Hacker News Reader

I would expect most companies serving pages over SSL to already be serving assets over SSL to avoid the mixed content warnings that most browsers currently give when loading non-SSL assets on an SSL page.

A lot of companies make profit by selling SSL as an pro feature. Just look at all those services where SSL login is only available at a certain cost level. (And using SSL only for the login form is a joke, too.)

It's a shame that these are making money from that basic consumer security. Especially since SSL is neither expensive nor need a lot of performance.

If you care about security enough to use HTTPS, you need to serve assets over SSL anyway. Note that this does not affect all assets – only active content – which means that you can still serve images, audio, video, etc. over HTTP if you're comfortable with the risk of interception, spoofing, etc.