I.e. just consider that currently a hosting provider has no option to unconditionally encrypt pages they host for modern browsers as that may break pages of the users. With encrypted http:// they get such option delegating the job of fixing warnings about insecure context to the content producers as it should. On 14 December 2014 at 19:48, Igor Bukanov <igor@mir2.org> wrote: > > On 14 December 2014 at 19:40, Chris Palmer <palmer@google.com> wrote: > >> >> But, again, consider the definition of the origin. If it is possible for >> securely-transported code to run in the same context as non-securely >> transported code, the securely-transported code is effectively non-secure. >> > > Yes, but the point is that the page will be shown with the same warnings > as a plain http page rather then showing a broken page. >
Received on Monday, 15 December 2014 08:56:36 UTC