I /really/ need to add http://n-gate.com to my rss reader because it’s *so good*. This is the best description I’ve ever seen of the Microsoft acquisition of Github.
@aearil I have very important needs regarding bad faith
@wohali haven’t looked. Guess I’ll have to find some other way? Maybe a crontab that fetches the latest post and inserts it into the feed reader dB?
@wohali hey actually my reader found a feed so 🤷
@tyil ain’t no point in setting up https for a static site with no exchange of information. Literally who cares.
@wxcafe HTML is information, and the purpose of HTTP is to exchange it.
Anyone intercepting the connection at any point can still inject stuff (like scripts), even if the original host only provides static content. And anyone can still read out the entire message and use it for personal/meta data harvesting.
Anyone understanding what the words "information", "exchange" and "security" mean would care.
After all it is the authors decision not to do it. Can not really blame someone for that. If he doesn't know better: educate him.
If you really cared for "security" in that context you should try to get a cert fingerprint in-person from the author/admin. The certificate authority system is broken anyway...
@andi @tyil look, I know. I have TLS everywhere. I used to have self-signed certs everywhere before LE came along. I have a yubikey to store my gpg key. I do totp 2fa on ssh logins. I get crypto. But I also get that some things are not worth tls-ing, and that who the fuck gives a shit. It’s literally not a problem for anyone. It’lol be flagged as insecure by browsers soon and they’ll probably upgrade then. It’s fine, calm down, stop telling strangers on the internet.
But it would prevent certain attacks for next to no cost. This faulty concept that some people have that plain-text sites are somehow secure by default is harmful to propagate, and I'd rather people not do that. Which is why I tried to explain that part.
Just as there's no magic bullet for security, nor should anything be assumed as default secure, one can't be dogmatic in telling a total strangers what their threat model or cost/benefit is.
I've seen lots of people introduce new security holes trying to make TLS work in their environment. LE made it soooo much easier, but in shared environments (i.e. most hosting), TLS is still non-trivial.