Hacker News Reader

Why is dropping HTTP valuable? CA HTTPS is extremely fragile and will eventually break over even just a few years without mantainence. HTTP sites have no expiration date(s). HTTP+HTTPS is the best of both worlds. Unless your threat model includes targeted MITM attacks and your website requires the execution of javascript code.

View on HN

IPSs constantly inject ads and trackers into plain http.

Maybe less so in the West, but on a permanent basis in the East.

I cannot overemphasize how dumb it is to allow your isp to see what you're doing.

I feel the same way about letting a corporation control who can visit your site and when (CA TLS only). I personally tunnel to a VPS for browsing because my ISP, Comcast, will do MITM injections of javascript into HTTP pages. This notably used to break the Steam browser.

So the best solution is HTTP+HTTPS on the server and using HTTPS till it inevitably breaks (for legal, technical, social, or other reason), then the HTTP is there to keep things accessible. I'm not anti-HTTPS. I'm anti-HTTPS-only. And you should be too if you care about human persons over corporate use cases.

Reply on news.ycombinator.com