4 ms·
And in ten years, I'm sure they'll ban HTTP altogether. This is unacceptable, IMHO. I was trying to use a site with misconfigured HSTS the other day, and it wo
by heartbeats 7y ago
And in ten years, I'm sure they'll ban HTTP altogether.
This is unacceptable, IMHO. I was trying to use a site with misconfigured HSTS the other day, and it wouldn't let me. No override, no nothing. That's just offensive. If it gives me a warning, fine. But when it outright tells you, "no I know better than you and I'm going to be smug about it," then this has gone too far.
Browsers are "user-agents," meaning they act on behalf of the user. If they do not do this, they are not browsers anymore.
- jxcl 7y agoThis is the documented standard behavior [1]. You’ll find all conforming browsers do this. [1]: https://tools.ietf.org/html/rfc6797#section-12.1 https://tools.ietf.org/html/rfc6797#section-12.1
- AndrewDucker 7y agoThat makes total sense. "If a web application issues an HSTS Policy, then it is implicitly opting into the "no user recourse" approach, thereby all certificate errors or warnings cause a connection termination, with no chance to "fool" users into making the wrong decision and compromising themselves."
- heartbeats 7y agoIf the standard told you to jump off a bridge, would you do it? The standard is idiotic. Which part of "user agent" don't they understand?
- Avamander 7y ago> No override, no nothing. In what browser? I'm not aware of any that have no override.
- thedaemon 7y agoGoogle Chrome has been removing over-rides since forever.
- Avamander 7y agoBut the override hasn't been removed.
- heartbeats 7y agoFirefox, Chrome. Are there any others?
- Avamander 7y agoChrome definitely has a relatively simple override, Firefox's is a tad bit more annoying.