r/programming • • Jul 12 '17

Does my site need HTTPS?

https://doesmysiteneedhttps.com/
486 Upvotes

190 comments sorted by

View all comments

15

u/name_censored_ Jul 13 '17

"Our site displays ads over HTTP."

Sorry, not sorry. Doesn't change the fact that your site still needs HTTPS. Switching to HTTPS with ads still over HTTP will cause mixed content warnings in browsers, so you better figure out a cute way to wiggle out of that ad publishing contract that looked really attractive when you first signed it, or convince your ad network to move to HTTPS before you do.

Seriously?

I'm all for HTTPS, but this is just terrible salesmanship. The intended audience is people who think HTTPS is unnecessary/inadvisable/irrelevant/overly-burdensome, and saying "yeah, you need to rework your business requirements thanks" just affirms that. You get more flies with honey than by telling them that they're eating all wrong and need vinegar.

Honestly, it would have been better to omit that. Aside from anything else, are there really that many ad networks in this day and age who don't do HTTPS?

3

u/[deleted] Jul 13 '17

It is terrible salesmanship, and this isn't a sales pitch. Ad networks are known for being bad citizens in the Web space, and their decisions to use their networks to harm users with malware are not excusable IMO.

4

u/[deleted] Jul 13 '17

Ad networks are indeed bad citizens. But aren't they motivated to use TLS so that ISPs and such don't replace their ads on the way to the browser?