Consider disabling HTTPS auto redirects

Re:Consider disabling HTTPS auto redirects by SquareWheel on Monday June 27, 2022 @11:04AM (#31895558)

Not a compelling argument in the least. MITM still means ISPs can track and inject ads, regardless of how static the content is on your website. And the performance argument is completely invalid because it's only measuring total bytes, and doesn't consider HTTP/2 multiplexing.

> It should be mentioned that my personal website is also plain text based and tiny. Imagine the impact of a blog article or research paper with significantly more content.

The larger the website, the greater the improvement from using HTTP/2 (which requires TLS). And it doesn't take much data at all to offset that TLS lookup.

This post is justifying bad behavior. The only sites that can afford to remain http are neverssl.com and local development.

[ Parent | on HN ]

Re:Consider disabling HTTPS auto redirects by soruly on Monday June 27, 2022 @11:48AM (#31896247)

even for local development, I tend to serve the HTTP server with nginx for adding HTTPS. Because many of the web APIs, like service worker, clipboard APIs, are only available in HTTPS context.

[ Parent | on HN ]

Re:Consider disabling HTTPS auto redirects by JamesSwift on Monday June 27, 2022 @12:07PM (#31896575)

Unfortunately mobile apps complain a ton about 'insecure' https, and make it a real chore to do local certs. So its usually easier to just run over http locally when doing mobile dev.

[ Parent | on HN ]