Hacker News Reader

A properly behaving site would not. One hacked by malware distributors could.

Counter-example: Ubuntu serves their ISO via an HTTP link on an HTTPS page. They supply a gpg signature as a way to validate that the file was not tampered with.

Why? Why not serve the ISO over HTTPS?

The hostname resolves to a bunch of different mirrors run by different people who don’t all share a secret key between them.

There are workarounds for this (using a redirector service and unique hostnames) but that is an additional request of donors who are providing them a lot of bandwidth for free.

It’s not a great reason, but it is a reason.

ISO files are not considered a common (if not most common) vector for malware delivery. While it’s dumb that they serve it over HTTP (don’t use CNAME-based mirror setups, everyone) it’s also neither putting anyone at significant risk to allow it nor under consideration for blocking.

Malice is certainly possible, but someone simply making a mistake is another easily plausible cause. Many sites don't correctly redirect all URLs to from http to https.

Mistakes will be fixed pretty quickly if this policy gets implemented, so I don't see it as a problem.

Yeah, it's going to be a nice forcing function to fix these mistakes.

Reply on news.ycombinator.com