5 ms·

http://example.com http://example.com also does this, albeit without the promise of never switching

bailey-maitland 7y ago
Another one: http://http.rip http://http.rip
Thorrez 7y ago
In both Chrome and Firefox, when I type "example.com" into the URL bar, I go to https://example.com https://example.com , probably because I've visited the https site before and they remember that. So I do not recommend example.com .
- kees99 7y ago
  Indeed, "browser.urlbar.autoFill" option (enabled by default) would do that in Firefox. There should be no forced https redirection if you fill in http:// http:// prefix by hand though. At least for now, until example.com adds HSTS headers.
- shakna 7y ago
  I don't think the IANA domains make use of HSTS or anything of the like. HTTP/2.0 304 Not Modified cache-control: max-age=604800 date: Sat, 02 Nov 2019 22:22:19 GMT etag: "3147526947+gzip" expires: Sat, 09 Nov 2019 22:22:19 GMT last-modified: Thu, 17 Oct 2019 07:18:26 GMT server: ECS (sjc/4E71) vary: Accept-Encoding If you type "example.com" into the URL, both Firefox and Chrome will try HTTPS first. If you want plain HTTP, you just need to ask for it: "http://example.com" http://example.com"
  - Thorrez 7y ago
    I don't think HTTPS is the default automatically. When I create a new Chrome profile, then type example.com into the url bar and hit enter, I go to http://example.com http://example.com . Then when I type https://example.com https://example.com twice (each time hitting enter) then type example.com and hit enter, I go to https://example.com https://example.com . So I think it might be whichever is more common in your history. Firefox behaves very similarly, except I don't have to visit https://example.com https://example.com twice before it becomes the default, I just have to visit it once.
    - ramshorns 7y ago
      This could also happen because of an extension like HTTPS Everywhere, which requests the https by default when both are available.
      - amarshall 7y ago
        HTTPS Everywhere uses built-in rules, not heuristics, to determine when to rewrite an HTTP request to HTTPS. There does not appear to be a rule for example.com, so HTTPS Everywhere does not cause a rewrite.
        shakna 7y ago
        It also sends the "Upgrade-Insecure-Request" header, which can cause that switch to take place.
- amarshall 7y ago
  For Firefox, this may occur when the address bar autocompletes from history, pulling the https:// https:// entry. As far as I can tell, it doesn’t have anything to do with prioritizing HTTPS, just whichever is more frequent in your history (if you visit the HTTP enough times it will switch to picking that for autocomplete). If you don’t use the autocomplete entry (for example, by tab-completing it but deleting the trailing slash), then it will use HTTP unless you actually typed https:// https://.
- organsnyder 7y ago
  The Firefox instance I'm using at the moment goes to the non-TLS version when I type "example.com" in the address bar.
shakna 7y ago
And with a different relationship: * neverssl might be bought out, or re-registered, at some time in the future. * example.com is a IANA reserved domain [0], which whilst it doesn't guarantee they'll never deploy SSL, does mean nobody else can register it, ever (RFC 6761) [1]. [0] https://www.iana.org/domains/reserved https://www.iana.org/domains/reserved [1] https://tools.ietf.org/html/rfc6761 https://tools.ietf.org/html/rfc6761
- profmonocle 7y ago
  Has an interesting WHOIS record too. The "registrar" is "RESERVED-Internet Assigned Numbers Authority", and no admin/technical/billing contacts like in standard whois entries.
- judge2020 7y ago
  http://example.com/ http://example.com/ does deploy HTTPS https://example.com/ https://example.com/ - but a redirect from http is unlikely, at least until the .com TLD is HSTS preloaded (and this might not be for another 10 years or so).
crazysim 7y ago
I think the only promise example.com has is that the domain will always exist.
- profmonocle 7y ago
  I'm not sure that's even true. RFC 6761 says "IANA currently maintains a web server providing a web page explaining the purpose of example domains." Saying "currently" implies it's not guaranteed to always be true. (Although it's more likely to stick around than a random domain registered by a hobbyist.)
  - dmurray 7y ago
    "the domain will exist" does not mean "someone will run a web server there and respond to traffic", though. Though I'm not exactly sure what it does mean. That it will have at least one DNS record?
morpheuskafka 7y ago
This is very pedantic, but technically nothing requires an HTTP service to be hosted at example.com. It's only guaranteed to be reserved and never assigned to a real organization at the DNS level.
seventhtiger 7y ago
I've always used terrible.com It's just your standard parked domain. I typed it in when I was frustrated one time trying to log into a public wifi. It worked and I didn't even understand why back then.

Another one: http://http.rip http://http.rip

In both Chrome and Firefox, when I type "example.com" into the URL bar, I go to https://example.com https://example.com , probably because I've visited the https site before and they remember that. So I do not recommend example.com .

kees99 7y ago
Indeed, "browser.urlbar.autoFill" option (enabled by default) would do that in Firefox. There should be no forced https redirection if you fill in http:// http:// prefix by hand though. At least for now, until example.com adds HSTS headers.
shakna 7y ago
I don't think the IANA domains make use of HSTS or anything of the like. HTTP/2.0 304 Not Modified cache-control: max-age=604800 date: Sat, 02 Nov 2019 22:22:19 GMT etag: "3147526947+gzip" expires: Sat, 09 Nov 2019 22:22:19 GMT last-modified: Thu, 17 Oct 2019 07:18:26 GMT server: ECS (sjc/4E71) vary: Accept-Encoding If you type "example.com" into the URL, both Firefox and Chrome will try HTTPS first. If you want plain HTTP, you just need to ask for it: "http://example.com" http://example.com"
- Thorrez 7y ago
  I don't think HTTPS is the default automatically. When I create a new Chrome profile, then type example.com into the url bar and hit enter, I go to http://example.com http://example.com . Then when I type https://example.com https://example.com twice (each time hitting enter) then type example.com and hit enter, I go to https://example.com https://example.com . So I think it might be whichever is more common in your history. Firefox behaves very similarly, except I don't have to visit https://example.com https://example.com twice before it becomes the default, I just have to visit it once.
  - ramshorns 7y ago
    This could also happen because of an extension like HTTPS Everywhere, which requests the https by default when both are available.
    - amarshall 7y ago
      HTTPS Everywhere uses built-in rules, not heuristics, to determine when to rewrite an HTTP request to HTTPS. There does not appear to be a rule for example.com, so HTTPS Everywhere does not cause a rewrite.
      - shakna 7y ago
        It also sends the "Upgrade-Insecure-Request" header, which can cause that switch to take place.
amarshall 7y ago
For Firefox, this may occur when the address bar autocompletes from history, pulling the https:// https:// entry. As far as I can tell, it doesn’t have anything to do with prioritizing HTTPS, just whichever is more frequent in your history (if you visit the HTTP enough times it will switch to picking that for autocomplete). If you don’t use the autocomplete entry (for example, by tab-completing it but deleting the trailing slash), then it will use HTTP unless you actually typed https:// https://.
organsnyder 7y ago
The Firefox instance I'm using at the moment goes to the non-TLS version when I type "example.com" in the address bar.

shakna 7y ago

And with a different relationship: * neverssl might be bought out, or re-registered, at some time in the future. * example.com is a IANA reserved domain [0], which whilst it doesn't guarantee they'll never deploy SSL, does mean nobody else can register it, ever (RFC 6761) [1]. [0] https://www.iana.org/domains/reserved https://www.iana.org/domains/reserved [1] https://tools.ietf.org/html/rfc6761 https://tools.ietf.org/html/rfc6761

profmonocle 7y ago
Has an interesting WHOIS record too. The "registrar" is "RESERVED-Internet Assigned Numbers Authority", and no admin/technical/billing contacts like in standard whois entries.
judge2020 7y ago
http://example.com/ http://example.com/ does deploy HTTPS https://example.com/ https://example.com/ - but a redirect from http is unlikely, at least until the .com TLD is HSTS preloaded (and this might not be for another 10 years or so).

crazysim 7y ago

I think the only promise example.com has is that the domain will always exist.

profmonocle 7y ago
I'm not sure that's even true. RFC 6761 says "IANA currently maintains a web server providing a web page explaining the purpose of example domains." Saying "currently" implies it's not guaranteed to always be true. (Although it's more likely to stick around than a random domain registered by a hobbyist.)
- dmurray 7y ago
  "the domain will exist" does not mean "someone will run a web server there and respond to traffic", though. Though I'm not exactly sure what it does mean. That it will have at least one DNS record?

morpheuskafka 7y ago

This is very pedantic, but technically nothing requires an HTTP service to be hosted at example.com. It's only guaranteed to be reserved and never assigned to a real organization at the DNS level.

seventhtiger 7y ago

I've always used terrible.com It's just your standard parked domain. I typed it in when I was frustrated one time trying to log into a public wifi. It worked and I didn't even understand why back then.