API Shouldn't Redirect HTTP to HTTPS

Re:API Shouldn't Redirect HTTP to HTTPS by bigstrat2003 on Tuesday May 28, 2024 @06:01PM (#40506074)

Dogma is how religion works, not engineering. If someone doesn't believe the benefit is worth the cost, they can and should question the practice. Blind obedience to a dogma of "just do HTTPS" is not a reasonable approach.

[ Parent | on HN ]

Re:API Shouldn't Redirect HTTP to HTTPS by HL33tibCe7 on Tuesday May 28, 2024 @06:13PM (#40506177)

“Rules of thumb” form many of the fundamental tenets of engineering practice.

Using HTTPS everywhere is one such rule of thumb.

It’s just not worth expending the mental energy considering every single edge case (while likely forgetting about some) in order to try and work out whether you can cut the corner to use HTTP rather than HTTPS, when using HTTPS is so easy.

[ Parent | on HN ]

Re:API Shouldn't Redirect HTTP to HTTPS by ozim on Wednesday May 29, 2024 @02:12AM (#40508993)

You cannot call out something dogma if you don’t understand reasons.

Injecting ads by ISPs into http is documented and known - they can inject anything on transit of HTTP it can be done automatically and basically with 0 cost. ISP is one the other all kind of free WiFi.

It is not only “NSA will get me” or only financial transactions. There are new known exploits in browsers and systems found on daily basis.

So reasoning is someone has to be of interest - not true because it is cheap and automated tls is making cost higher for simply scooping stuff.

[ Parent | on HN ]