5 ms·

Chrome just screwed the pooch, at least for me... blocking .dev domains ended my use. I'm not going to setup ssl on all my development environments for all the

Chrome just screwed the pooch, at least for me... blocking .dev domains ended my use. I'm not going to setup ssl on all my development environments for all the sites I have. I'll just dev in firefox, and move to firefox completely.

Ajedi32 9y ago
Any particular reason you think Firefox won't also implement Google's HSTS preloads for .dev? Google owns that TLD, so I don't see why any browser which supports HSTS preloads would choose to ignore that particular pin, especially given that a move towards universal deployment of HTTPS is generally regarded as a good thing by browser developers and security experts.
- kuschku 9y ago
  > Google owns that TLD That’s the issue, and the part that should never have happened.
Sephr 9y ago
There are TLDs explicitly reserved for local use, and .dev isn't one of them.
mark-r 9y ago
According to this recent post Google is in charge of the master list that all the other browsers use. Expect the .dev domains to stop working on those other browsers shortly. https://medium.engineering/use-a-dev-domain-not-anymore-95219778e6fd https://medium.engineering/use-a-dev-domain-not-anymore-9521...
- CydeWeys 9y ago
  I'm the tech lead of Google Registry and the reason our TLDs ended up on that list, and I'd like to add a clarification here. Google isn't "in charge of" the HSTS preload list per se. The owner of each individual website is in charge of whether or not they are on the list. It is true that the Chrome team happens to manage the list, but the contents of the list wouldn't be any different were it to be managed by anyone else who operated it under the same principle. We, the Google Registry, the group that operates the TLDs that Google owns, have decided to start putting our private, closed, and not-yet-launched TLDs on the HSTS preload list. We can and would be doing this regardless of whether the list were managed by Chrome, Mozilaa, Microsoft, Apple, etc. More information on our motivations for doing so can be found here: https://security.googleblog.com/2017/09/broadening-hsts-to-secure-more-of-web.html https://security.googleblog.com/2017/09/broadening-hsts-to-s...
  - mark-r 9y ago
    Understood, and sorry if some imprecision in my language led to misunderstandings. But because the list is maintained by Google, it means that Chrome is the first browser to expose changes to the list. I thought the article that I linked gave a good overview of how we got to where we are.
    - CydeWeys 9y ago
      Safari got this latest version of the HSTS preload list very quickly too. I don't know what their rollout process is, but it was almost simultaneous. It's true that Firefox and Edge are lagging behind by many months, which is unfortunate.

Ajedi32 9y ago

Any particular reason you think Firefox won't also implement Google's HSTS preloads for .dev? Google owns that TLD, so I don't see why any browser which supports HSTS preloads would choose to ignore that particular pin, especially given that a move towards universal deployment of HTTPS is generally regarded as a good thing by browser developers and security experts.

kuschku 9y ago
> Google owns that TLD That’s the issue, and the part that should never have happened.

Sephr 9y ago

There are TLDs explicitly reserved for local use, and .dev isn't one of them.

mark-r 9y ago

According to this recent post Google is in charge of the master list that all the other browsers use. Expect the .dev domains to stop working on those other browsers shortly. https://medium.engineering/use-a-dev-domain-not-anymore-95219778e6fd https://medium.engineering/use-a-dev-domain-not-anymore-9521...

CydeWeys 9y ago
I'm the tech lead of Google Registry and the reason our TLDs ended up on that list, and I'd like to add a clarification here. Google isn't "in charge of" the HSTS preload list per se. The owner of each individual website is in charge of whether or not they are on the list. It is true that the Chrome team happens to manage the list, but the contents of the list wouldn't be any different were it to be managed by anyone else who operated it under the same principle. We, the Google Registry, the group that operates the TLDs that Google owns, have decided to start putting our private, closed, and not-yet-launched TLDs on the HSTS preload list. We can and would be doing this regardless of whether the list were managed by Chrome, Mozilaa, Microsoft, Apple, etc. More information on our motivations for doing so can be found here: https://security.googleblog.com/2017/09/broadening-hsts-to-secure-more-of-web.html https://security.googleblog.com/2017/09/broadening-hsts-to-s...
- mark-r 9y ago
  Understood, and sorry if some imprecision in my language led to misunderstandings. But because the list is maintained by Google, it means that Chrome is the first browser to expose changes to the list. I thought the article that I linked gave a good overview of how we got to where we are.
  - CydeWeys 9y ago
    Safari got this latest version of the HSTS preload list very quickly too. I don't know what their rollout process is, but it was almost simultaneous. It's true that Firefox and Edge are lagging behind by many months, which is unfortunate.