The author of this ticket isn't exaggerating when he states that "MITMing this crawling horror would be no more difficult than a plain, unencrypted TCP connection".

That's how bad it is.