3 ms·

That’s fair, given that HSTS is after all a standard itself and Google is merely applying it. Then I guess my perplexity is towards IETF in that they allow for

That’s fair, given that HSTS is after all a standard itself and Google is merely applying it. Then I guess my perplexity is towards IETF in that they allow for two conflicting standards to exist. What if I want to use local.my.app for development; Or, in a more textbook example, i want to use workstation-1.building-a.my.internal.my.app without https?

therealmarv 8y ago
That's a bad idea but here you go https://stackoverflow.com/questions/44650854/how-to-disable-chrome-hsts-permanently-for-a-subdomain#comment85342255_49130998 https://stackoverflow.com/questions/44650854/how-to-disable-...
- simon_acca 8y ago
  Well, disabling HSTS is a badidea as long as the logical (or legal) entity creating the subdomain is the same one that enforces HSTS, which was the case up until this point, (in that being the same entity they know which subdomains need HSTS and which ones don't).
  - icebraining 8y ago
    Anyone registering a .app domain knows it will have HSTS, so they feel it's appropriate for their site to use it.
s2g 8y ago
Arbitrarily across an entire TLD. Because IANA decided to start selling off the web for companies to abuse. > What if I want to use local.my.app for development; You can switch to .dev... oh right.
- underyx 8y ago
  RFC-6761 [1] reserves .example, .invalid, .localhost, and .test — the latter two seem like nice alternatives. [1]: https://tools.ietf.org/html/rfc6761 https://tools.ietf.org/html/rfc6761
- icebraining 8y ago
  What makes .net OK but .app is "selling off the web"? I mean, besides traditionalist conservatism?
notatoad 8y ago
>What if I want to use local.my.app for development; Or, in a more textbook example, i want to use workstation-1.building-a.my.internal.my.app without https? uh... don't do that? if you're developing locally or internally, use my.app.local or workstation-1.building.internal. If you want to use public domains for non-public things i guess go ahead, but you can't expect everybody else to support your weird thing. Or if you really need to run your internal dev stuff on public domains, get a certificate for it.

therealmarv 8y ago

That's a bad idea but here you go https://stackoverflow.com/questions/44650854/how-to-disable-chrome-hsts-permanently-for-a-subdomain#comment85342255_49130998 https://stackoverflow.com/questions/44650854/how-to-disable-...

simon_acca 8y ago
Well, disabling HSTS is a badidea as long as the logical (or legal) entity creating the subdomain is the same one that enforces HSTS, which was the case up until this point, (in that being the same entity they know which subdomains need HSTS and which ones don't).
- icebraining 8y ago
  Anyone registering a .app domain knows it will have HSTS, so they feel it's appropriate for their site to use it.

s2g 8y ago

Arbitrarily across an entire TLD. Because IANA decided to start selling off the web for companies to abuse. > What if I want to use local.my.app for development; You can switch to .dev... oh right.

underyx 8y ago
RFC-6761 [1] reserves .example, .invalid, .localhost, and .test — the latter two seem like nice alternatives. [1]: https://tools.ietf.org/html/rfc6761 https://tools.ietf.org/html/rfc6761
icebraining 8y ago
What makes .net OK but .app is "selling off the web"? I mean, besides traditionalist conservatism?

notatoad 8y ago

>What if I want to use local.my.app for development; Or, in a more textbook example, i want to use workstation-1.building-a.my.internal.my.app without https? uh... don't do that? if you're developing locally or internally, use my.app.local or workstation-1.building.internal. If you want to use public domains for non-public things i guess go ahead, but you can't expect everybody else to support your weird thing. Or if you really need to run your internal dev stuff on public domains, get a certificate for it.