Hacker News new | past | comments | ask | show | jobs | submit login

I mean it's a blog, with no ability to sign in / risk leaking any PI. Adding HTTPS would only waste CPU cycles serving the page.



This is a common attitude that I think overlooks a big part of the benefits of secure transport.

If all your traffic is TLS then you have a number of benefits, including principally

1) Noone can MITM the traffic. They can't insert anything in stream or do anything else funky that they absolutely can with clear traffic if they own your route somehow.

2) The amount of information leakage is less due to chaffing. Consider a situation where all your sensitive traffic is HTTPS and all your other traffic is HTTP. In that world a bad person monitoring your traffic may not know the details of your sensitive traffic, but they know that the metadata of any HTTPS indicates sensitive traffic. If everything is HTTPS on the other hand literally any of the metadata could be sensitive or non-sensitive and they have no way of telling. The more non-sensitive traffic is encrypted the greater the benefit of this protection.

So given those are pretty significant benefits for visitors to your site it's nice to provide the option of HTTPS. On a seperate note, the amount of CPU cycles consumed by serving HTTPS these days is really trivial especially if you use a EC cert or similar.


Sure, but there's a wider context of encrypting all internet traffic to provide less context for the stuff that is sensitive.


Some telecoms carriers inject their own Javascript into every HTTP page.

I've seen some of that break my pages for some users. It went unnoticed for months until someone complained that "my" Javascript was badly written and breaking something. After a difficult round of conversations where each of us assumed the other was seeing the same page contents, we compared source and found the culprit was injected by the carrier.

So we changed to HTTPS to fix that problem.


What about an inbetween actor changing the content? Or someone just hijacking the website?


I suppose someone could mitm impersonating pg? Seems like a low risk though.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: