Is the best way to currently prevent this is via full ssl?
Additionally, how can a site like Amazon.com run non-ssl protected pages and prevent mitm-ing? (e.g. http://www.amazon.com/dp/B00TYBBNAW/ doesn't redirect to https, but only when ordering, etc.)
I think the problem is javascript that's not 'free' as in explicitly licensed as free software.
The web, as a concept, seems to conflict with his ideals in a number of ways, at least superficially. For instance, you can't modify and redistribute the source code of any site you visit, since by definition you only get the response of that site. Technically, every URL leads to a black box. Although many sites use free libraries and might offer their source code as a repo, you never really know what they're actually running.
Hacker News is a perfect example. It's only barely "open source" in that you can download an old version of the Arc forum, and it's known that the HN staff have made their own edits to the software, which no one can contribute to, or fork, or even see, since they don't want people to be able to game the system. What people are interacting with is pretty much a closed source and proprietary service.
But on the other hand, you interact with the html, and you can mess with it in the browser all you want. Still not technically free, though.
Does Uber's javascript code come with a license that gives you these freedoms:
* Freedom 0: The freedom to run the program for any purpose;
* Freedom 1: The freedom to study how the program works, and change it to make it do what you wish;
* Freedom 2: The freedom to redistribute copies so you can help your neighbour, and
* Freedom 3: The freedom to improve the program, and release your improvements (and modified versions in general) to the public, so that the whole community benefits?
The problem i have with their "neutral, lacking security" icon is that it does not indicate that anything is wrong when in fact there is. https:// should never have a neutral icon. it should be VALID or INVALID.
Additionally, how can a site like Amazon.com run non-ssl protected pages and prevent mitm-ing? (e.g. http://www.amazon.com/dp/B00TYBBNAW/ doesn't redirect to https, but only when ordering, etc.)