davidbgk
/
larlet-fr-david

<!doctype html><!-- This is a valid HTML5 document. -->
<!-- Screen readers, SEO, extensions and so on. -->
<html lang=en>
<!-- Has to be within the first 1024 bytes, hence before the <title>
  See: https://www.w3.org/TR/2012/CR-html5-20121217/document-metadata.html#charset -->
<meta charset=utf-8>
<!-- Why no `X-UA-Compatible` meta: https://stackoverflow.com/a/6771584 -->
<!-- The viewport meta is quite crowded and we are responsible for that.
  See: https://codepen.io/tigt/post/meta-viewport-for-2015 -->
<meta name=viewport content="width=device-width,minimum-scale=1,initial-scale=1,shrink-to-fit=no">
<!-- Required to make a valid HTML5 document. -->
<title>HTTPS considered harmful — David Larlet</title>
<!-- Generated from https://realfavicongenerator.net/ such a mess. -->
<link rel="apple-touch-icon" sizes="180x180" href="/static/david/icons/apple-touch-icon.png">
<link rel="icon" type="image/png" sizes="32x32" href="/static/david/icons/favicon-32x32.png">
<link rel="icon" type="image/png" sizes="16x16" href="/static/david/icons/favicon-16x16.png">
<link rel="manifest" href="/manifest.json">
<link rel="mask-icon" href="/static/david/icons/safari-pinned-tab.svg" color="#5bbad5">
<link rel="shortcut icon" href="/static/david/icons/favicon.ico">
<meta name="apple-mobile-web-app-title" content="David Larlet">
<meta name="application-name" content="David Larlet">
<meta name="msapplication-TileColor" content="#da532c">
<meta name="msapplication-config" content="/static/david/icons/browserconfig.xml">
<meta name="theme-color" content="#f0f0ea">
<!-- That good ol' feed, subscribe :p. -->
<link rel=alternate type="application/atom+xml" title=Feed href="/david/log/">

  <!-- Canonical URL for SEO purposes -->
  <link rel="canonical" href="https://larlet.fr/david/stream/2018/01/06/">

<style>
/* http://meyerweb.com/eric/tools/css/reset/ */
html, body, div, span,
h1, h2, h3, h4, h5, h6, p, blockquote, pre,
a, abbr, address, big, cite, code,
del, dfn, em, img, ins,
small, strike, strong, tt, var,
dl, dt, dd, ol, ul, li,
fieldset, form, label, legend,
table, caption, tbody, tfoot, thead, tr, th, td,
article, aside, canvas, details, embed,
figure, figcaption, footer, header, hgroup,
menu, nav, output, ruby, section, summary,
time, mark, audio, video {
  margin: 0;
  padding: 0;
  border: 0;
  font-size: 100%;
  font: inherit;
  vertical-align: baseline;
}
/* HTML5 display-role reset for older browsers */
article, aside, details, figcaption, figure,
footer, header, hgroup, menu, nav, section { display: block; }
body { line-height: 1; }
blockquote, q { quotes: none; }
blockquote:before, blockquote:after,
q:before, q:after {
  content: '';
  content: none;
}
table {
  border-collapse: collapse;
  border-spacing: 0;
}

/* http://practicaltypography.com/equity.html */
/* https://calendar.perfplanet.com/2016/no-font-face-bulletproof-syntax/ */
/* https://www.filamentgroup.com/lab/js-web-fonts.html */
@font-face {
  font-family: 'EquityTextB';
  src: url('/static/david/css/fonts/Equity-Text-B-Regular-webfont.woff2') format('woff2'),
       url('/static/david/css/fonts/Equity-Text-B-Regular-webfont.woff') format('woff');
  font-weight: 300;
  font-style: normal;
  font-display: swap;
}
@font-face {
  font-family: 'EquityTextB';
  src: url('/static/david/css/fonts/Equity-Text-B-Italic-webfont.woff2') format('woff2'),
       url('/static/david/css/fonts/Equity-Text-B-Italic-webfont.woff') format('woff');
  font-weight: 300;
  font-style: italic;
  font-display: swap;
}
@font-face {
  font-family: 'EquityTextB';
  src: url('/static/david/css/fonts/Equity-Text-B-Bold-webfont.woff2') format('woff2'),
       url('/static/david/css/fonts/Equity-Text-B-Bold-webfont.woff') format('woff');
  font-weight: 700;
  font-style: normal;
  font-display: swap;
}
@font-face {
  font-family: 'TriplicateT4c';
  src: url('/static/david/css/fonts/Triplicate-T4-Code-Regular-webfont.woff2') format('woff2'),
       url('/static/david/css/fonts/Triplicate-T4-Code-Regular-webfont.woff') format('woff');
  font-weight: 300;
  font-style: normal;
  font-display: swap;
}

/* http://practice.typekit.com/lesson/caring-about-opentype-features/ */
body {
  /* http://www.cssfontstack.com/ Palatino 99% Win 86% Mac */
  font-family: "EquityTextB", Palatino, serif;
  background-color: #f0f0ea;
  color: #07486c;
  font-kerning: normal;
  -moz-osx-font-smoothing: grayscale;
  -webkit-font-smoothing: subpixel-antialiased;
  text-rendering: optimizeLegibility;
  font-variant-ligatures: common-ligatures contextual;
  font-feature-settings: "kern", "liga", "clig", "calt";
}
pre, code, kbd, samp, var, tt {
  font-family: 'TriplicateT4c', monospace;
}
em {
  font-style: italic;
  color: #323a45;
}
strong {
  font-weight: bold;
  color: black;
}
nav {
  background-color: #323a45;
  color: #f0f0ea;
  display: flex;
  justify-content: space-around;
  padding: 1rem .5rem;
}
  nav:first-child {
    border-top: 1vh solid #2d7474;
  }
  nav:last-child {
    border-bottom: 1vh solid #2d7474;
  }
  nav a {
    color: #f0f0ea;
  }
  nav abbr {
    border-bottom: 1px dotted white;
  }

h1 {
  border-bottom: .2vh solid #2d7474;
  background-color: #e3e1e1;
  color: #323a45;
  text-align: center;
  padding: 2rem 0 1rem;
  width: 100%;
}
h2 {
  margin: 4rem 0 1rem;
  border-top: .2vh solid #2d7474;
}
h3 {
  text-align: center;
  margin: 3rem 0 .75em;
}
hr {
  height: .4rem;
  width: .4rem;
  border-radius: .4rem;
  background: #07486c;
  margin: 2.5rem auto;
}
time {
  display: bloc;
  background-color: #2d7474;
  color: #e3e1e1;
  padding: .29rem 1rem;
  float: right;
}
ul, ol {
  margin: 2rem;
}
ul {
  list-style-type: square;
}
a {
  text-decoration-skip-ink: auto;
}
article {
  max-width: 50rem;
  display: flex;
  flex-direction: column;
  margin: 3rem auto 1rem auto;
}
  article p:last-child {
    margin-bottom: 1rem;
  }
p {
  padding: 0 .5rem;
}
  p + p {
    margin-top: 2rem;
  }

blockquote {
  background-color: #e3e1e1;
  border-left: .5vw solid #2d7474;
  display: flex;
  flex-direction: column;
  align-items: center;
  padding: 1rem;
  margin: 1.5rem;
}
  blockquote cite {
    font-style: italic;
  }

figure {
  border-top: .2vh solid #2d7474;
  background-color: #e3e1e1;
  text-align: center;
  padding: 1.5rem 0;
  margin: 1rem 0 0;
  font-size: 1.5rem;
  width: 100%;
}
  figure img {
    width: 250px;
    height: 250px;
    border: .5vw solid #323a45;
    padding: 1px;
  }
figcaption {
  padding: 1rem;
  line-height: 1.4;
}
aside {
  display: flex;
  flex-direction: column;
  background-color: #e3e1e1;
  padding: 1rem 0;
  border-bottom: .2vh solid #07486c;
}
  aside p {
    max-width: 50rem;
    margin: 0 auto;
  }

/* https://fvsch.com/code/css-locks/ */
p, li, pre, code, kbd, samp, var, tt, time {
  font-size: .95rem;
  line-height: calc( 1.5em + 0.2 * 1rem );
}
h1 {
  font-size: 1.7rem;
  line-height: calc( 1.2em + 0.2 * 1rem );
}
h2 {
  font-size: 1.6rem;
  line-height: calc( 1.3em + 0.2 * 1rem );
}
h3 {
  font-size: 1.35rem;
  line-height: calc( 1.4em + 0.2 * 1rem );
}
@media (min-width: 20em) {
  /* The (100vw - 20rem) / (50 - 20) part
     resolves to 0-1rem, depending on the
     viewport width (between 20em and 50em). */
  p, li, pre, code, kbd, samp, var, tt, time {
    font-size: calc( .95rem + .6 * (100vw - 20rem) / (50 - 20) );
    line-height: calc( 1.5em + 0.2 * (100vw - 50rem) / (20 - 50) );
  }
  h1 {
    font-size: calc( 1.7rem + 1.5 * (100vw - 20rem) / (50 - 20) );
    line-height: calc( 1.2em + 0.2 * (100vw - 50rem) / (20 - 50) );
  }
  h2 {
    font-size: calc( 1.5rem + 1.5 * (100vw - 20rem) / (50 - 20) );
    line-height: calc( 1.3em + 0.2 * (100vw - 50rem) / (20 - 50) );
  }
  h3 {
    font-size: calc( 1.35rem + 1.5 * (100vw - 20rem) / (50 - 20) );
    line-height: calc( 1.4em + 0.2 * (100vw - 50rem) / (20 - 50) );
  }
}
@media (min-width: 50em) {
  /* The right part of the addition *must* be a
     rem value. In this example we *could* change
     the whole declaration to font-size:2.5rem,
     but if our baseline value was not expressed
     in rem we would have to use calc. */
  p, li, pre, code, kbd, samp, var, tt, time {
    font-size: calc( .95rem + .6 * 1rem );
    line-height: 1.5em;
  }
  h1 {
    font-size: calc( 1.7rem + 1.5 * 1rem );
    line-height: 1.2em;
  }
  h2 {
    font-size: calc( 1.5rem + 1.5 * 1rem );
    line-height: 1.3em;
  }
  h3 {
    font-size: calc( 1.35rem + 1.5 * 1rem );
    line-height: 1.4em;
  }
  figure img {
    width: 500px;
    height: 500px;
  }
  blockquote {
    margin-left: -1.5rem;
  }
}

figure.unsquared {
  margin-bottom: 1.5rem;
}
  figure.unsquared img {
    height: inherit;
  }

/* https://github.com/richleland/pygments-css */
.codehilite{
    background-color: #fdf6e3;
    margin: 1rem auto;
    padding: 1rem;
    overflow-x:auto;
    box-shadow:inset 0 0 2px rgba(0,0,0,0.2)
}
.codehilite .t{color:#586e75}
.codehilite .w{color:#073642}
.codehilite .err{color:#cb4b16}
.codehilite .k{color:#859900}
.codehilite .kc{color:#2aa198}
.codehilite .kd{color:#268bd2}
.codehilite .kn{color:#b58900}
.codehilite .kp{color:#859900}
.codehilite .kr{color:#073642}
.codehilite .kt{color:#b58900}
.codehilite .n{color:#586e75}
.codehilite .na{color:#2aa198}
.codehilite .nb{color:#268bd2}
.codehilite .nc{color:#268bd2}
.codehilite .ne{color:#cb4b16}
.codehilite .no{color:#2aa198}
.codehilite .nd{color:#2aa198}
.codehilite .ni{color:#2aa198;font-weight:bold}
.codehilite .nf{color:#268bd2}
.codehilite .nn{color:#586e75}
.codehilite .nt{color:#2aa198;font-weight:bold}
.codehilite .nv{color:#cb4b16}
.codehilite .b{color:#859900}
.codehilite .bp{color:#586e75}
.codehilite .v{color:#586e75}
.codehilite .vc{color:#586e75}
.codehilite .vg{color:#268bd2}
.codehilite .vi{color:#268bd2}
.codehilite .m{color:#268bd2}
.codehilite .mf{color:#268bd2}
.codehilite .mh{color:#268bd2}
.codehilite .mi{color:#268bd2}
.codehilite .mo{color:#268bd2}
.codehilite .s{color:#2aa198}
.codehilite .sb{color:#2aa198}
.codehilite .sc{color:#2aa198}
.codehilite .sd{color:#2aa198}
.codehilite .s2{color:#2aa198}
.codehilite .se{color:#cb4b16}
.codehilite .sh{color:#2aa198}
.codehilite .si{color:#cb4b16}
.codehilite .sx{color:#2aa198}
.codehilite .sr{color:#cb4b16}
.codehilite .s1{color:#2aa198}
.codehilite .ss{color:#cb4b16}
.codehilite .il{color:#268bd2}
.codehilite .o{color:#586e75}
.codehilite .ow{color:#859900}
.codehilite .p{color:#586e75}
.codehilite .c{color:#93a1a1;font-style:italic}
.codehilite .cm{color:#93a1a1}
.codehilite .cp{color:#93a1a1}
.codehilite .c1{color:#93a1a1}
.codehilite .cs{color:#93a1a1}
.codehilite .hll{background-color:#dc322f}
.codehilite .g{color:#586e75}
.codehilite .gd{color:#586e75}
.codehilite .ge{font-style:italic}
.codehilite .gr{color:#586e75}
.codehilite .gh{color:#586e75;font-weight:bold}
.codehilite .gi{color:#586e75}
.codehilite .go{color:#586e75}
.codehilite .gp{color:#586e75}
.codehilite .gs{font-weight:bold}
.codehilite .gu{color:#586e75;font-weight:bold}
.codehilite .gt{color:#586e75}

@media print {
  body { font-size: 100%; }
  a:after { content: " (" attr(href) ")"; }
  a, a:link, a:visited, a:after {
    text-decoration: underline;
    text-shadow: none !important;
    background-image: none !important;
    background: white;
    color: black;
  }
  abbr[title] { border-bottom: 0; }
  abbr[title]:after { content: " (" attr(title) ")"; }
  img { page-break-inside: avoid; }
  @page { margin: 2cm .5cm; }
  h1, h2, h3 { page-break-after: avoid; }
  p3 { orphans: 3; widows: 3; }
  img {
    max-width: 250px !important;
    max-height: 250px !important;
  }
  nav, aside { display: none; }
}

/* Dark theme */
[lang=en] body {
  background: #323a45;
}
  [lang=en] article,
  [lang=en] article em,
  [lang=en] article strong {
    color: #f0f0ea;
  }
    [lang=en] article a {
      color: #ffbd2b;
    }
    [lang=en] article a:visited {
      color: #ff6b03;
    }
  [lang=en] blockquote,
  [lang=en] figure {
    background: #111930;
    color: #ccc;
  }
</style>
<nav>
  <p>
    <a href="/david/" title="Profil public">David&nbsp;Larlet</a> partage ses <a href="/david/blog/" title="Expériences bienveillantes">réflexions</a> et sa <a href="/david/stream/2019/" title="Pensées (dés)articulées">veille hebdomadaire</a>.
  </p>
</nav>

<h1>HTTPS considered harmful</h1>
<time>2018-01-06</time>
<article>
  <blockquote>
<p>If a website is served over HTTPS, this should be a good list of features to try out and improve end-user performance. Many major websites have already leveraged these technologies and have seen great results. Based on your existing infrastructure, the level of complexity for implementing each of these features may vary. But the general awareness is more important and will help us plan accordingly for the future. </p>
<p>At eBay, we are very excited about the possibilities that HTTPS has opened up. With the adoption of modern technologies that come with HTTPS, our web platform is now ready to build the next wave of compelling user experiences. Cheers to a secure and innovative future.</p>
<p><cite><em><a href="https://www.ebayinc.com/stories/blogs/tech/beyond-https/">Beyond HTTPS</a></em> (<a href="/david/cache/409a6c299f7b4995c69f018c4c905792/">cache</a>)</cite></p>
</blockquote>
<p>I strongly disagree <em>today</em>, it wasn’t the case <a href="/david/thoughts/#ssl">six years ago</a>. Vincent reminded me a few months ago about the inherent fragility of HTTPS and how centralized that system is. Nothing new but sometimes you need a little discussion to realize how critical it actually is.</p>
<p>Encouraging everybody to switch to HTTPS promotes strong dependency to a third-party mafia, increases load time, makes your content inaccessible if you have any trouble reconducting your certificate, avoids migrating easily from one hosting platform to another, forces upgrading on a lot more security issues if you are hosting yourself. Even worse, when you switch there is no harmless turning back! <strong>That’s not the Web I’m aiming for.</strong></p>
<p>“Sharing is learning” was <a href="/david/thoughts/#https">my conclusion at that moment</a>. Please prove me wrong.</p>
<p><em>PS: I always dreamt about publishing a note “X considered harmful”, achievement unlocked!</em></p>
<p><strong>Edit:</strong> see <a href="/david/stream/2018/01/10/">the follow up</a>.</p>
</article>


<nav>
  <p>
    <a rel=prev href="/david/stream/2018/01/05/">← Robust JavaScript</a> | <a href="/david/stream/2018/" title="Retour à la liste complète">↑</a> | <a  rel=next href="/david/stream/2018/01/07/">Censurer l’alternative →</a>
  </p>
</nav>


<aside>
  <p>
    Other articles in English:
  
    <a href="/david/blog/2018/caching-links/">On caching links</a>,
  
    <a href="/david/blog/2018/bushcraft-retrospective/">Bushcraft retrospective</a>,
  
    <a href="/david/blog/2018/into-the-raft/">Into the Raft</a>,
  
    <a href="/david/blog/2018/into-the-bugs/">Into the Bugs</a>,
  
    <a href="/david/blog/2018/meritocracy-crisis/">Meritocracy crisis</a>,
  
    <a href="/david/blog/2018/seller-teacher-wise/">The Seller, the Teacher and the Wise</a>,
  
    <a href="/david/blog/2018/into-the-good/">Into the Good</a>,
  
    <a href="/david/blog/2018/into-the-mice/">Into the Mice</a>,
  
    <a href="/david/blog/2018/into-the-camp/">Into the Camp</a>,
  
    <a href="/david/blog/2018/into-the-wind/">Into the Wind</a>,
  
    <a href="/david/blog/2018/into-the-snow/">Into the Snow</a>,
  
    <a href="/david/blog/2018/into-the-cold/">Into the Cold</a>,
  
    <a href="/david/blog/2017/async-python-frameworks/">Async Python Frameworks</a>,
  
    <a href="/david/blog/2017/distributed-teams/">Distributed teams</a>,
  
    <a href="/david/blog/2017/into-the-wild/">Into the Wild</a>,
  
    <a href="/david/blog/2017/without-javascript/">Without JavaScript</a>,
  
    <a href="/david/blog/2017/inclusive-python/">Inclusive Python</a>,
  
    <a href="/david/blog/2017/micro-cultures-governance/">Micro-cultures and governance</a>,
  
    <a href="/david/blog/2017/resilient-web-tools/">Resilient Web and Tools</a>,
  
    <a href="/david/blog/2017/bitcoin-energy/">Bitcoin and energy</a>,
  
    <a href="/david/blog/2016/team-building/">Team building</a>,
  
    <a href="/david/blog/2016/inclusive-developer/">Inclusive developer</a>,
  
    <a href="/david/blog/2016/cultural-intimacy/">Cultural Intimacy</a>,
  
    <a href="/david/blog/2016/tools-teams/">Tools and teams</a>,
  
    <a href="/david/blog/2016/senior-developer/">Senior developer</a>,
  
    <a href="/david/blog/2016/slow-data/">Slow Data</a>,
  
    <a href="/david/blog/2016/inclusive-communities/">Inclusive communities</a>,
  
    <a href="/david/blog/2016/delivery-values/">Delivery and value(s)</a>,
  
    <a href="/david/blog/2016/collaboration-debt/">Collaboration debt</a>,
  
    <a href="/david/blog/2016/communities-leadership/">Communities and leadership</a>,
  
    <a href="/david/blog/2016/specifications-apis/">Specifications and APIs</a>.
  
    Oh, and most of <a href="/david/stream/2018/">the 2018 thoughts</a>.
  </p>
</aside>


<nav>
  <p>
    <abbr title="Lieu de vie et de potentielles rencontres actuel">Montréal</abbr> ·
    <a href="mailto:david%40larlet.fr" title="Envoyer un courriel">Contact</a> ·
    <a href="http://larlet.com" title="Identité professionnelle">[Travailler ensemble ?]</a> ·
    <abbr title="Alwaysdata, 62 rue Tiquetonne 75002 Paris, +33.184162340">Hébergeur</abbr> ·
    <a href="/david/log/" title="S’abonner aux publications via RSS">Flux</a>
  </p>
</nav>

  <script>
  /* Service workers */
  if (navigator.serviceWorker) {
    window.addEventListener('load', function () {
      var selector = 'a[href^="/david/cache/"], a[rel=prev], a[rel=next]'
      function sendLinks (selector) {
        var links = [].slice.call(document.querySelectorAll(selector)).map(function (link) {
          return link.getAttribute('href')
        })
        links.push(location.pathname)  // Put the current page in cache too.
        navigator.serviceWorker.controller.postMessage({ links: links })
      }
      navigator.serviceWorker.getRegistration()
        .then(function (registration) {
          if (!registration || !navigator.serviceWorker.controller) {
            return navigator.serviceWorker.register('/serviceworker.js')
              .then(navigator.serviceWorker.ready)
              .then(function () {
                console.log('[ServiceWorker] Ready to go!')
              })
              .catch(console.error.bind(console))
          } else {
            console.log('[ServiceWorker] Send links via registration')
            sendLinks(selector)
          }
        })
      navigator.serviceWorker.addEventListener('controllerchange', function () {
        console.log('[ServiceWorker] Send links via controller change')
        sendLinks(selector)
      })
      navigator.serviceWorker.addEventListener('message', function (event) {
        var link = document.querySelector('a[href="' + event.data.link + '"]')
        if (event.data.status && link) {
          link.style.backgroundColor = '#2d7474'
          link.style.color = '#f0f0ea'
          
            link.setAttribute('title', 'Put in cache for offline use')
          
        }
      })
    })
  } else {
    console.warn('[ServiceWorker] No cache for old browsers.')
  }
</script>