Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others.
Those who give up freedom for security deserve neither.
Those who give up freedom for security deserve neither.
Benjamin Franklin, to the legislature of Pennsylvania, on the topic of basically letting the Penn family buy their way out of paying taxes indefinitely by providing enough hired mercenaries to protect the colony's frontier during the French and Indian war.
The freedom he was talking about was a legislature's freedom to govern.
The temporary security he was talking about was hired guns.
And none of it applies to the question of the tragedy of the commons that is "HTTP protocol is default embarrassingly insecure."
Indeed, if I were to torture the quote enough to make it fit, it looks more like "Those who would give up essential Liberty (Mozilla, in this case, to design the user agent the way they think best benefits their users and the World Wide Web as a whole) to purchase a little temporary Safety (... of their user count by delaying inconveniencing users in the corner cases where HTTPS can't be used), deserve neither Liberty nor Safety." But it barely fits.
You can make an act compulsory on the whole population but you can't legislate duty-of-care upon the whole population.