[eropple]

It protects visitors on compromised networks--and that includes things like ad injectors at coffee shops that might push nasty code to them, not just people dealing with oppressive regimes and so on. It also provides some benefit around "well, that page is HTTPS, so it's more interesting"--if every page is HTTPS, the signaling value of switching to HTTPS is destroyed, and that is a good thing.

HTTPS everywhere is a positive, and it is a good thing to do.

[ogurechny]

“Specialists” drinking the Kool-Aid look most depressing. Don't you find it strange that each time each proponent believes it's important to mention a stereotypical script kiddie on a public WiFi, something that doesn't bother a lot of people at all because of they way they connect to internet, and hasn't been a common occurrence even in the days of completely broken wireless security protocols?

What is/was common is internet providers' interest in making money on personal behavioral data in the traffic they transfer. DPI boxes to passively gather statistics or actively inject ads (and even rewrite existing ads) have been offered and tested since the 2000s across the world. Scale of big ISPs would make them Google's (&Co) competitors on personal behavioral data market, and mobile ISPs would combine it with location data, too. Moreover, they would be able to use Google's own tracking cookies to track individual users instead of inventing the classification systems (either by observing them in clear text, or by injecting scripts). The security and income of web services is the real reason for the global “HTTP is deprecated, switch to HTTPS” campaign, not you and your “privacy”.

[shartacct]

Ad injectors on public wifi is a marginal 'risk' considering this page is targeted to professionals and informed hobbyists anyway, who will predominantly just be browsing from home, work or with a VPN that tunnels traffic through either a server they control or a service provider's server whom they trust anyway.

[eropple]

All risks are marginal when you handwave hard enough.

TLS is basically-free in 2021. It's fine and it is good to do.