News for hackers. Stuff that matters.

A comment on What's on HTTP?. Parent comment

Re:What's on HTTP? by toast0 on Thursday March 19, 2026 @12:26AM (#47434923)
Invalid certificates are one thing, and you can probably click through that. But maybe your older browser tops out at TLS 1.0, and servers don't offer that anymore (I think the credit card PCI cert discourages it) or maybe your older browser can't do ECC certs and the server you want to talk to only has an ECC cert.

Or maybe your older server only speaks TLS 1.0 and that's not cool anymore. Or it could only use sha1 certs, so it can't get a current cert.

When I can, I like to server http and https, and serve the favicon with HTTPS and use HSTS to induce current clients to use https for everything. Finally, a use for the favicon.

[ Parent | on HN ]
Re:What's on HTTP? by Dylan16807 on Thursday March 19, 2026 @01:45AM (#47435410)
Someone with an older browser can update the browser outside of very niche situations. I have little concern for that use case.

If a server can't do TLS 1.2 from 2008 I question how it's still stable and unhacked more than anything.

[ Parent | on HN ]