Hacker News Reader

Comment by mrunkel | Hacker News Reader

Why does the old web server even need HTTPS? Have I missed a memo that HTTP is going away?

If you're not sending anything private (ie just the contents of the website are being delivered) there isn't really any need for HTTPS, so leave that old HTTPD server running HTTP.

But, if you want your stuff encrypted, you can't rely on old versions of HTTPS so you have to use something more modern.

Also, if you want your transmissions to be secure, you probably shouldn't be relying on hardware/software that has passed EoL ages ago too.

If you want to read more, you can check out my page at wais://runkel.org/personal?old-servers

View on HN

> Have I missed a memo that HTTP is going away?

https://konklone.com/post/were-deprecating-http-and-its-goin...

(FWIW, I personally don't like it and think that it's a mistake.)

Considering that post is 5 years old and HTTP still works in Firefox and Chrome, I don't think what the post says is coming is coming.

A change of this magnitude is going to take many years.

Author of the post here :)

In those 5 years, HTTPS has gone from being the minority of traffic to being ~90% of the connections observed by most Chrome clients (scroll down a few graphs for the Chrome-observed one): https://transparencyreport.google.com/https/overview

Firefox has reported similar numbers. It's now more common for new web features to require HTTPS when they are introduced, to avoid developing HTTP sites as dependencies: https://blog.mozilla.org/security/2018/01/15/secure-contexts...

That doesn't mean that HTTP is banned, but given the magnitude of the change and the size of the web, I think it's fair to say that it's being deprecated.

More practically, anyone who wanted to build a product (or a government process) on intercepting or modifying people's unencrypted web traffic would find their dataset to be an order of magnitude smaller, and orders of magnitude less useful (since so much of the remaining HTTP traffic is in the long tail of small/older sites).

Tell that to ISPs who insert ads into every non-encrypted location they can find.

Pretty sure that’s mostly a US problem, I haven’t heard of any other first world country where this regularly happens. You should probably work on fixing the problem instead of requiring everyone to accommodate you.

You're wrong, naturally, and the fact HTTPS solves the general problem is proof enough it's needed.

I'm not arguing against HTTPS. I'm saying that it's not a requirement for an old website running on an old server (which is what the post was about).

Reply on news.ycombinator.com