Hacker News Reader

> why localhost should scream "insecure"

What tool is screaming at you that localhost is insecure?

They may be using a self-signed cert so it’s https://localhost and the browser is flagging the cert rather than localhost itself.

browsers. padlock icon is crossed out

I just tested this and don't see that. I compared http://neverssl.com to running "python3 -m http.server" and visiting http://localhost:8000

* Chrome: "Not Secure" on neverssl, "i" in a circle on localhost

* Firefox: Padlock with a red line through it on neverssl, page icon on localhost

* Safari: "Not Secure" on neverssl, no message on localhost