side note (and maybe I gave flu and itโs making me more stupid) but what are the arguments for having SSL on brochureware websites that donโt collect private information?
because we used to live in a world where ISPs, open wifi networks (cafes, etc) could intercept your HTTP responses and inject javascript/HTML into your browser to force you to see ads and/or attack you
Thanks everyone for your comments on this. I like this excerpt from doesmysiteneedhttps.com:
"this discussion isn't about PKI. It's the best system we've got for right now. Deal with it and secure your site. Use CAA records to restrict which CAs can issue certificates for your site, then cross your fingers and hope transparency and oversight works (it does, so far)".
Do you all feel that there is enough integrity in browser trusted root certificate stores to still provide robust defence against the content / malware injection threat?
Also - have these kinds of injection attacks ceased now, and is SSL the reason for this?
> Do you all feel that there is enough integrity in browser trusted root certificate stores to still provide robust defence against the content / malware injection threat?
It's the best we can do with what we've got to work with. All we can hope is that the bad actors get caught from the Certificate Transparency Logs and are swiftly removed from all root certificate stores as their punishment.
Thanks again to everyone who contributed to this thread. So this is what I'm hearing:
HTTPS still matters, even for static or non-interactive sites: โข Mitigates content injection: Many ISPs and network operators have historically injected ads, tracking scripts, or even malware into unencrypted traffic. HTTPS prevents this by ensuring the integrity of the response between server and browser. โข Defends against surveillance and manipulation: Examples of DNS hijacking, Gmail session spoofing, and targeted malware campaigns (e.g. FinFly), all made possible through unencrypted channels. HTTPS helps block these classes of attacks. โข Removes network-level ambiguity: On public or hostile networks (e.g. hotel WiFi), HTTPS is the only realistic protection against on-path attackers modifying or observing content in transit. โข Accessible and frictionless today: With Letโs Encrypt etc deployment is largely automated and cost-free for most use cases. โข Normalizes secure transport: Widespread adoption means sensitive or at-risk traffic doesnโt stand out. Universal encryption helps everyone by minimizing soft targets.
On the other hand:
The CA model is a systemic weakness: Certificate Authorities remain a centralized point of failure. Trust is implicit and broad, and mechanisms like Certificate Transparency offer only partial mitigation. โข Operational complexity remains an issue: Some tooling (e.g. Certbot) is complex and prescriptive, and certain practices (like root-required processes) can introduce risk or confusion for small deployments. โข HTTPS doesnโt secure everything: It encrypts transport, but does not protect against compromised endpoints, malicious JavaScript, or bad site logic. โข Trust shifts to browser vendors: Efforts like DNS-over-HTTPS, cert pinning, and HSTS move the locus of trust from networks to browsers โ trading one set of risks for another.
Yes to basically all of this, but I would suggest that trust in browsers over networks is demonstrably better, where those browsers' source code is available. With networks there are as many chances for something to be wrong as there are networks, and each network's problems are only visible and addressable by a small group. For browsers, anyone who can see the source can evaluate it, giving a much wider opportunity to spot misconfiguration and error, and it only needs correction in one place for everyone to receive the benefit.
@charlvdwalt the content of the website doesnโt matter because the content is whatever an attacker wants it to be if you arenโt using SSL. Your brochureware is now malware.
@charlvdwalt SSL is super important and all, but that statement is awfully FUD-y. The odds of somebody actually doing that are vanishingly small, but you make it sound like their site can be replaced by anyone any time
regimes have used it as an attack vector, and so did several democracies too. ISPs have used it to inject ads. Encryption isn't only about privacy, it's critical to ensure that the contents of a message you received haven't been tampered with.
@gabrielesvelto @iagox86 @charlvdwalt The regimes most of us need to worry about all have their own CA or several they can get to do their bidding with some kind of "national security letter".
@iagox86 @charlvdwalt No, it was actually a really big issue which is why Google incentivized it. ISPs were injecting ads into random webpages, law enforcement and intelligence agencies made frequent use of it, and it was also a massive privacy risk. Almost every service provider has deep packet inspection and can/will monitor everything you do.
- adds dependency on CA - requires one more thing to work, ie be kept updated, to request new certs regularly - locks out old devices that don't support the crypto-flavor-of-the-month - the above adds friction, which makes Cloudflare et al more attractive to not have to bother, leading to increased mono culture
Encryption by default has removed a whole category of not just attacks, but scummy business practices. A little inconvenience to administrators is not even worth talking about.
Your comment reads exactly like a politician arguing for stripping worker protections or safety regulations because they inconvenience employers.
Itโs tone deaf, deliberately ignorant, and dismissive of people who get to not be taken advantage of easily due to these measures.
In practice I've had more problems with broken https cert setups blocking me from pages that I've tried to access that I've had with ISP-injected ads. But I don't live in the US where that is/was legal, so YMMV I suppose.
And the fact that Letsencrypt and Cloudflare are used by such a large percentages of websites is a huge problem, IMHO. We need fewer single-points-of-failure, not more.
@mikaeleiman @slotos I would argue you see less of the latter issue because enough sites use SSL that it's not worth the effort for the ISP to set up an advertisement injection. Prevention tends to reduce the chances of a problem occuring.
@todb @iagox86 @charlvdwalt @pluralistic I remember phone interviewing with some company that was doing injections as part of "web acceleration". I did not follow up once i learned that aspect.
Also that was after working at AOL and learning their image compression was actually not bad... as long as you didn't dial all the settings down to their lowest values (as they did). So would have been sometime after 2004
@nuintari @todb @iagox86 @charlvdwalt @pluralistic Frontier (formerly Verizon's west coast network) rewrote Google search results via DNS hijacking to add referral codes to Amazon, etc, and may or may not have added their own ads. Pre SSL, of course. I had a reproducible test case that ran via cron at home so we could see when they turned it off and on.
The irony that this page isn't HTTPS and I can't change it to HTTPS, and searches from the main website drop it down to HTTP as well isn't lost on me...
(I can only guess they have a different host for their older articles that doesn't support SSL).
@azonenberg @nuintari @todb @iagox86 @charlvdwalt @pluralistic another example I can think of is that as recently as the late 10s, there was still the issue of cell vendors inserting mobile subscribersโ MSISDNs (or similar tracking ref) using HTTP transproxies for all non-HTTPS traffic - I recall this with at least one of the big US networks, and Vodacom in ZA also did something like it. probably many others worldwide if you dig around
@azonenberg @nuintari @todb @iagox86 @charlvdwalt @pluralistic it was a very big thing on public WiFi hotspots. It would break a lot of websites cos the advertising code would just jam new HTML elements in, shitty JavaScript, conflicting versions with what the page authors used... It was a nightmare
Il Samsung Galaxy Z Flip FE potrebbe montare il chip Exynos 2400. Un benchmark svela dettagli sul SoC e la strategia per un pieghevole piรน accessibile.
The Romanian fascist candidate shared a post on his blog, where he addresses those who will not vote for him directly. He tells them that he will "deal with each one of them", individually, after he becomes president.
Robert Kiyosaki, author of Rich Dad Poor Dad, has renewed his warning against fiat currency, urging Americans to move away from what he calls โfake moneyโ and instead invest in Bitcoin (CRYPTO:BTC), gold, and silver.
โWelcome to the era of โhostage politicsโ, where Labour is apparently your only hope.โ
โThere is contempt here. Instead of changes to the tax system, and a commitment to thinking differently about an economic paradigm that has reached an undeniable dead end, Labour looks at the rising wave of populist politics and decides to tell voters that populism is the problem, not the world that created it.โ
First it was the Conservatives and now Reform. The only thing the government has to offer is that itโs the least worst option, says Guardian columnist Nesrine Malik
[repost Legalna Aborcja] Nie mamy wฤ tpliwoลci, ลผe napis na tym transparencie to prawda. @abotakprzychodnia powstaลa wลaลnie po to by pomagaฤ - bez wzglฤdu na powรณd, bez oceniania - po to by kaลผda osoba, ktรณra potrzebuje aborcji otrzymaลa wsparcie.
Powstaลa w tym miejscu, pod Sejmem, bo politycy i polityczki od lat udawali, ลผe aborcji nie ma zakลamujฤ c rzeczywistoลฤ. Antyaborcyjne prawo jakie mamy w Polsce skonstruowane jest tak, by osoby, ktรณre aborcje robiฤ zostawaลy z tym doลwiadczeniem same, wpฤdzane w poczucie wstydu, winy i strachu.
Ponad 130 osรณb dziennie robi aborcje tylko ze wsparciem #aborcjabezgranic, a 250-300 to liczba aborcji robionych w Polsce kaลผdego dnia. 1 na 3 kobiety w Polsce ma doลwiadczenie aborcji. (CBOS, Doลwiadczenia aborcyjne Polek)
Prawo antyaborcyjne po wyborach z 2023 roku miaลo siฤ zmieniฤ, a jest coraz gorzej. Organizacje, ktรณre kaลผdego dnia zapewniajฤ dostฤp do aborcji (wyrฤczajฤ c w tym paลstwo) nie otrzymujฤ ลผadnego wsparcia od rzฤ du. Stosunek osรณb u wลadzy do aborcji widaฤ wyraลบnie po tym co od dwรณch miesiฤcy dzieje siฤ pod @abotakprzychodnia - politycy i polityczki znรณw myลlฤ , ลผe jeลli odwrรณcฤ gลowฤ to aborcja zniknie.
A aborcja jest. Nie wystarczy zamknฤ ฤ oczu, by przestaลa byฤ potrzebna, odwrรณciฤ gลowy, by kobiety przestaลy jฤ robiฤ. Aborcja jest, bo jest potrzebna kobietom, aby czuลy siฤ bezpieczne, aby mogลy decydowaฤ o swoim ลผyciu i o ลผyciu swojej rodziny. Aborcja to doลwiadczenie wielu z nas, slogan wyborczy.
@abotakprzychodnia @aborcyjnydream dziฤkujemy, ลผe jesteลcie! Trudniej nam jest pomoc Wam na miejscu, na Wiejskiej, ale wspieramy kaลผdego dnia!
Im bardziej oni prรณbujฤ zakazaฤ aborcji, tym bardziej my wystawiamy jฤ do sลoลca. Dlatego idziemy o krok dalej i OTWIERAMY PIERWSZY W POLSCE STACJONARNY LOKAL! Zostaล jego ambasadorkฤ !
Myanmar's shadow government said an airstrike by the ruling junta had killed at least 17 students and injured 20 others at a school in an opposition-controlled area on Monday, despite a ceasefire being in place after a devastating earthquake.
The image shows a top-down view of a kitchen scene with various items arranged on a dark gray surface. In the center, there is a metal strainer with a white cloth placed over it, positioned on a glass bowl. A clear plastic bottle with a red ring near the neck is pouring a liquid onto the cloth. To the left, there is a halved lemon and a whole lemon, along with a small bowl of white granulated sugar. To the right, there are metal measuring spoons, a small bowl of white powder, and two corks. The background includes a white and black checkered cloth. The scene suggests a process involving straining a liquid, possibly related to making lemonade or another citrus-based beverage.
Provided by @altbot, generated privately and locally using Ovis2-8B
๐ข The #UK government is being taken to the High Court by Palestinian #humanrights group Al-Haq over its role in exporting F-35 fighter jet components used by Israel in #gaza
The UK government is being taken to the High Court by Palestinian human rights group Al-Haq over its role in exporting F-35 fighter jet components used by "Israel" in Gaza.
From Studio Ghibli-inspired illustrations to doll โstarter packs,โ an explosion of AI-generated images in recent weeks has sparked a fresh wave of concern among artists.
O lรญder da IL estรก disponรญvel para a governaรงรฃo se โfor para mudar Portugalโ, frisando que o partido vai exigir a liberalizaรงรฃo do mercado ferroviรกrio, baixar o IVA da construรงรฃo e o IRS.
Dal 15 al 19 maggio il #MIM sarร presente al Salone del Libro di Torino! Nello spazio espositivo del MIM, presso il padiglione Oval, saranno realizzate attivitร informative per i docenti, gli studenti e le famiglie con un programma di oltre 40 eventiโฆ
Dal 15 al 19 maggio il #MIM sarร presente al Salone del Libro di Torino!
Nello spazio espositivo del MIM, presso il padiglione Oval, saranno realizzate attivitร informative per i docenti, gli studenti e le famiglie con un programma di oltre 40 eventiโฆ
Il #Pkk depone le armi e annucia lo scioglimento mettendo fine alla #guerra con la #Turchia durata 40 anni. Resta da vedere quali effetti concreti potrร avere sul piano politico e sociale, sia per le comunitร curde in patria sia per il destino di Abdullah #Ocalan, ancora al centro di un dibattito acceso nel Paese.
โIntelligenza artificiale, intelligenza emotiva: futuro semplice o imperfetto?โ รจ il tema della conferenza in programma sabato 10 maggio 2025 alle ore 9.00 nellโaula magna di giurisprudenza a Palazzo Cavallini, via San Faustino 41 a Brescia. Relatori Francesco Morace, Cosimo Accoto, Arturo Di Corinto, Daniele Monteleone, Nicoletta Cusano Salvatore Frattallone. Moderatori Teresa Croce e Luigi Della Bora; introduzione a cura del prof. Maurizio Tira. Lโiniziativa รจ sotto lโegida di Lions, Leo, Fondazione Lions Clubs Distretto 108 Ib2 โBruno Bnร โ Ets, Comune di Brescia, Universitร degli Studi di Brescia e Fondazione UniBS.
Israel is using starvation as a weapon against #Palestinian #children and babies.
This little #Palestinian boy, Mohammed Abu Al-Hussain (4), is soon going to die of malnutrition and dehydration if he doesn't get the food and medical care he urgently needs.
๐๏ธ โ El 'talรณn de Aquiles' socialista: los mensajes de รbalos y Sรกnchez despiertan un nuevo revuelo polรญtico โ El diario El Mundo desvela conversaciones entre el presidente del Gobierno y รbalos una vez este fuese destituido. huffingtonpost.es/politica/el-โฆ
Hamas and the United States announced an agreement today that will lead to the freeing of Israeli soldier Edan Alexander, a dual American citizen, ahead of President Donald Trumpโs trip to the region.
Trump lashed out at bipartisan critics after reports revealed he plans to accept a $400 million Boeing 747-8 jet from Qatar for use as Air Force One.
In a Truth Social post, Trump dismissed concerns as โworld class losersโ complaining about a transparent gift. Qatar stated the plane is under legal review between its Ministry of Defense and the Pentagon.
Critics, including Sen. Bernie Sanders, Sen. Chris Murphy, and Rep. Jamie Raskin, accused Trump of corruption and violating the Constitution.
Even allies like Laura Loomer led the MAGA pushback to the jet deal.
Besides the obvious corruption, it's a national security issue. I'm not an aircraft designer, but I'm pretty sure there's quite a bit of electronics aboard that craft. Pretty easy to slip in a few listening devices.
Not to mention the refit to include all the secure communication equipment Air Force One has. Also ECM, active countermeasures, NBC equipment, refuelling, etc.
L'immagine presenta un'opera d'arte in stile linocut, caratterizzata da un forte contrasto tra il blu turchese e il bianco. Al centro dell'immagine, un grande pesce, probabilmente un balenoptera, รจ rappresentato in modo stilizzato. Il corpo del pesce รจ decorato con piccoli punti bianchi, che suggeriscono le scaglie, e presenta linee bianche che delineano le sue forme. Il pesce sembra muoversi attraverso un'acqua rappresentata da curve bianche che si estendono in tutte le direzioni, creando un senso di movimento e dinamismo. Lo sfondo รจ uniformemente blu turchese, che accentua la figura del pesce e le curve bianche. L'opera d'arte รจ composta in modo da guidare lo sguardo del viewer attraverso il movimento del pesce e delle onde, creando un'atmosfera vivace e fluida.
Fornito da @altbot, generato localmente e privatamente utilizzando Ovis2-8B
If you think billionaires should not be deciding our rights and freedoms? Sign now.
Using their vast fortunes, they weaken regulations meant to protect people and the planet, fund candidates who serve their interests, and gain control of the media tโฆ
Charl van der Walt ๐ป๐ต๐ธ
in reply to Marcus Hutchins • • •feld
in reply to Charl van der Walt ๐ป๐ต๐ธ • • •Charl van der Walt ๐ป๐ต๐ธ
in reply to Charl van der Walt ๐ป๐ต๐ธ • • •Thanks everyone for your comments on this. I like this excerpt from doesmysiteneedhttps.com:
"this discussion isn't about PKI. It's the best system we've got for right now. Deal with it and secure your site. Use CAA records to restrict which CAs can issue certificates for your site, then cross your fingers and hope transparency and oversight works (it does, so far)".
Do you all feel that there is enough integrity in browser trusted root certificate stores to still provide robust defence against the content / malware injection threat?
Also - have these kinds of injection attacks ceased now, and is SSL the reason for this?
Thanks!
feld
in reply to Charl van der Walt ๐ป๐ต๐ธ • • •> Do you all feel that there is enough integrity in browser trusted root certificate stores to still provide robust defence against the content / malware injection threat?
It's the best we can do with what we've got to work with. All we can hope is that the bad actors get caught from the Certificate Transparency Logs and are swiftly removed from all root certificate stores as their punishment.
Charl van der Walt ๐ป๐ต๐ธ
in reply to Charl van der Walt ๐ป๐ต๐ธ • • •@rysiek @simon_brooke @Gustodon @cigitalgem @paul @SpaceLifeForm @sabrinaweb71 @bruce @dascandy @leeloo @laird @nuintari @todb @iagox86 @TindrasGrove @tdp_org @http_error_418 @HodgesC @nuintari @lolennui @pluralistic @azonenberg @todb @iagox86 @HodgesC @truh @nuintari@bsd.cafe @dzwiedziu @freediverx @dascandy and others.
Thanks again to everyone who contributed to this thread. So this is what I'm hearing:
HTTPS still matters, even for static or non-interactive sites:
โข Mitigates content injection: Many ISPs and network operators have historically injected ads, tracking scripts, or even malware into unencrypted traffic. HTTPS prevents this by ensuring the integrity of the response between server and browser.
โข Defends against surveillance and manipulation: Examples of DNS hijacking, Gmail session spoofing, and targeted malware campaigns (e.g. FinFly), all made possible through unencrypted channels. HTTPS helps block these classes of attacks.
โข Removes network-level ambiguity: On public or hostile networks (e.g. hotel WiFi), HTTPS is the only realistic protection against on-path attackers modifying or observing content in transit.
โข Accessible and frictionless today: With Letโs Encrypt etc deployment is largely automated and cost-free for most use cases.
โข Normalizes secure transport: Widespread adoption means sensitive or at-risk traffic doesnโt stand out. Universal encryption helps everyone by minimizing soft targets.
On the other hand:
The CA model is a systemic weakness: Certificate Authorities remain a centralized point of failure. Trust is implicit and broad, and mechanisms like Certificate Transparency offer only partial mitigation.
โข Operational complexity remains an issue: Some tooling (e.g. Certbot) is complex and prescriptive, and certain practices (like root-required processes) can introduce risk or confusion for small deployments.
โข HTTPS doesnโt secure everything: It encrypts transport, but does not protect against compromised endpoints, malicious JavaScript, or bad site logic.
โข Trust shifts to browser vendors: Efforts like DNS-over-HTTPS, cert pinning, and HSTS move the locus of trust from networks to browsers โ trading one set of risks for another.
Advanced Persistent Teapot
in reply to Charl van der Walt ๐ป๐ต๐ธ • • •@charlvdwalt @rysiek @simon_brooke @Gustodon @cigitalgem @paul @SpaceLifeForm @sabrinaweb71 @bruce @dascandy @leeloo @laird @nuintari@infosec.exchange @todb @iagox86 @TindrasGrove @tdp_org @HodgesC @lolennui @truh @nuintari@bsd.cafe @dzwiedziu @freediverx
Yes to basically all of this, but I would suggest that trust in browsers over networks is demonstrably better, where those browsers' source code is available. With networks there are as many chances for something to be wrong as there are networks, and each network's problems are only visible and addressable by a small group. For browsers, anyone who can see the source can evaluate it, giving a much wider opportunity to spot misconfiguration and error, and it only needs correction in one place for everyone to receive the benefit.
Simon Brooke
in reply to Advanced Persistent Teapot • • •@http_error_418 @charlvdwalt @rysiek @Gustodon @cigitalgem @paul @SpaceLifeForm @sabrinaweb71 @bruce @dascandy @leeloo @laird @nuintari@infosec.exchange @todb @iagox86 @TindrasGrove @tdp_org @HodgesC @lolennui @truh @nuintari@bsd.cafe @dzwiedziu @freediverx
Agreed, **provided** the full source code of the browser is available **and is compact enough to be meaningfully audited**.
In my opinion, modern browsers are too heavyweight, seek to do too much, and this makes them hard to audit.
Marcus Hutchins
in reply to Charl van der Walt ๐ป๐ต๐ธ • • •Ron Bowes
in reply to Marcus Hutchins • • •Gabriele Svelto [moved]
in reply to Ron Bowes • • •Leeloo
in reply to Gabriele Svelto [moved] • • •The regimes most of us need to worry about all have their own CA or several they can get to do their bidding with some kind of "national security letter".
Marcus Hutchins
in reply to Ron Bowes • • •Navi
in reply to Charl van der Walt ๐ป๐ต๐ธ • • •Does my site need HTTPS?
CaddyDuลกan Mitroviฤ
in reply to Charl van der Walt ๐ป๐ต๐ธ • • •m_eiman
in reply to Duลกan Mitroviฤ • • •@dusnm On the minus side you have:
- adds dependency on CA
- requires one more thing to work, ie be kept updated, to request new certs regularly
- locks out old devices that don't support the crypto-flavor-of-the-month
- the above adds friction, which makes Cloudflare et al more attractive to not have to bother, leading to increased mono culture
slotos
in reply to m_eiman • • •m_eiman
in reply to slotos • • •@slotos @dusnm Fairly serious, I suppose ๐คทโโ๏ธ
These are actual issues and costs of forcing https everywhere. I suppose the benefits usually outweigh them, but that doesn't make them go away.
slotos
in reply to m_eiman • • •@mikaeleiman @dusnm
Encryption by default has removed a whole category of not just attacks, but scummy business practices. A little inconvenience to administrators is not even worth talking about.
Your comment reads exactly like a politician arguing for stripping worker protections or safety regulations because they inconvenience employers.
Itโs tone deaf, deliberately ignorant, and dismissive of people who get to not be taken advantage of easily due to these measures.
m_eiman
in reply to slotos • • •@slotos Feel free to feel that way.
In practice I've had more problems with broken https cert setups blocking me from pages that I've tried to access that I've had with ISP-injected ads. But I don't live in the US where that is/was legal, so YMMV I suppose.
And the fact that Letsencrypt and Cloudflare are used by such a large percentages of websites is a huge problem, IMHO. We need fewer single-points-of-failure, not more.
Epic Null
in reply to m_eiman • • •Jon A. Cruz
Unknown parent • • •@todb @iagox86 @charlvdwalt @pluralistic I remember phone interviewing with some company that was doing injections as part of "web acceleration". I did not follow up once i learned that aspect.
Also that was after working at AOL and learning their image compression was actually not bad... as long as you didn't dial all the settings down to their lowest values (as they did). So would have been sometime after 2004
Scott Laird
Unknown parent • • •reshared this
Giuseppe Aceto reshared this.
Andrew Zonenberg
Unknown parent • • •Ed Chivers
in reply to Andrew Zonenberg • • •@azonenberg @nuintari @todb @iagox86 @charlvdwalt @pluralistic BT did this here in the UK with a technology called "phorm". I remember there was a hell of a stink about it and they ditched it after a year or so. news.bbc.co.uk/1/hi/technologyโฆ
The irony that this page isn't HTTPS and I can't change it to HTTPS, and searches from the main website drop it down to HTTP as well isn't lost on me...
(I can only guess they have a different host for their older articles that doesn't support SSL).
BBC NEWS | Technology | BT advert trials were 'illegal'
news.bbc.co.ukamy tech (bones)
in reply to Andrew Zonenberg • • •JP
in reply to Andrew Zonenberg • • •Advanced Persistent Teapot
in reply to Andrew Zonenberg • • •