Re:The modern HTTPS world has no place for old web servers
by MaxBarraclough on Wednesday May 13, 2020 @04:27PM
(#23171445)
> Weather forecasts are public information, so what level of safety is provided by HTTPS to the point where it should be not just a default, but the only option for developers?
Even if it's public information, you should protect against an attacker modifying the payload to exploit a weakness in your browser/application, and to protect against any any other kind of unauthorised modification of the payload. (I see Cthulhu_ already mentioned this.) We've discussed the non-obvious advantages of HTTPS before. [0][1] There's a reason Netflix encrypt video streams. I agree it's probably not worth breaking existing applications to encrypt the weather data, but it's worth doing going forward.
Even if it's public information, you should protect against an attacker modifying the payload to exploit a weakness in your browser/application, and to protect against any any other kind of unauthorised modification of the payload. (I see Cthulhu_ already mentioned this.) We've discussed the non-obvious advantages of HTTPS before. [0][1] There's a reason Netflix encrypt video streams. I agree it's probably not worth breaking existing applications to encrypt the weather data, but it's worth doing going forward.
[0] https://news.ycombinator.com/item?id=22933774 (Forgive me linking to my own comments)
[1] https://news.ycombinator.com/item?id=21912817