3 ms·

According to this recent post Google is in charge of the master list that all the other browsers use. Expect the .dev domains to stop working on those other bro

by mark-r 9y ago

According to this recent post Google is in charge of the master list that all the other browsers use. Expect the .dev domains to stop working on those other browsers shortly. https://medium.engineering/use-a-dev-domain-not-anymore-95219778e6fd https://medium.engineering/use-a-dev-domain-not-anymore-9521...

CydeWeys 9y ago
I'm the tech lead of Google Registry and the reason our TLDs ended up on that list, and I'd like to add a clarification here. Google isn't "in charge of" the HSTS preload list per se. The owner of each individual website is in charge of whether or not they are on the list. It is true that the Chrome team happens to manage the list, but the contents of the list wouldn't be any different were it to be managed by anyone else who operated it under the same principle. We, the Google Registry, the group that operates the TLDs that Google owns, have decided to start putting our private, closed, and not-yet-launched TLDs on the HSTS preload list. We can and would be doing this regardless of whether the list were managed by Chrome, Mozilaa, Microsoft, Apple, etc. More information on our motivations for doing so can be found here: https://security.googleblog.com/2017/09/broadening-hsts-to-secure-more-of-web.html https://security.googleblog.com/2017/09/broadening-hsts-to-s...
- mark-r 9y ago
  Understood, and sorry if some imprecision in my language led to misunderstandings. But because the list is maintained by Google, it means that Chrome is the first browser to expose changes to the list. I thought the article that I linked gave a good overview of how we got to where we are.
  - CydeWeys 9y ago
    Safari got this latest version of the HSTS preload list very quickly too. I don't know what their rollout process is, but it was almost simultaneous. It's true that Firefox and Edge are lagging behind by many months, which is unfortunate.

by mark-r 9y ago

CydeWeys 9y ago

I'm the tech lead of Google Registry and the reason our TLDs ended up on that list, and I'd like to add a clarification here. Google isn't "in charge of" the HSTS preload list per se. The owner of each individual website is in charge of whether or not they are on the list. It is true that the Chrome team happens to manage the list, but the contents of the list wouldn't be any different were it to be managed by anyone else who operated it under the same principle. We, the Google Registry, the group that operates the TLDs that Google owns, have decided to start putting our private, closed, and not-yet-launched TLDs on the HSTS preload list. We can and would be doing this regardless of whether the list were managed by Chrome, Mozilaa, Microsoft, Apple, etc. More information on our motivations for doing so can be found here: https://security.googleblog.com/2017/09/broadening-hsts-to-secure-more-of-web.html https://security.googleblog.com/2017/09/broadening-hsts-to-s...

mark-r 9y ago
Understood, and sorry if some imprecision in my language led to misunderstandings. But because the list is maintained by Google, it means that Chrome is the first browser to expose changes to the list. I thought the article that I linked gave a good overview of how we got to where we are.
- CydeWeys 9y ago
  Safari got this latest version of the HSTS preload list very quickly too. I don't know what their rollout process is, but it was almost simultaneous. It's true that Firefox and Edge are lagging behind by many months, which is unfortunate.