8 ms·

We seriously need to have a new HN policy that requires every link posted to be HTTPS link

PhilipRoman 3y ago
Why? There are plenty of older useful sites which work just fine over HTTP. If you mean for cases where https is supported, but link is http - I agree.
- MaxBarraclough 3y ago
  There are plenty of good reasons to use HTTPS. [0] It doesn't make sense to link to HTTP when the site works fine over HTTPS, which is the case here. I'm not sure I'd want to completely ban all HTTP though. [0] https://news.ycombinator.com/item?id=27507886 https://news.ycombinator.com/item?id=27507886
deleted 3y ago
[deleted]
appplication 3y ago
Honest question: what is the consequence of visiting an HTTP link rather than HTTPS for a site where my interaction is read only? Is there some security issue? Or is it privacy concerns.
- uobytx2 3y ago
  There is a security issue and a privacy issue. The privacy issue is that your local WiFi provider, direct isp, and all the intermediate isps can see not only which site you visit, but all your activity within that site (like which pages you visit or things you download). The security part is that any of those who can view can also do a “man in the middle” attack. Comcast could decide to send you a different version of the website that was more favorable to their company, or inject ads (ISPs have been known to inject ads on sites they don’t own before https was big). A hacker could send you a version that gets you to download malware by replacing content or links. They can see and effect everything you do and see in such a site if they can intercept your request.
daedalus_j 3y ago
Just run Firefox in HTTPS only mode. [0] You'll get a warning for any site that CAN'T be upgraded to HTTPS, but any site that supports both you'll just go straight to the HTTPS version. [0] https://support.mozilla.org/en-US/kb/https-only-prefs https://support.mozilla.org/en-US/kb/https-only-prefs
up2isomorphism 3y ago
After reading something on concurrent algorithms you come up with this irrelevant observation? Also, no if an http link is about a good concurrent algorithm, I will read it anyways.
anticensor 3y ago
There still are a few HTTP-only websites.

Why? There are plenty of older useful sites which work just fine over HTTP. If you mean for cases where https is supported, but link is http - I agree.

MaxBarraclough 3y ago
There are plenty of good reasons to use HTTPS. [0] It doesn't make sense to link to HTTP when the site works fine over HTTPS, which is the case here. I'm not sure I'd want to completely ban all HTTP though. [0] https://news.ycombinator.com/item?id=27507886 https://news.ycombinator.com/item?id=27507886

deleted 3y ago

[deleted]

appplication 3y ago

Honest question: what is the consequence of visiting an HTTP link rather than HTTPS for a site where my interaction is read only? Is there some security issue? Or is it privacy concerns.

uobytx2 3y ago
There is a security issue and a privacy issue. The privacy issue is that your local WiFi provider, direct isp, and all the intermediate isps can see not only which site you visit, but all your activity within that site (like which pages you visit or things you download). The security part is that any of those who can view can also do a “man in the middle” attack. Comcast could decide to send you a different version of the website that was more favorable to their company, or inject ads (ISPs have been known to inject ads on sites they don’t own before https was big). A hacker could send you a version that gets you to download malware by replacing content or links. They can see and effect everything you do and see in such a site if they can intercept your request.

daedalus_j 3y ago

Just run Firefox in HTTPS only mode. [0] You'll get a warning for any site that CAN'T be upgraded to HTTPS, but any site that supports both you'll just go straight to the HTTPS version. [0] https://support.mozilla.org/en-US/kb/https-only-prefs https://support.mozilla.org/en-US/kb/https-only-prefs

up2isomorphism 3y ago

After reading something on concurrent algorithms you come up with this irrelevant observation? Also, no if an http link is about a good concurrent algorithm, I will read it anyways.

anticensor 3y ago

There still are a few HTTP-only websites.