Comment by bruce511 | Hacker News Reader

Comment by bruce511 | Hacker News Reader

Parent Full thread

On the one hand, yes, certificates are issued by certificate authorities. And this is a critical part of the current web landscape.

But, I'll counterpoint that LetsEncrypt isn't the only ACME provider. Should they behave badly others can step into the gap.

The 90 day thing isn't a barrier. Certificates in general are automated- it's no harder to be HTTPS than HTTP.

Promoting HTTPS and dropping HTTP is ultimately valuable to all sites, because it prevents HTML injection. Given that your reader will be accessing the web via an ISP it prevents that ISP from injecting things into your site.

As an author of my own websites, I'm https only, and I think LE improves the indie web experience. There is a long chain of big companies between my site and my reader (Isp, LE, DNS, browser etc) but HTTPS offers me the best way of making sure the contect I create is the content delivered.

Why is dropping HTTP valuable? CA HTTPS is extremely fragile and will eventually break over even just a few years without mantainence. HTTP sites have no expiration date(s). HTTP+HTTPS is the best of both worlds. Unless your threat model includes targeted MITM attacks and your website requires the execution of javascript code.

IPSs constantly inject ads and trackers into plain http.

Maybe less so in the West, but on a permanent basis in the East.

I cannot overemphasize how dumb it is to allow your isp to see what you're doing.

I feel the same way about letting a corporation control who can visit your site and when (CA TLS only). I personally tunnel to a VPS for browsing because my ISP, Comcast, will do MITM injections of javascript into HTTP pages. This notably used to break the Steam browser.

So the best solution is HTTP+HTTPS on the server and using HTTPS till it inevitably breaks (for legal, technical, social, or other reason), then the HTTP is there to keep things accessible. I'm not anti-HTTPS. I'm anti-HTTPS-only. And you should be too if you care about human persons over corporate use cases.

Reply on news.ycombinator.com