alt Hacker NewsEveryone (including the author) is as per usual focused on the wrong thing.
There is nothing wrong with downloading a certificate over HTTP. In fact, that's how PKI is designed and if you look at the AIA field of this very site you will see the certificate chain is meant to be served over HTTP.
What IS wrong is implicitly trusting an untrusted certificate. Whether it came over HTTPS or HTTP is irrelevant. But no one is talking about that.
I'm more puzzled why someone would buy a complicated IoT purifier for a drafty Bay Area house that probably has knob and tube wiring.
My most reliable air purifiers have a dumb, physical on/off switch. I bought them deliberately for that feature.
People don’t understand things and act shocked when they learn apt and Steam packages are downloaded over HTTP. You only need encryption for private information. CA public keys are not that. But you do need verifiable signatures.