example), the horse came _before_ the cart.

Being brave is cool and all but it's a weird adage; I'm not afraid of malware or ads, but I'd still prefer to not get them.

It's an anti-vaxxer statement too; I'm not afraid of the 'rona either, but I'd rather not get it if it's all the same to you.

What possible reason could one have to avoid HTTPS whenever possible? I really do not understand this mindset.

Without it, your ISP can see what pages you're visiting, files you are downloading, and your searches if they're in the URL. So the same reason any other site would need it?

So they can see me download Oregon Trail from this website. Mine that data, in sure there’s gold there!

What’s the practical cost to having it?

Practical “cost” is that it raises the bar on clients wanting to access the material, some of which could be very old I suppose.

That cost only exists if you enforce https, which is different from supporting https.

From the horses mouth:

"CSS, JavaScript and HTTPS are not required. This site works in text and vintage browsers."

Ahhh!!!

I 100% get that. So you can boot up some old computer and grab retro files. Love it.

There's a difference between not requiring HTTPS and not supporting it at all.

Indeed. That difference is the unncessary additional work in supporting it.

Yeah! And get rid of those pesky switches too, hubs are all we need!

Reply on news.ycombinator.com