Why can't I get a file checksum if I'm on http?

[StephenLynx]

What even is the purpose of that limitation? HTTPS doesn't even cover access to the filesystem? What were you thinking?
#28

This is downright stepping on software freedoms and keeping me from using my software as I wish. If someone wants to run a site in plain http, that's his problem.

[twiss]

The issue is that, if a web app computes a checksum of a file, and displays it to the user, the user might trust the file based on that (checksums are often used as a security measure), not realizing that anyone could have modified the code. Using Web Crypto on HTTP is therefore almost always insecure, thus it's better to prevent this massive footgun, and encourage web developers to use HTTPS in these cases. This is meant to protect end users.

[StephenLynx]

This is none of the spec's business. That's between the software and their end-users.