Mail a Letter Online

I am very clearly not the intended customer and appreciate that they're willing to take my business anyway.

I also used them for holiday cards two years back, which was

* Fantastic -- super straightforward to write up a small script to call their API and send 1 card to each person on our holiday-card list

* A little weird -- sending 70 holiday cards involved instructing their API to download an identical .pdf holiday card template from a remote server where I hosted that one file 70 times

* Cheap -- they printed and mailed glossy postcards at a very affordable price

* Ever so slightly disappointing -- we got to see maybe 10 of the actual mailed postcards from this run (on family's fridges, in the test copy we sent ourselves, and in the 3 or 4 postcards that we thought were addressed correctly but which were returned to us with an invalid address) and every single one of them had the same printing defect, what looked like a big scuff across a photo. Not sure what the deal was or why it was so consistent on every image. We didn't write in to support because I am pretty sure we are not the target audience.

Great service, A+, huge time saver vs. manually writing so many addresses, still a big fan.

This is one of the silliest arguments that comes up every time "SSL All The Things!" is discussed. The "you" in your story has to be both a Bad Guy and your ISP, and needs to come up with a way to sabotage a site that shows you cat pictures in such a way that it shows malicious cat pictures that somehow do anybody any harm.

So yeah, please MITM this site for us real quick so we can see all the Bad Stuff you're talking about.

The attitude of "it's cool, only use SSL for the sensitive parts" hasn't been true for a decade.

And yes, the point of MITM is that there has to be a malicious actor in the middle. This is mainly a threat when using public WiFi, like at an airport or a coffee shop. It's absolutely trivial for some bored individual to run SSLstrip for funsies and distribute malware through any HTTP connections.

Also, an attacker doesn't need to somehow create malware-infested versions of the cat pictures on your site. They only need to append some javascript at the end of your site's body tag, which again, is trivial for a script to do. And maybe a transparent image with the malicious payload should they have JS disabled.

To those wondering how they might protect themselves from these sorts of attacks when using non-SSL sites on public WiFi, this is where a VPN comes in handy. All of your connections will be encrypted and no longer vulnerable to MITM attacks.