4 ms·

Weird.. $ curl https://techblog.netflix.com/2016/08/netflix-and-fill.html -vv * Trying 2607:f8b0:4002:c06::d6... * Connected to techblog.netflix.com (2

Weird.. $ curl https://techblog.netflix.com/2016/08/netflix-and-fill.html -vv * Trying 2607:f8b0:4002:c06::d6... * Connected to techblog.netflix.com (2607:f8b0:4002:c06::d6) port 443 (#0) * Server aborted the SSL handshake * Closing connection 0 curl: (35) Server aborted the SSL handshake Fails from at least the 3 locations I just tried across the country.. Google outage?

Thaxll 10y ago
Why do you use HTTPS? The link is HTTP, their blog doesn't support HTTPS.
- vonmoltke 10y ago
  Their blog is directing me to an HTTPS link when I go to "techblog.netflix.com". It does it even when I specify HTTP.
  - justinsaccount 10y ago
    Do you have https everywhere installed too?
    - vonmoltke 10y ago
      No. Firefox seems to be doing this on its own.
      - niftich 10y ago
        If you're running NoScript, check its settings. See: https://news.ycombinator.com/item?id=12256270#12257702 https://news.ycombinator.com/item?id=12256270#12257702
        vonmoltke 10y ago
        That did it, thanks. I would not have expected NoScript to be doing things like that.
- justinsaccount 10y ago
  Ah.. https everywhere seems to think it should support it. Oddly have never had a problem with it until now.
diggan 10y ago
This gets mentioned every time a blogpost from Netflix appears on HN. I've mentioned it too! https://news.ycombinator.com/item?id=12217900 https://news.ycombinator.com/item?id=12217900 According to kpcyrd, this is what happens: " I have the same issue, even though the link actually is http, my browser tries to open the https version, no matter what. It looks like https://netflix.com https://netflix.com had hsts with includeSubdomains at one point in time which my browser has still cached. "
- nathancahill 10y ago
  Which is why you should only enable HSTS if you plan on supporting it permanently.
  - peterwwillis 10y ago
    "But there's no reason to not use HTTPS! What could go wrong?" But, you know... we have to secure our blog posts from MitM...
    - eterm 10y ago
      No, you have to secure your blog posts because cookies against the top level domain can be in the request headers sent to the subdomain[1]. It's a bit bizarre you'd blame HTTPS, what is your alternative, don't use https? [1] I say "can" because it depends on how the top level cookie is set, whether the browser respects the secure flag, and individual browser versions.

Thaxll 10y ago

Why do you use HTTPS? The link is HTTP, their blog doesn't support HTTPS.

vonmoltke 10y ago
Their blog is directing me to an HTTPS link when I go to "techblog.netflix.com". It does it even when I specify HTTP.
- justinsaccount 10y ago
  Do you have https everywhere installed too?
  - vonmoltke 10y ago
    No. Firefox seems to be doing this on its own.
    - niftich 10y ago
      If you're running NoScript, check its settings. See: https://news.ycombinator.com/item?id=12256270#12257702 https://news.ycombinator.com/item?id=12256270#12257702
      - vonmoltke 10y ago
        That did it, thanks. I would not have expected NoScript to be doing things like that.
justinsaccount 10y ago
Ah.. https everywhere seems to think it should support it. Oddly have never had a problem with it until now.

diggan 10y ago

This gets mentioned every time a blogpost from Netflix appears on HN. I've mentioned it too! https://news.ycombinator.com/item?id=12217900 https://news.ycombinator.com/item?id=12217900 According to kpcyrd, this is what happens: " I have the same issue, even though the link actually is http, my browser tries to open the https version, no matter what. It looks like https://netflix.com https://netflix.com had hsts with includeSubdomains at one point in time which my browser has still cached. "

nathancahill 10y ago
Which is why you should only enable HSTS if you plan on supporting it permanently.
- peterwwillis 10y ago
  "But there's no reason to not use HTTPS! What could go wrong?" But, you know... we have to secure our blog posts from MitM...
  - eterm 10y ago
    No, you have to secure your blog posts because cookies against the top level domain can be in the request headers sent to the subdomain[1]. It's a bit bizarre you'd blame HTTPS, what is your alternative, don't use https? [1] I say "can" because it depends on how the top level cookie is set, whether the browser respects the secure flag, and individual browser versions.