3 ms·
It’s possible for me, today, to implement HSTS, and have my site served securely everywhere, today. Browsers can’t set 443 as default, because other websites a
by kuschku 7y ago
It’s possible for me, today, to implement HSTS, and have my site served securely everywhere, today.
Browsers can’t set 443 as default, because other websites are broken, other websites I can’t fix and the browsers can’t fix either.
- necovek 7y agoWe have differing views of "everywhere, today": you acknowledged yourself there are cases where it won't happen, it's just how much we think that's important where we differ. That's ok, I appreciate your point and thanks for spending the time to explain. As for what browsers can or cannot do, they also can't introduce DNS-over-http, introduce stricter cookie policies breaking a bunch of web sites, or reduce effectiveness of ad-blockers, drop flash, or... Sure, defaulting to https is too high a bar (not expressing an opinion on any of those — eg. good riddance to Flash :) — but browsers can and have done stuff that's just as bad, forcing web site creators to adapt their web sites).