[jocoda]

I worked on a project where the site uses HTTP. Initially I did a double take as using requires a login, thinking that's just wrong.

But after a bit of reflection I now think that in this specific case there's nothing bad about using http. Services are offered on a first come first serve basis to a large but closed group of valid users. Key is that there are a bunch of real world processes that follow the initial trigger with no practical way for any other party to benefit.

The site is extremely simple but blazingly fast.

[josephg]

Sorry, but why is http a benefit here? Http has lots of downsides - like the traffic can be snooped and edited. (It is edited by many ISPs for advertising. And in countries like Australia the ISPs are required by law to log all http requests.) And of course, you can’t use http2 without tls.

What is the benefit to turning https off?