That quote is the only thing you have to read of that article besides the headline.

The ironic observation about the page using an LE cert is fantastic; Browser mandates make the encryption discussion moot. If you don't use it, your argument literally won't load for a modern audience.

It speaks to the problem of digital decay. We can still pull up a plain HTTP site from 1995, but a TLS site from five years ago is now often broken or flagged as "insecure" due to aggressive deprecation cycles. The internet is becoming less resilient.

And this has real, painful operational consequences. For sysadmins, this is making iDRAC/iLO annoying again.

(for those who don't know what iDRAC/iLO are, it's the out-of-band management controller that let you access a server's console (KVM) even when the OS is toast. The shift from requiring crappy, insecure Java Web Start (JWS) to using HTML5 was a massive win for security and usability - old school sysadmins might remember keeping some crappy insecure browser around (maybe on a bastion host) to interact with these things because they wouldn't load on modern browsers after 6mo)

Now, the SSL/TLS push is undoing that. Since the firmware on these embedded controllers can't keep pace with Chrome's release schedule, the controllers' older, functional certificates are rejected. The practical outcome is that we are forced to maintain an old, insecure browser installation just to access critical server hardware again.

We traded one form of operational insecurity (Java's runtime) for another (maintaining a stale browser) all because a universal security policy fails to account for specialised, slow-to-update infrastructure... I can already hear the thundering herd approaching me: "BUT YOU NEED FIRMWARE UPDATES" or "YOU NEED TO DEPRECATE YOUR FIRMWARES IF NOT SUPPORTED".. completely tone-deaf to the environments, objectives and realities where these things operate.

>if you don't use it, your argument literally won't load for a modern audience

this is just a flat-out lie. yes, modern browsers will stilll load websites over http. come on.

Like all things, it's complicated.

Direct sites will load with a "Not Secure" warning, includes on the site might not load without chrome://settings/content/insecureContent

And of course: you won't manage to be visible to Google itself, as you'll be down-ranked for not having TLS.

If you happen to have a .dev domain: you're on the HSTS Preload list, so your site literally won't load.

> And of course: you won't manage to be visible to Google itself, as you'll be down-ranked for not having TLS.

You’ll be visible to Google (otherwise there would be nothing to downrank), you will just be less visible on Google.

And your ISP will be happy to show pop-up advertisements all over your HTTP website.

And you, the owner, will likely be to blame by the user.

What first world ISP does this?

It's not worth it to them precisely because the vast majority of web traffic is served over HTTPS. You can bet they would these days if most traffic was HTTP

Comcast.

If you can call them a first world ISP ;)

https://arstechnica.com/tech-policy/2014/09/why-comcasts-jav...

That was on free Xfnity Wifi. They got called out for it.

Yes. You got the answer to your question. You’re welcome ;)