@ericsedge @timbray static sites should still be served over HTTPS. Protects against spying and against injection attacks.

(And they should still use CSS, but they don't have to if they don't want to.)

(Or did i misread your joke?)