🌟 hikari of the valley of the wind ✅

There's an especially insidious wrinkle to this in web APIs. Many newer web APIs can only be used for documents served via a "secure context", which means served via HTTPS. Even for completely static single-file applications that never so much as make a single network request. Despite the claims on that MDN page, some browsers don't even allow these features to be used on documents opened from a local filesystem, and you can expect this to get locked down tighter over time.

Web-Decker will probably never be able to prompt the user to take a webcam photo, or access gamepads on firefox, or save a file in-place, because in addition to quite reasonable affirmative-consent-gating dialog boxes, there is this bullshit HTTPS constraint.

Secure Contexts are a very deliberate choice to ratchet applications toward HTTPS, and HTTPS is in turn a ratchet to kill old software.

i think part of the motivation for this is that lots of new web platform features are too dangerous to allow over regular http. so instead of leaving dangerous features out of the platform we just make sure everyone has to go https or go fuck themselves

Yeah, a friend once gave me the suggestion to configure my own site to only allow HTTPS for security, which felt silly when I don't even expect it to get enough attention to be targeted by an attacker, and would go against the whole point of the site which was to have it be fully viewable under Internet Explorer 6

I still have HTTPS of course, and anyone who's serious about security will set their browser to HTTPS-by-default anyway, but there's no point taking the option of unencrypted HTTP away from my site and breaking that backwards compatibility just to provide an entirely hypothetical level of security for a small handful of people who choose to view it this way on a modern browser

Fucking seriously.

you are correct, and i will endevour to not require https in my projects when i don't have to

I feel this in my bones. There have been so many legacy devices in environments that I worked in required me to maintain a laptop or vm or something with an ancient browser version because modern browsers just flat out refuse to connect to them.

I am purposeful about allowing people to access my site via both http and https, and only forcing https wherever auth is concerned. Because there's a lot of shit that breaks when only https is allowed, such as transparent caching proxies (which are important in areas with poor bandwidth/access).

I used to have it such that my site would serve up entirely different sites on http vs. https, and when I worked at a search index company a few years ago I made a point to bring that up whenever anyone was assuming that http and https URLs are equivalent (our index didn't even track the scheme of URLs! it was maddening!) and like, yeah, it's an edge case, but edge cases are what make things break.

once I was using a 10 years old laptop and the rtc battery died, leaving it to a date if 1/1/2000. My browser freaked out when I tried to access google because the certificate was far into the future. It already used https pinning so I couldn't use http. I had a lot of trouble searching how to adjust the clock on linux that day.

what we have set up on ahti.space, sortix.org, etc is to redirect to HTTPS if your browser sends the Upgrade-Insecure-Requests header (sent by default on modern browsers) but still allow access over HTTP otherwise

I don't understand why that's not more common – it doesn't introduce any new attacks for modern browsers (if you are in the position to strip off the Upgrade-Insecure-Requests, you are in the position to just proxy the entire request), still automatically upgrades the connection to HTTPS for modern browsers that default to plaintext HTTP when you don't include the protocol, and allows me to access it on any random retrocomputer I have. I guess once TLS 1.4 starts becoming required we might need to rethink the setup to allow TLS 1.2 / 1.3 only systems that send the header to connect, but that it not a lot of maintenance burden at all

Google is shit.
I remember reading an article about problems caused by them lobbying to require https everywhere (around time that HTTP2 / SPDY etc. was being pushed and before i first heard of Let's Encrypt as a tool) especially in third world countries. Missionaries in schools on far end of the globe with access to the Internet only via satellite had extra trouble getting materials (even as basic as opening some wikipedia page) due to extra packets going through high error-rate connection. They had some caching put up in place so they could revisit previously opened pages without dealing with their satnet limitations, but it only worked for non-secure http.

And now i tried to look for that article again. Of course google's search focused on the fact i want to learn about satnet, or missionaries, or socio-economic problems in Africa, completely ignoring that i put HTTPS there as the first word in my damn query.
It effectively buried the thing under its "i know better what you'd want to read, buddy".

how do this to web site

I remember an article someone wrote about google's push to require https everywhere and how that would cut off huge swathes of the old pre-1998 internet that were still happily being hosted on the same technologies they'd always been and would not be inaccessible because instead of being basically free to host they'd now need to pay however much each year for a cert that has to be renewed. and how this was part of their strategy to kill off the open internet.