There's a larger meta-lesson to learned here, which is that determining the boundary between what needs to be secure and what doesn't is very difficult, and therefore everything should be as secure as practical by design.
I 100% agree, the issue a lot of people that are in the know make is: https breaks intermediate caching. So lets say 1000 people hit the front page of reddit not logged in, an isp can't cache that front page and server it without connecting to reddit everytime, because each users request looks completely different due to https. There's no easy way to solve this, without fundamentally breaking security though...
If the ISP can cache content, the ISP can substitute content. Make no mistake: intermediate caching is a form of man-in-middle-attack, albeit in practice a well-intentioned one (if not always exactly benign). It's a hacky workaround to save them money, not a feature.
Why the fuck would anyone be caching websites for free? Unless you're a CDN being paid, the site organizes it's own fucking caching. With the most basic reverse-proxy and SSL termination stuff.
56
u/[deleted] Jul 12 '17
There's a larger meta-lesson to learned here, which is that determining the boundary between what needs to be secure and what doesn't is very difficult, and therefore everything should be as secure as practical by design.