3 ms·
Because some websites serve something different on 443 and 80, and you won’t get the right result by visiting 443. The preload list allows you to specifically
by kuschku 7y ago
Because some websites serve something different on 443 and 80, and you won’t get the right result by visiting 443.
The preload list allows you to specifically say that for your own website clients should always use HTTPS, which is a good solution, as it means no one is ever going to visit kuschku.de on port 80, except for curl and dev tools, for which the redirect is useful.
- necovek 7y agoI disagree with the claim that it's better for a web site to implement HSTS than to fix whatever they are serving on 443. But to each their own.
- kuschku 7y agoIt’s possible for me, today, to implement HSTS, and have my site served securely everywhere, today. Browsers can’t set 443 as default, because other websites are broken, other websites I can’t fix and the browsers can’t fix either.
- necovek 7y agoWe have differing views of "everywhere, today": you acknowledged yourself there are cases where it won't happen, it's just how much we think that's important where we differ. That's ok, I appreciate your point and thanks for spending the time to explain. As for what browsers can or cannot do, they also can't introduce DNS-over-http, introduce stricter cookie policies breaking a bunch of web sites, or reduce effectiveness of ad-blockers, drop flash, or... Sure, defaulting to https is too high a bar (not expressing an opinion on any of those — eg. good riddance to Flash :) — but browsers can and have done stuff that's just as bad, forcing web site creators to adapt their web sites).