Sorry for top-leveling a grand-child comment, but reading between the lines, this is the attack vector: > And for the last question: Again, there are n

Sorry for top-leveling a grand-child comment, but reading between the lines, this is the attack vector: > And for the last question: Again, there are no .dev domain > names. There never have been. It's never been available for > registration. The recommendation for a long time has been to > only use either (a) domain names that you actually own, or (b) > domain names that are reserved for testing and are guaranteed > never to exist a la RFC 2606. Using domain names for testing > that don't yet exist but could in the future is a huge security > hole that you must fix now. Do it now while the domain names > still fail to resolve. Once they resolve, and you don't own > them, then your security situation gets a lot worse. Google is concerned with nation-state attacks. This means they have to assume ninja-assassin-scuba-divers have tapped all their cables underground. They're also concerned about ninja-assassin-usb-stick-droppers, and all kinds of other use cases. What they're doing is: 1) Requiring *.dev to match PRE-LOADED HSTS certs. This allows google to "safely" boot up a computer from scratch. Just so long as "clone-a-computer-from-scratch.dev" matches the public/private handshake for HSTS/HTTPS then google knows that no MITM, no nation state DNS takeover, etc. is possible. So long as the VERY FIRST CONTACT WITH THE INTERNET is a *.dev domain, then that computer can be "as secure as possibly known". 2) Forcing people to bounce "off" of invalid TLD's as a network administration method. Remember, google is concerned about nation states. Remember wanna-cry? How it was disabled by some random researcher registering xyz-abc-123.com? That attack costs $15. Now imagine a nation-state, intentionally registering a gTLD of "\*.haha-now-your-company-infra-is-pwnd" which they somehow glean is the gTLD your developers use for local development / testing / intranet portal. If you could spoof IBM's intranet by doing something like: "http://www.welcome.ibm" or "https://www.welcome.ibm" (b/c the *.ibm wasn't cert-pinned.....) then you could trivially cause *.ibm to resolve to some sort of spoofed site to collect passwords. Or what if they're catching `mysql -uroot -pxyz staging.product.ibm`? Whoops. Or... perhaps another gTLD we'll see google register is "*.go" or maybe their internal builds of chrome already do cert-pinning on that. (Reason is I've seen/heard they allow 'http://go/my-internal-shortlink' ... I know that other tech companies have had similar setups). Same attack vector. You control the DNS, you control ALL responses. And when somebody types www.microsoft.com, it may be _impossible_ to know if that "Down for Maintenance" banner is real or fake if their DNS is controlled by somebody who really is your enemy.