Hacker News Reader

This used to be true, but it isn't true any more on modern web browsers. In particular, Firefox improved its caching policies for HTTPS in version 4.

https content is generally only cached in memory by the browser.

But if the response contains a Cache-Control header that explicitly specifies that the content is public, it can be cached to disk, just like http content. Eg:

Cache-Control: public, max-age=86400

It's a browser configuration thing, but I think you're right about the default.

Maybe a more intelligent approach would be to use "don't cache" if the server doesn't specify any caching headers. Otherwise, follow the server's recommendation.

Its not something that could be changed from the current "default" without high risk of big impact.

There would be need to introduce a new header to trigger SSL based caching, and migrate towards simply not sending the old/normal cache header.

You can see the direct result of that: lots of ajax'y functionality, and the reduction of full page refreshes.