Hacker News Reader

Comment by jacquesm | Hacker News Reader

Why would you host a blog on a https url at all?

Why not? Why shouldn't everything be encrypted? Yes, you're probably only leaking the specific page you visit, but the principle stands.

I like the idea of information that is public (eg. a blog, as opposed to your activity in your favorite webapp) being easily cached.

You might appreciate your ISP's web proxy cache if you live in New Zealand, for example.

It would be nice if everything magically worked in this case, but I don't think we're really there yet. And I'll admit there's a downside - SSL also buys you data integrity (eg. was the blog post modified in transit?) and you don't get that here.

Still, I'm not convinced about SSL-by-default for general public information websites (with an obvious exception for sensitive health or political sites, etc).

I also don't buy the "protect your readers' privacy" angle. To me, that's "provide your readers an illusion of privacy", since they still have to trust $random_website to not leak the logs they are able to gather. Readers who want identity privacy should use Tor or similar, and not be misled by https-everywhere.

It'd be nice if we had a signing mechanism; it could reuse most of the mechanics of SSL encryption (same certs, same algorithms) and it'd provide tampering-proof communications would hindering caching. And it could even be done statically, without requiring more servers resources per request (e.g. as a step during static site generation).

Because the blog admin area should be on https anyway and it's an opportunity to play with https.

To protect your readers' privacy.

It only protects the specific page they're reading. The domain goes in cleartext (that's the whole point of SNI). Kind of a weak protection.

It's really a wash since if you don't have SNI, the IP address uniquely identifies the site that the user is going to and the IP address is on every packet but is not ever encrypted.

Reply on news.ycombinator.com