News for hackers. Stuff that matters.
Re:API Shouldn't Redirect HTTP to HTTPS by HL33tibCe7 on Tuesday May 28, 2024 @06:04PM (#40506107)
To me, HTTPS is worth it alone to eliminate the possibility of the ISPs of people reading my site from injecting shit (ads, trackers, etc.) into the responses I send to them.

It’s completely trivial to set up, there’s really no downside at this point.

Re:API Shouldn't Redirect HTTP to HTTPS by samatman on Wednesday May 29, 2024 @12:04PM (#40513427)
This is the somewhat depressing but accurate answer. HTTPS doesn't mean you are communicating sensitive or private data, it means you want the client to see what you send them, and not something else.
Re:API Shouldn't Redirect HTTP to HTTPS by averageRoyalty on Tuesday June 04, 2024 @08:49PM (#40580372)
To be fair, triviality is relevant to the tooling you run and there are many downsides - extra negotiation and traffic, unsupported on older clients without using up an IPv4 address, certificate expiry, etc.

For most cases these are non issues, but there are many scenarios where those things can outweigh the potential of your ISP modifying/reading. If that's still a concern, you can tunnel through your ISP to a more trusted exit point.