With the rise of Letsencrypt there is no excuse not to anymore. given that this is basically downloading code that will be executed on the users computer, this should really come over a secure connection.
@patdavid and me an help you with LE questions. (others probably too)
Sounds like a good idea.
I’m totally unfamiliar with how these things work actually. What would it imply ? How do you see the thing working ?
As you are running apache on gmic.eu. Just use certbot to setup https + letsencrypt. Certbot is included in most distributions.
It should be relative painless to switch to https.
I admit I’m using a not-so-expensive external hosting service for gmic.eu, so I cannot tweak the web server as I want.
I’ll see what they offer, and if this service is available in my hosting contract.
We use dehydrated for discuss.pixls.us.
Maybe your webhoster offers LetsEncrypt integration already. I mean it doesn’t cost them much to add that.
Also how does an user verify that the file on that webhoster is unmodified and really still what you uploaded?
OK, so finally, it seems the web server is already configured for https connexions.
I’ll simply force the update file to use a https:// address instead of a http:// one.
+1
and if you can HSTS header.
Yes, that is what I’m doing right now.
And it seems to work so far.
Don’t know what this thing is, so please elaborate 
For apache:
# HSTS (mod_headers is required) (15768000 seconds = 6 months)
Header always set Strict-Transport-Security "max-age=15768000"
For nginx:
add_header Strict-Transport-Security max-age=15768000;
With this header in the SSL vhost … the client will go directly to the https site for the configured time, if it has been there once.
So even if you type http://gmic.eu/ it will load the https site.
Ah ok ok.
Don’t know how I can do this with my hosting service, but I will check.
One important bit to check when you force the site to https:
links to local and 3rd party resources have to use https as well.
so either always use
https://somehost/somepath
or
//somehost/somepath
The 2nd syntax will reuse the same protocol type as the current page.
Looks like this thing is working too Thanks !