Yeps, gnuplot's home page is still on clear text HTTP:// ...
6
Replies
0
Boosts
@bagder That hasn't been touched since the '90s 😲
And I don't see why it shouldn't?
I see the argument about how most traffic needs to be encrypted by default to prevent tracking…
And of course anything with forms/login/important data needs to be https!
But the odd information page that doesn't contain anything private/secure/nsfw? Why not have those rare advantages that unencrypted provides (i.e. easier caching, simplicity)
@dat to avoid network snoopers to see what I do, to avoid MITM, to avoid injected content, because browsers warn about cleartext, to allow better HTTP features that can't be done over cleartext on the internet, to...
There's a long list. But sure, to each their own.
to avoid network snoopers to see what I do,
therefore "the majority of requests needs to be https" - I don't see a problem in someone knowing I accessed some technical docs, but if <90% of my traffic is secure, then there might be a point where people start to wonder about single secured connections
to avoid MITM
What should people do with MITM on tech docs or some random static blog I'm reading? Give me wrong info? I don't see the problem, really.
because browsers warn about cleartext
I concede that point. Even if it's rather some kind of circular reasoning, but that warning is usefull to get that percentage high enough.
to allow better HTTP features that can't be done over cleartext on the internet
What would that be? I can't really think of many, but that's far more relevant to your work than mine, so probably you know stuff I don't?
Is that only those things like WebRTC/Camera/Geolocation (not applicable for the site in question) or HTTP3 (might speed things up) that require encryption to have a sane default or is there something that actually needs it?
@dat operators have injected ads on cleartext websites in the past, that's as ancient as the web. Or things like tracking identifiers in headers.
"new" HTTP features would be for example brotli compression and other HTTP details added the last few decades. Because middle-boxes can see cleartext, they prevent new things (google "Ossification")
@bagder "Nothing to hide."
