> (valid I think even if I’ve never encountered it to my knowledge)

Visitors to your website may encounter it. Do you not care that your visitors may be seeing ads?

You're also leaking what your visitors are reading to their ISPs and governments. Maybe you don't consider anything you write about to be remotely sensitive, but how critically do you examine that with every new piece you write?

If you wrote something which could be sensitive to readers in some parts of the world (something about circumventing censorship, something critical of some religion, something involving abortion or other forms of healthcare that some governments are cracking down on), do you then add SSL at that point? Or do you refrain from publishing it?

Personally, I like the freedom to just not think about these things. I can write about whatever I want, however controversial it might be in some regions, no matter how dangerous it is for some people to be found reading about it, and be confident that my readers can expect at least a baseline of safety because my blog, like pretty much every other in the world today, uses cryptography to ensure that governments and ISPs can't use deep packet inspection to scan the words they read or use MITM to inject things into my blog. Does it really matter? Well probably not for my site specifically, but across all the blogs and websites in the world and all the visitors in the world, that's a whole lot of "probably not"s which all combine together into a huge "almost definitely".

The reason is to prevent your site from becoming a watering hole where malicious actors use it to inject malware into the browsers of your users.

TLS isn't for you, it's for your readers.

relevant blog post and HN discussion: https://news.ycombinator.com/item?id=22146291

> You're not handling sensitive data, so unencrypted is just fine.

Except when an adversary MITMs your site and injects an attack to one of your readers:

* https://www.infoworld.com/article/2188091/uk-spy-agency-uses...

Further: tapping glass is a thing, and if the only traffic that is encrypted is the "important" or "sensitive" stuff, then it sticks out in the flow, and so attackers know to focus just on that. If all traffic is encrypted, then it's much harder for attackers to figure out what is important and what is not.

So by encrypting your "unimportant" data you add more noise that has to be sifted through.

> Why? The days of MITM boxes injecting content into HTTP traffic are basically over

The reason you don't see many MITM boxes injecting content into HTTP anymore is because of widespread HTTPS adoption and browsers taking steps to distrust HTTP, making MITM injection a near-useless tactic.

(This rhymes with the observation that some people now perceive Y2K as overhyped fear-mongering that amounted to nothing, without understanding that immense work happened behind the scenes to avert problems.)

You see no reason for privacy, ok

[flagged]