I remember reading an article along these lines a few years ago when arguing against using https absolutely everywhere.
Ok. Not relevant here. I don't care if my ISP knows I'm learning SELinux. And they would know that even with HTTPS.
> Some ISPs use that information for advertising, or inject custom javascript into unencrypted web pages
Sounds like an ISP problem. Buy service from a better one. No need to impose SSL on the website for this.
> HTTPS is free
Absolutely not. It takes time and effort to set up. And then maintain forever. Plus you're introducing an unnecessary dependency on multiple third parties.
> HTTPS is fast
HTTP is faster.
Thats not always true, thanks to awful middleware boxes. Especially inside corporate networks.
Also TLS is required for http2 - which is much faster than HTTP1.1 in almost every case.
> It takes time and effort to set up. And then maintain forever.
People level the exact same accusations at SELinux. Some would say SELinux doesn't add a lot of security, and its a pain to set up and maintain.
HTTPS is much easier to set up than SELinux thanks to letsencrypt and certbot. And it adds real security for your users. Its weird to promote SELinux but not bother with TLS.
But all these complaints are moot in this case anyway because this website is hosted by github pages[1]. Github will do all the heavy lifting to make HTTPS work. The owner just needs to set DNS up:
https://docs.github.com/en/pages/configuring-a-custom-domain...
Oh yeah and you know what I was saying about http2 being faster than http1.1? Github enables http2 automatically on github pages. But only, y'know, if you set your site up correctly.
[1] At least according to the invalid cert warnings I'm seeing
Just move I guess.
To protect users, traffic over the internet should always be encrypted. Even if you don't care, as a user I care. And thankfully the people in charge of our software, protocols and ecosystem are slowly forcing the issue on our behalf:
- Unencrypted http will eventually be deprecated from web browsers. (Newer browser features are already banned in insecure contexts).
- iOS forbids applications from making unencrypted HTTP connections.
- The IETF more or less requires new protocols to be secure.
We'll see more of this over time. Its a good thing. Get on board.
HTTPS is free and stops most of these tricks from working. You can still sniff the domain name via DNS or SNI, but HTTPS blocks attackers from seeing the URL you're visiting, or seeing the traffic the server sends back. It also stops people from doing MITM attacks on the connection.
Its 2022. HTTPS is fast, it works great and its free. Use it everywhere.