I recently noticed that the assets sent to clients aren't gzipped or minified on either my companies intranet or its public facing website.
I brought this to the attention of the networking department (who maintain the server) and asked if they could add the appropriate code to the server config.
My co-worker initially saw no problem and thought it was a good idea, but today he said that after he inquired further, he found out that it was a security concern and that's why they don't do it.
This baffles me.
I asked how it could possibly be a security concern if we compress the assets sitting on our server prior to sending them to the client.
He told me that it made it easier for hacked content to slip through the clients antivirus scanner. We use HTTPS though, so there's no way our code could be tampered with on the way to the client's browser without their browser noticing, right?
Further more, even if we did send the assets in plain text, if they get intercepted, the hacker could just gzip them himself and send that, so I'm really confused now.
Are there any legitimate reasons NOT to gzip/minify content sent to client's computers?
EDIT: The content is static, essentially just a marketing website for the company