Life Is About to Get Harder for Websites Without HTTPS
HTTPS is pain in the neck and _currently_ I hate it from the bottom of my heart.<p>TLTR: if you have a commercial service or device running in a local network forget HTTPS and service workers, use HTTP and HTML5 appcache.<p>-- RANT starts here --<p>It would be lovely when every website and webapp uses HTTPS. But for a significant amount of them it&#x27;s just not f..... possible without driving <i>users</i> completely insane.<p>If the HTTPS server doesn&#x27;t (and never will) have a public domain forget about encryption and security, forget about using service workers. The following examples can&#x27;t, by the love of god, ever provide HTTPS without completely f..cking up user experience due self signed certificates warnings:<p>1) internal corporation services, websites and webapps.<p>2) services that run in a local private network like on a Raspberry Pi.<p>3) webapps which are served via public HTTPS website, but need to talk via CORS to local unsecured services, like to a Philips hue bridge, or any other IoT device which is in the local network but only provides HTTP. These will enlight the users with a shiny mixed-content warning.<p>.... JUST use self-signed certificates, they said.<p>NO.<p>For normal users the UX of self-signed certificates is just non existent, it&#x27;s a complete mess! It will scare the sh&#x27;t out of users and will almost always look like your service is plain malware.<p>It <i>looks</i> much more secure to serve a good&#x27;ol HTTP site with no encryption at all.