[diafygi]

And I hate the fact that I can't trust the network to not modify your sites when I visit them. So I guess we can both be mad together.

Remember that https offers both privacy and integrity, so even if you don't care about the privacy, you should care about the integrity.

[whorleater]

>you should care about the integrity

I mean, there's the option to not use my site. Can I take a stand against HTTPS because I believe PKI to be a dumpster fire?

[dagenix]

This is like taking a stand against seatbelts. No one can do you from doing so, but it makes very little sense to and seems like it has more to do with an insistence of being contrary than to make a point or actually change something.

[crunchatized]

I mean, you can.

But the heavily flawed PKI is rapidly improving from the dumpster fire it has been. The glaring 'blindly trust every CA to never go rogue' problem is on the edge of being solved, with browsers beginning to require CAs to submit all new certificates to Certificate Transparency logs in order to be accepted. Attackers would have to either compromise multiple targets in detectable ways, or publicly disclose their forged certificate to the world before they can use it, at least once the older certificates from the dark ages of 2017 have all expired in a few years.

[dwheeler]

Sure, PKI has serious problems. But HTTP without HTTPS has far worse problems. Nothing is perfect. Waiting for the perfect, while failing to help in easy ways that you can do now, is a poor choice.

In any case, HTTPS doesn't protect your site, it protects the users of your site (by protecting the confidentiality and integrity of the data in transit). If you don't care about your users, then those potential users should avoid your site.

MITM attacks have become pervasive. HTTPS was less important years ago, but that time has passed. For example, ISPs, hotels, airlines, and many others have decided that it's okay to attack their customers. Supporting HTTPS is an easy way to help those users. It doesn't need to be perfect to be useful.

[yjftsjthsd-h]

Of course you can do that. And everyone can choose not to use insecure sites like yours.