The problem with these calls for HTTPS is that those doing it believe http and https are mutually exclusive. They completly turn off human navigable webservers and leave only the machine navigable ones online. It makes the web only accessible to computer software written in the last 5 years.
There are plenty, I'd say most, websites which do not need HTTPS. And my static website does not need https. It's nice, sure, but it's a personal website and there's no money or personal information involved. Leaving an HTTP version going alongside the HTTPS and Tor hidden service is just fine.
The greater evil is having people run third party code by default on every website from every random domain that's called. Now that's insecure. It's like opening every email attachment you get. Every single "danger" of HTTP he lists is actually a danger of running third party code blindly and automatically.
There are plenty, I'd say most, websites which do not need HTTPS. And my static website does not need https. It's nice, sure, but it's a personal website and there's no money or personal information involved. Leaving an HTTP version going alongside the HTTPS and Tor hidden service is just fine.
The greater evil is having people run third party code by default on every website from every random domain that's called. Now that's insecure. It's like opening every email attachment you get. Every single "danger" of HTTP he lists is actually a danger of running third party code blindly and automatically.