Hacker News Reader

Ironic that your link to the ASUS site is (working) HTTPS.

I checked the liveupdate01.asus.com and dlcdnet.asus.com domains referenced in the article, and they can certainly serve over HTTPS...

View on HN

Having a domain that can serve https is good and all, but it's no use if the client doesn't actually bother checking whether the cert is valid or not. The phenomenon is so prevalent that google needed to add a warning to developers in android's ssl socket documentation.

I wonder if someone has built a transparent proxy/router level implementation of HTTPS Everywhere... That might be quite useful.

That's like mailing a postcard to a company that puts it in an envelope for you.

Not really. I was thinking along the lines of a localized instance so it would be more akin to things being captured at the perimeter and getting converted there.

So outbound to an insecure HTTP url gets rewritten to pull from a HTTPS url instead etc.

Reply on news.ycombinator.com