Hacker News new | ask | show | jobs
by JTyQZSnP3cQGa8B 953 days ago
Some ISPs modify the content and inject ads in HTTP web sites.
3 comments

I get that. I understand why viewing http is insecure, I dont understand why serving it is insecure.

Apparently this rubs people the wrong way. I get it, run Lets Encrypt and certbot blah blah, but if I am hosting an ESP32 in my house for a hobby project, I running HTTP on the LAN.

HTTP in your house, over your LAN, seems like a fine thing to do. I think people are assuming that your blog would be on the internet.
> I get that. I understand why viewing http is insecure, I dont understand why serving it is insecure.

Presumably you are serving that content so it can be consumed no? It's not like your consumers can consume https if you only serve http. But yeah I suppose if you are serving read-only content and don't give a shit about what happens client side, there's a lot less reason for https.

Serving data via http is insecure because that data can be intercepted, read and modified.

If it's entirely public data then there's no security risk to the server. The security benefit is for the clients, so unless you hate your users you should use encryption even for totally public static data.

> I understand why viewing http is insecure, I dont understand why serving it is insecure.

People are assuming you want others to be able to see want you are serving. In such case, the server is the only one who can secure the transmission to prevent MITM. The viewer cannot reach over and add in https into the request to prevent their ISP from injecting ads (or other kinds of MITM changes).

Weelll they could use a vpn
Mine tries, and breaks the page in the process. I effectively cannot view any pure HTTP website.
You can view pure HTTP website through VPN. It basically encrypted tunnel between you and VPN server through your ISP. So your ISP couldn't try to interject the encrypted connection.

However, your browser might prevent you from connecting to http due to strict https only policy. My browser will stop any connection to http page and throw up a warning.

If your ISP is this shitty you should probably take your money elsewhere.
ISP’s are often a monopoly or duopoly of equally shitty options.
Not everywhere though. The idea of an ISP in France injecting content is insane (and wild be completely illegal as well)
Then leave whatever tech backwater you live in and move to the first world.
My understanding is that this tech backwater is most likely the good ol' US of A.