Is there a reason he doesn't have HTTPS on his site? Firefox throws up a giant warning when I try to visit.
If you really don't think your website is going to be censored, that leaves the problem of ISPs injecting content. Maybe he doesn't feel that is a big problem, or that there is another way to fight it.
The big push for everything to be https is about making it hard for governments or ISPs to say that some site or another should be an exception.
It's kind of like, wearing masks.. before the policy was that everyone should wear a mask, best to keep it simple and not try to make exceptions that way we will get the most adoption.. except for sites like this, it's like you never actually talk, and have been vaccinated so you are not worried about catching anything and don't wear a mask.
The other part of this is that for people like me who have been serving http for so many years, the campaign for https just doesn't hit as hard as for young people who really grew up with that mindset being preached to them constantly.
But in the end, I think that it is better if everyone does it. Just maybe not quite as severe a problem as you think if a few people slip through the cracks.
I am not trying to relitigate the battle of SSL's naming scheme, that battle was lost, and now people associate "security" with encryption. Who knows, maybe in the future they will associate "security" with bitcoin. But it's certainly not true that every plaintext connection is an insecure connection in the sense of actual security. Not everything needs to be or should be encrypted, and many things obtain no benefit whatsoever from being encrypted.
Especially in a world full of disinformation, authenticity and integrity of information are often a much greater good than confidentiality.
Like it or not, it is up to the information owner to determine their threat model and which mitigations are suitable for that threat model. If someone is broadcasting a message containing information that is public, they may not consider someone intercepting a response and altering it to be a threat that needs addressing, or they may consider alternate mitigations as sufficient -- e.g. the fact that many people can independently verify the information from different sources. For the vast majority of sites, this is a reasonable assumption. Just because you may be worried about this threat doesn't mean the information owner needs to be. Of course you as an information consumer have your own threat model, and if you are really worried about someone targeting you and altering http responses sent to your browser, then you may not want to visit unencrypted sites. That is also legitimate. The information owner can't force their threat model on you anymore than you can force yours on them. But words like "secure" and "insecure" make sense only with respect to a given threat model, they are not attributes of an http connection.
For a good discussion into why _all_ websites should use HTTPS, and the many different ways that not having the connection secured is actively harmful and why should not be done in the modern era.
https://www.troyhunt.com/heres-why-your-static-website-needs...
Not having your site as HTTPS puts all of your website visitors at risk. Even US ISPs like that of Comcast use these very same practices to inject warnings into insecure web traffic[0], some of which look more like advertisements than warnings. And like mentioned in the article, promises from ISPs not to use it for advertisements are just that, promises, and those can be broken in an instant. And when you have the power to inject anything without notice, you can do anything and everything with the website experience. You can attempt to force a download, present scam pages that look like antivirus warnings or software updates, one of the easiest ways to have users fall for malware.
We should _never_ expect regular non-technical users to have all of their threat models in mind, nor should they be expected to understand all of these differences. Website owners should be expected to protect all of their visitors as best as possible and one of the easiest ways to start is by protecting their website with modern HTTPS encryption. Otherwise, it would be like a chef leaving the bones in a salmon before serving to a customer. You could do leave them in, but a customer might not know they are there and you have left a choking hazard.
[0]: https://gizmodo.com/comcast-to-customer-who-noticed-it-secre...
No, it does not. These are bold statements made without evidence that your personal preference should override the threat model of information owners -- that they must worry about something they have looked at and chose not to view as a threat. I once had a website that had Hebrew drills, so you could look up the construct forms of various nouns and other grammatical information. I did not care if an attacker in a coffee shop or other public network was trying to intercept that site and give a victim incorrect Hebrew words. It was not a threat in my threat model. So I did not use https. My website, my information, and I know the threat model to use. My site would not have been more "secure" if everything was encrypted. There would be no meaningful benefit to anyone from me doing that, and being a security professional, I was not interested in security theater, but only actual security.
> We should _never_ expect regular non-technical users to have all of their threat models in mind
Correct. That is why the threat model of the information owner is what determines what a site serves. Information owners generally do have a threat model in mind. It is, after all, their information, their website, and their security policies that matter. They are the ones in a position to decide whether they care if their http responses are altered or not in targetted attacks on public networks. Obviously a site that accepts credentials or displays sensitive information is very different from a site that displays verbal patterns. The fact of the matter is that in many cases, there is no need to care and no real security benefit to encrypting the site.
Except it's often the user who is on the hook for the risk. You mustn't outsource your threat model to someone who doesn't necessarily care about you. Unless you're a sufficiently qualified security expert to be able to judge whether this instance is safe, the only reasonable policy is to never connect to a http website (or one that uses cloudflare, since they offer fake https to their customers).
More importantly, security theater is something that should be avoided as it creates bad habits and promotes irreality in a field already rife with the same. I'm not sure why cryptography struggles so much with this, but there are a lot of people who don't understand what benefits, if any, cryptography provides to their application but decide to add it in anyways.
This should be considered a bad practice. Imagine if someone told you to add a function to a codebase just because other codebases had it, and what harm can it do, even if this function served no purpose and doesn't require too many CPU cycles. Most software developers would oppose the idea, they would want to add code only when it is needed, and would favor the removal of unneeded code as beneficial, given that this simplifies the codebase. The same is true for encryption, which requires a lot of CPU cycles, and adds non-trivial complexity. So the idea that it should be added everywhere even where it's not needed is something we should resist.
The nuance of if encryption is really required in this specific case is pointless when it is so easy and readily available. The effective direction becomes “just blanket serve everything over HTTPS” because there isn’t much downside.
my super-smart and hardworking admins just lost a dozen services over the weekend because one of the hundred "easy" certs they manage expired, was not refreshed for whatever reasons, and the node happened to be an LDAP services node.
at some point, "easy" and "instant" becomes "needs constant attention"
https://www.troyhunt.com/heres-why-your-static-website-needs...
Not having your site as HTTPS puts all of your readers at risk. Even US ISPs like that of Comcast use this very same practice to inject warnings into insecure web traffic[0]. And like mentioned in the article, promises from ISPs not to use it for advertisements are just that, promises, and those can be broken in an instant.
[0]: https://gizmodo.com/comcast-to-customer-who-noticed-it-secre...