Without HSTS preload anyone on your local network can arp/dns spoof your traffic, MITM you, and automatically inject malicious javascript (cryptominers, credential-stealers, etc.), access all of the page content, and manipulate the page or response.

If you are connecting to a "Free Public WiFi" and the malicious actor is the one broadcasting the access-point; it's even easier to MITM you.

Without Cert & Key Pinning your employee laptop can be MITM by corporate to eavesdrop on all of your HTTPS traffic. The browser will show that the connection is secure, but it isn't. When you pin the cert and key - even with a compromised corporate computer - the insecure site warning will show and you'll be alerted to the fuckery.

> Doing things this way is the final nail in the coffin for Internet Explorer 6

- Fucking great! Nothing else to say here.

> handshakes take enormous amounts of CPU

- This is vastly overstated (enormous?). Also, this is called a tradeoff. Security isn't free in time, money, or performance.

> Preloads list is an absolute kludge that does not and will never scale... and works only for specific browser

- The preload list, right now, is 10.6mb and contains 90,862 entries. This seems to function and scale just fine. Seeding your browser with known values is really the best way to do this until 99.X% of web traffic is provided over HTTPS... Also Chrome, Firefox, Safari, IE/Edge, and Opera make up 98% of all browser traffic today and they have all supported this standard for years.

> The biggest problem with forcing everything HTTPS is a false sense of security.

- Defense in depth. Layering security controls is the only way to go. Also; this is some crazy mental gymnastics to take the position "wearing a seatbelt is a false sense of security because you can still crash".

> Because it's hard and a pain.

- Feeling that pain is offset onto the attackers trying to compromise your site. If you don't feel the pain; they don't either.

> Secure websites can make the web less accessible for those who rely on metered satellite internet... TLS 1.3 with 1-RTT should improve this situation.

- Even if your entire business depended upon delivering data to metered satellite internet users; the risk outweighs the cost when not encrypting your traffic. WARNING: DON'T IMPLEMENT 0-RTT OR 1-RTT WITHOUT UNDERSTANDING YOUR APPLICATION-SPECIFIC REQUIREMENTS. You can really fuck this up by not properly managing tokens between your webserver and application layer. Not recommended.

> I don't get it. With Lets Encrypt, it's like one or two lines to get everything set up.

- True, but it get's confusing really fast if you don't 100% match the certbot use-case.

> HTTPS is not an obligation.

- For 99% of people running businesses; it is.

> Recently an OpenShift cluster I admin went down because of long-lived certs not being rotated in time.

- If you have had certbot running for a long time I would suggest you check your server logs TODAY and make sure your cron job is still working correctly. Recently there was a change with the certbot acme version requirement and your reissue might be failing. Seriously, take a quick look right now.

> Because frankly, I neither trust letsencrypt nor the certificate authority system in general... but won't help against industrial (e)spionage

- Places tinfoil hat on... you're not wrong.