kurtseifried (he/him) on Nostr: Should you redirect HTTP to HTTPS for a website? What about for APIs? Josh Bressers ...

Should you redirect HTTP to HTTPS for a website? What about for APIs? Josh Bressers (npub16g6…s9jn) and kurtseifried (he/him) (npub1063…eaeu) thought this was a reasonably simple question and... well... as usual it turns out to be quite complicated and nuanced. Find out on the #osspodcast at http://opensourcesecurity.io/2024/06/02/episode-431-redirecting-http-to-https/ TL;DR: we should really make HTTPS the default, not HTTP for new stuff. I'm also still not sure how I feel about the cult of backwards compatibility (especially in light of the RJ tab toots).