Hacker News Reader

bigstrat2003

There's nothing sensitive, therefore there is no reason to use TLS.

No! Stop! Why won’t this one die! MITMing is a two way street. I could intercept sensitive data, or I could shove something in that tricks the user (phishing, etc), exploits the user agent, and more!.

“You only need encryption for the sensitive stuff” is what we did, poorly, in the late ‘00s / early ‘10s, and it was rightfully proven to be a bad idea. There’s a reason why browsers treat HTTP the way they currently do, and it isn’t because they’ve been co-opted by Big Certificate Authority.

EDIT: and as the other commenter says, there are download links.

You don't need encryption to prevent something shoved into it without detection

No but we have no "httpv" protocol scheme to require signatures but not encryption

Which IMO has been a huge mistake since breaking caching proxies for networks because we want to prove authenticity and have to do secrecy as well has been quite silly.

No, but you do need authentication, and TLS does both.

Other than the build and download links?

Reply on news.ycombinator.com