Hacker News Reader

Not only do the forums have HTTPS disabled, but they expect you to download executables to run on your computer over HTTP. And, the kicker: they already have a legit HTTPS cert for the entire site: visiting on HTTPS redirects you to HTTP _facepalm_.

Never heard of Spine before your comment, but if I found this in the wild I'd assume it was amateur hour and turn back immediately.

View on HN

A slight correction here, the download of the exe does take place over https. As does buying the software, and signing up to the forums. But everything else doesn't?

The software itself is some of the smoothest and most stable I've ever used. And when there's an update within the software that, as far as I'm aware, takes place over https too.

But the rest of the site and forums, even when signed in, is http, and I don't really know why.

The download itself is over https, but the page where you click the download link is http.

If someone were going to MITM the executable, they can just MITM the download page instead and point the download button to their own server with the bad executable.

Exactly; this is why mixed content is problematic, and the r'aison d'etre for HTTPS Everywhere.

Reply on news.ycombinator.com