This sounds like a tempest-teapot scenario because he doesnt seem to know about http&#x2F;2 which includes the feature TBL is ranting about.  Instead, he comes off as fingerwagging at folks for doing something to stop-gap fix the web because the http RFC didnt include security from the beginning.  Adding tls to http&#x2F;1.x is impractical, utopian mythology because there&#x27;s too much deployed to ever change until http&#x2F;2 becomes widely deployed.<p>Instead of ranting, downplaying the EFF and others for improving the situation or wishing for the impossible, TBL missed the opportunity to support adoption of http&#x2F;2, which might not be perfect (PHK mentioned rushed process and protocol complexity) but it has been touted to supersede  http&#x2F;1, https and spdy.<p>btw: there&#x27;s also unauthenticated opportunistic encryption like tcpcrypt which works via server and client plugins.<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;HTTP&#x2F;2#Encryption" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;HTTP&#x2F;2#Encryption</a><p><a href="https:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;rfc7540" rel="nofollow">https:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;rfc7540</a>