Please don’t answer that it’s not in your top 100 to-do list.
I face this problem in India with mainstream ISP.
A site without a cert is basically telling its users "I don't care about you."
There is no absolute protection against compromise, but it would be polite for every web site to implement https and hsts to at least make it harder for visitors to be compromised. It costs them very little.
Maybe the analogy is soap in the bathroom at a coffee shop - most customers will not get cholera if the soap is missing, but is it moral for the shop owners to take the risk when the cost is so low and the downside is so high?
1. Ensuring you are getting the information the website author intends for you to get. i.e. data can’t be manipulated in transit.
2. Ensuring the information you are getting is in fact coming from the domain you are requesting it from.
3. Preventing others between you and the website from seeing the information sent back and forth.
I think you questioned the need for TLS here assuming 3 was the only purpose of TLS?
If you have enough money, you don't need to promote yourself or impress anyone...
The following was written years ago, but it is a lot easier to use https now. http://scripting.com/2014/08/08/myBlogDoesntNeedHttps.html
This is a good summary of why you should use HTTPS: https://doesmysiteneedhttps.com/
It requires no effort to stick with HTTP. Yes, it's not rocket science to use HTTPS, but it requires a non-zero amount of time to enable it. He probably has better things to do with his time.
Besides, it's his personal website... He can do whatever he wants with it.
There are millions of sites without HTTPS that should have it, why specifically his site / blog?
He isn't thinking about starting a account or a bank on his site is he?
Please do correct me if I'm wrong, but I think a whole lot of trouble can come if you enable running scripts over unsecured connections. From malicious DOM manipulations to exploiting CPU vulnerabilities. All of this of course if you assume the website you're visiting isn't itself doing malicious things :)
