Hacker News new | ask | show | jobs
by SamReidHughes 3862 days ago
What's missing is, why? It's a static site, so you won't get any real privacy about what you're reading. If you have binaries to distribute, you have other features for releasing them that let you use TLS.
3 comments

Script injection (see Comcast a few weeks ago), page manipulation (eg. pointing at download links with malicious side-load), keyword-based filtering (HTTP inspection). If you're using non-default DNS servers, you also get privacy on which site you're reading: all HTTP request headers also get TLS protection, which includes hostname, path, etc. And while outside of Tor, there's no protection for the IP address (so third parties can know you're reading a page on github), "a site hosted on github" encompasses a wide variety of content.
> "a site hosted on github" encompasses a wide variety of content.

That doesn't help, you can easily fingerprint a page from secondary requests or incoming/outgoing links.

AFAIK the hostname is not encrypted when using SNI
Well in the past China has intercepted non-https connections and inserted malicious javascript that joined the users into a botnet that launched a DDOS attack on github.

The "Great Cannon".

It's a valid point as the content of the site itself can still be manipulated if not served securely. However that being said, it does seem like a very low risk situation and if needed there are tons of other options.

Most of the Pages sites are just about projects themselves so the readme.md and wiki in the github repo can already serve over https and do the job just fine.