Hacker News Reader

Comment by notadoc | Hacker News Reader

While this is obviously useful for anything with a login, there are many content and consumption sites that simply don't need HTTPS.

View on HN

You are forgetting half of the benefit of HTTPS. Not only is content kept secret, but it is also kept unmodified.

Even if your don't care about secrecy, you should use HTTPS to ensure your content doesn't have ads or malware injected into it by your ISP (which happens) or a WiFi hijacker (which happens). If a user of yours sees an ad or gets a virus from someone injecting it in your website, they are going to blame you.

HTTPS protects the site owner just as much as the site user.

Hmm, good point. The ad injection thing is quite relevant to developing markets, where many ISPs routinely inject ads onto sites.

But it's certainly more overhead particularly for mom and pop businesses. I suppose it will drum up a lot of business for web developers though, a Chrome stimulus of sorts.

"Your users can't be easily MITM attacked when they visit your site" is a pretty big benefit to every site out there.

  > Your users can't be easily MITM attacked

Ha, ha. Your browser trusts your corporate/institutional/national proxy, or else.

the other thing to note is that a lot of new APIs (and older ones which are being updated) require HTTPS - geolocation, webBT, webUSB, service workers, etc, all require HTTPS (or will, soon).

Yeah, can't wait till my CV and project descriptions (not hosted there) static Jekyll site is somehow insecure and dangerous.

[edit] I'll guess I'll have to find a new host then, since Github pages doesn't support https on custom domains. Perhaps Netlify, seems to support Github hooks.

If you're serving them over plaintext http, then they're already insecure. How dangerous that is might be debatable, but there's no doubt that it's insecure.

Well China intercepts http traffic and inserts javascript malware joining users into a botnet that DDOSes github pages of human rights organizations. It depends on what you mean by insecure and dangerous.

Link?

https://citizenlab.org/2015/04/chinas-great-cannon/

https://en.wikipedia.org/wiki/Great_Cannon

gitlab pages has https support built in

For custom domains? I doubt it. Op is not talking about https://<username>.github.io.

Comment you're responding to said gitlab, not github.

Maybe those code hosting sites need to become more creative in their naming...

The comment I was responding to was talking about gitlab having SSL on their <username>.gitlab.io pages. While correct, that is besides the point OP was making. Which was about custom domains. Gitlab doesn't offer that, either.

Reply on news.ycombinator.com