Hacker News Reader

Comment by josephg | Hacker News Reader

Because plenty of unscrupulous ISPs and governments log unencrypted web traffic. Some ISPs use that information for advertising, or inject custom javascript into unencrypted web pages their customers visit for who knows what reason.

HTTPS is free and stops most of these tricks from working. You can still sniff the domain name via DNS or SNI, but HTTPS blocks attackers from seeing the URL you're visiting, or seeing the traffic the server sends back. It also stops people from doing MITM attacks on the connection.

Its 2022. HTTPS is fast, it works great and its free. Use it everywhere.

View on HN

Also technology wise its not 2022 everywhere, if you know what i mean. Many poorer nations suffer from inferior infrastructure, which could mean slower loading / processing times for https based webpages.

I remember reading an article along these lines a few years ago when arguing against using https absolutely everywhere.

Nope. SSL was pretty okay performance-wise 15 years ago. So no, we don't know what you mean. 'Poorer' infrastructure excuse is void. If we cared about performance we'd get rid of almost all javascript, not https.

Yep. Also http2 more than makes up for the performance difference. And http2 requires TLS.

What is the concern with these logs? Do they contain end user information? May be IP, anything else?

> Because plenty of unscrupulous ISPs and governments log unencrypted web traffic.

Ok. Not relevant here. I don't care if my ISP knows I'm learning SELinux. And they would know that even with HTTPS.

> Some ISPs use that information for advertising, or inject custom javascript into unencrypted web pages

Sounds like an ISP problem. Buy service from a better one. No need to impose SSL on the website for this.

> HTTPS is free

Absolutely not. It takes time and effort to set up. And then maintain forever. Plus you're introducing an unnecessary dependency on multiple third parties.

> HTTPS is fast

HTTP is faster.

>Sounds like an ISP problem. Buy service from a better one. No need to impose SSL on the website for this.

Just move I guess.

Or don't. It's not a problem that needs to be solved server-side.

It is a problem to solve over the wire, because we should assume at this point that bytes over the internet are monitored. Both in the east (Great Firewall of China) and the west (NSA + Snowden). I don't want my ISP or my government knowing which websites I'm visiting, what apps I open on my phone or, really anything else about me without a court order. Insecure-by-default is a bad default.

To protect users, traffic over the internet should always be encrypted. Even if you don't care, as a user I care. And thankfully the people in charge of our software, protocols and ecosystem are slowly forcing the issue on our behalf:

- Unencrypted http will eventually be deprecated from web browsers. (Newer browser features are already banned in insecure contexts).

- iOS forbids applications from making unencrypted HTTP connections.

- The IETF more or less requires new protocols to be secure.

We'll see more of this over time. Its a good thing. Get on board.

> HTTP is faster.

Thats not always true, thanks to awful middleware boxes. Especially inside corporate networks.

Also TLS is required for http2 - which is much faster than HTTP1.1 in almost every case.

> It takes time and effort to set up. And then maintain forever.

People level the exact same accusations at SELinux. Some would say SELinux doesn't add a lot of security, and its a pain to set up and maintain.

HTTPS is much easier to set up than SELinux thanks to letsencrypt and certbot. And it adds real security for your users. Its weird to promote SELinux but not bother with TLS.

But all these complaints are moot in this case anyway because this website is hosted by github pages[1]. Github will do all the heavy lifting to make HTTPS work. The owner just needs to set DNS up:

https://docs.github.com/en/pages/configuring-a-custom-domain...

Oh yeah and you know what I was saying about http2 being faster than http1.1? Github enables http2 automatically on github pages. But only, y'know, if you set your site up correctly.

[1] At least according to the invalid cert warnings I'm seeing

Reply on news.ycombinator.com