Hacker News new | past | comments | ask | show | jobs | submit login

[flagged]



I get the optics aren't great.

But, if you check the source, this is a single HTML + CSS page with zero scripts or forms. Does it matter, technically?


Considering ISPs and Nation states have injected additional scripts into plain HTML payloads, it does matter, technically.


It really, really does.


How? I don't trust the site's author, so from a security standpoint there's nothing gained by distinguishing him from an impersonator.


Do you trust your ISP/Government/Router to not inject spyware/malware into the pages you visit?


That's literally what I just said. I don't trust the site's author any more than I trust an ISP/Government/Router.


I have no reason to trust this site's author any more than I would trust someone impersonating this site's author. What does https gain me?



No one should be linking to N-Gate about an issue like this, and it's embarrassing to see that this page was put up as recently as 2017.

It's just repeating "but I don't need it" over and over, while occasionally breaking off to make mind-bogglingly silly claims like "the security of the things I build are someone else's problem", and "we should just magically fix transport-layer bugs clientside."

And a few unsubstantiated jabs at LetsEncrypt for good measure, because pretending that everyone else is terrible at their job is a lot easier than paying even the slightest attention to what's been the general consensus of the entire Internet security community for over a decade.

I apologize for being a little more blunt and snippy about this than might be necessary, but seeing articles like these tick me off in a weird way (which I'm sure N-Gate would regard as a source of pride). It's a good reminder that people can make just about any poorly-thought-out unsubstantiated argument sound reasonable by just adding a lot of snark and then hoping that readers won't realize there's nothing logically coherent behind their "isn't everyone else except me stupid" hook.

I am sure that N-Gate does a lot of amazing work outside of their blog, and I'm sure that if I met them in person I would think they were very smart and charming -- but would it kill them to occasionally post anything on their site that isn't just a bunch of flippant contrarianism disguised as technical discussion?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: