46 ms·
Chrome’s address bar will use https:// by default
- falcolas 6y agoStrange to see what kinds of things that Chrome leads the way on, and what things it's a distant follower to other browsers on. I'd wonder what value Google would derive from staying with HTTP as a default, but I can't think of anything offhand.
- livre 6y agoIn this case Firefox was first with a slightly different implementation (a warning instead of directly falling back to http). https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/ https://blog.mozilla.org/security/2020/11/17/firefox-83-intr... I think the idea originally came from the extension HTTPS Everywhere and its EASE mode back in 2018. https://www.eff.org/deeplinks/2018/12/how-https-everywhere-keeps-protecting-users-increasingly-encrypted-web https://www.eff.org/deeplinks/2018/12/how-https-everywhere-k...
- deleted 6y ago[deleted]
- jefftk 6y ago> a slightly different implementation That is an option you can enable, while this post is about changing the default.
- marcosdumay 6y agoYour FF link is about a different functionality. FF has used https by default, with fallback into http for addresses you write for a really long time.
- p410n3 6y agoI'm interested If that behavior will be the same when using web.dev Usually when I enter a site to test it there, it always tells me to avoid redirects. I think HSTS would would have also solved this, but our (managed) hosting provider does not offer this as a default, and doing it manually for the amount of sites is not really practical. At least not the sites that are already done.
- tialaramex 6y agoAll of .dev is covered by HSTS pre-loading. So even if you explicitly type http://web.dev/ http://web.dev/ you are going to actually navigate to https://web.dev/ https://web.dev/ because that's how HSTS is defined. If you want a site that isn't encrypted in browsers then an entire TLD which is specifically secured is the wrong place to build that site.
- p410n3 6y agoI think I explained myself badly. Im entering sites INTO https://web.dev https://web.dev that we make at work. Web.dev is basically Google Lighthouse and tests your website for basic performance, seo, best practices and A11Y. So for example I enter mycustomer.com and it tells me "avoid http redirects" because I didn't enter the https:// https:// before. Hsts is included in one of our packages which also includes CSP settings and other security stuff, but barely anyone buys that.
- dfabulich 6y agoThere's no link to more technical detail. What happens when the site I type in the URL bar doesn't support HTTPS? Will it error out? (with a timeout?) Or will it automatically fallback to trying HTTP? (In that case, could a MITM block HTTPS to force the browser to try to downgrade?) EDIT: I see that the article says it will fall back, but Chrome Canary has options in chrome://flags, and it's not clear which option they picked. > Omnibox - Use HTTPS as the default protocol for navigations > Use HTTPS as the default protocol when the user types a URL without a protocol in the omnibox such as 'example.com'. Presently, such an entry navigates to http://example.com http://example.com. When this feature is enabled, it will navigate to https://example.com https://example.com if the HTTPS URL is available. If Chrome can't determine the availability of the HTTPS URL within the timeout, it will fall back to the HTTP URL. The options are: Enabled, Enabled 3 second timeout, Enabled 10 second timeout, and Disabled. So how will it work, exactly?
- theonlybutlet 6y agoAt the end it states it will then fall back to http.
- tebbers 6y agoFrom the article: "For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails."
- jefftk 6y ago"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails." MITM is still an issue. At some point I hope browsers can switch to "you have to type http:// http:// if you want HTTP", and this is a step in that direction. (Disclosure: I work for Google, speaking only for myself)
- ibejoeb 6y agoIt might still be an issue, but this is still a huge improvement. If the browser is going to pick a protocol on behalf of the user, it ought choose a stronger protocol first.
- tialaramex 6y agoDoing this helps in some cases against passive attackers, sidesteps the need for a redirect to send visitors to your secure site on first visit to have them pick up your HSTS but it doesn't offer any protection against an active attacker on first visits. Firefox HTTPS mode gives you a (dismissable) interstitial if any site apparently doesn't do HTTPS, which is an opportunity to catch attacks, but less suitable for non-experts because they will find it hard to judge when to be surprised. As a site owner, HSTS preload remains what you should do to protect visitors if you know you are going to do HTTPS. Some day DANE and/or DPRIVE plus HTTPSVC will reliably ensure the visitors to any HTTPS site get HTTPS on contemporary browsers, we're years from that though.
- Spivak 6y agoI don’t think it’s enough to actually drop your redirect on the server side yet since there’s lots of non-browser clients.
- theonlybutlet 6y agoI'm surprised, I already thought this was the default behaviour.
- 0xdba 6y agoYes, I thought either FF or Chrome had implemented this before.
- tialaramex 6y agoFirefox offers HTTPS Mode, which converts all HTTP links to HTTPS first, A HREFs, stuff you type into the URL bar, everything, then if that fails it generates an interstitial page explaining what went wrong with a button to get the unencrypted HTTP site if that's available. But that's optional (I wouldn't recommend it to anybody who doesn't seem clear on what HTTPS versus HTTP means for example) and far more invasive, though in exchange it delivers more practical security if you understand what's going on. I've enabled it, I have mentioned it to IT people I know socially, I wouldn't suggest my mother or sister try it.
- notsobig 6y agoi was amazed when i looked into it. brave did it, safari had it hidden in the developer menu, chrome: nope. i figured there was something to be gained for them. ultimately there arent too many sites you type out much of an endpoint for, but "old.reddit.com/r/ihaveembarrassingsecrets" or whatever is a big one.
- jedimastert 6y agoI keep forgetting it's not because "HTTPS Everywhere" is on my short list of extensions to install first thing
- flotzam 6y agoIs there a way to get exactly this new Chrome address bar behavior in Firefox? I.e. I want Firefox to follow plain http links same as before, but if I type in example.com it should expand to https://example.com https://example.com
- pjmlp 6y agoNot quite the same, but you can enable HTTPS only navigation and then cleary accept an exception when only HTTP is available. https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/ https://blog.mozilla.org/security/2020/11/17/firefox-83-intr...
- morvita 6y agoIt's not exactly the same thing, but Firefox has HTTPS-only mode you can activate. https://support.mozilla.org/en-US/kb/https-only-prefs https://support.mozilla.org/en-US/kb/https-only-prefs
- deleted 6y ago[deleted]
- marcosdumay 6y agoAFAIK, Firefox has worked exactly like this for a long time. There is probably some way to disable that behavior, and when you type a site, it offers an http suggestion for you to reach easily, but the default is https.
- flotzam 6y agoFirefox 86 falls back on HTTP transparently (e.g. try it with sane-project.org). I'd like to disable that, but without also adding a (stateful, fingerprintable) confirmation step to follow HTTP links.
- cblconfederate 6y agoRight, can it please stop hiding it though? URLs aren't prose
- SquareWheel 6y agoHiding it? Just enable "Always Show Full URLs" in the omnibar.
- Black101 6y agoDefault value matters ... it's a bit like opt-in vs opt-out
- bmicraft 6y agoWhat's the point in having the protocol spelled out when you have the lock icon anyways? I don't think this would be a useful default.
- squaresmile 6y agoOne thing that was quite annoying to me is the URL changing under my cursor on double-click if the protocol is hidden. However, I can see that editing the URL is a niche use case. Fair enough.
- throwaway287391 6y agoI hate that editing URLs is practically impossible in Chrome on iOS (not sure about Android or other iOS browsers). There seems to be no equivalent of arrow keys to navigate around inside the address bar. If I screeenmash enough I think I can sometimes get it to go to the very start or end of the URL, but anything in between is hopeless. (Posting this partially in hopes that someone tells me how to do it to prove me wrong...)
- oneeyedpigeon 6y ago
- colllectorof 6y agoMeanwhile, here is the state of certbot support on shared hosting: https://certbot.eff.org/hosting_providers https://certbot.eff.org/hosting_providers Yellow means you have to jump through hoops as a user. Even though the whole point of managed/shared hosting is that you don't. So either all those companies whose primary business is to provide hosting are incompetent, or "Let's Encrypt is super easy" narrative is false.
- antihero 6y ago> all those companies whose primary business is to provide hosting are incompetent, Bingo
- pornel 6y agoThat makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP. [1] https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/https/overview It's not a big change from security perspective though. HTTP requests shouldn't be getting cookies any more, and the redirect isn't revealing anything new (not until we get DoH + ESNI). You still need HSTS preload to defend against active downgrade attacks. An interesting side effect of the change is that sites won't have have a working HTTP redirect any more. Inevitably, there will be sites that let their HTTP versions rot and break, which will eventually force all other web clients to default to HTTPS for web-compatibility.
- Ajedi32 6y agoIt seems like this is primarily a performance optimization, at least for now. One less round trip when navigating to a site by typing the domain name when that site redirects to HTTPS (and isn't on the HSTS preload list).
- remram 6y agoIt's a huge security improvement. The HTTP->HTTPS redirection is not secured in any way. [edit: it's not really because it falls back]
- est31 6y agoThe info "is https available" is not secured either. The ISP can just block any packet on port 443 and force http that way. It would break links but wouldn't break people entering the address via the URL bar. A real improvement in security would be Google caching the data, and either offering it via a custom API or just signing it and appending it to their 8.8.8.8 DNS responses. Per default, Chrome already sends the URL to Google as you type, you have to turn auto complete off if you don't want it to happen.
- 6y ago
- patrickmcnamara 6y agoI'm surprised this took so long. I tried to find an extension recently that could completely block HTTP but I couldn't find anything.
- Ajedi32 6y agoHTTPS Everywhere[1] has a setting for that. [1]: https://chrome.google.com/webstore/detail/https-everywhere/gcbommkclmclpchllfjekcdonpmejbdp?hl=en https://chrome.google.com/webstore/detail/https-everywhere/g...
- superkuh 6y agoWhat you've described is, of course, what Google wants in the long run. For corporations making money on the web HTTPS is required and it makes a lot of sense. The problem is the web isn't just corporate sites involving money or private information. But if a browswer, or individual, begins blocking HTTP sites what they're effectively doing is saying, "Only sites approved by corporations should be visitable." This is a result of only corporations (no matter how non-profit or currently benevolent they are) being certificate authorities. A human person can't be a certificate authority. And that is a terrible blow to freedom on the web.
- Karunamon 6y agoYou're not wrong, but plaintext needs to die for reasons everyone already understands. We can deal with the implementation details^wabuses later.
- Ajedi32 6y agoA human person can't be a DNS registrar either. TLS certs aren't a stamp of approval; they're just a statement saying "we've verified that this public key belongs to the owner of this domain".
- superkuh 6y agoThat's true, but I can still type in an IP address and communicate with any webserver I want on the entire internet. I guess you don't remember in 2018 when Comodo revoked sci-hub's TLS certs under corporate political pressure. This style of revocation combined with HTTPS only browsers is effectively a block that can't be bypassed. I am not saying that the DNS system cannot be used for political attack. It obviously can. It was used as such against sci-hub before they started attacking via the cert provider. What I am saying is that blocking HTTP in the browser makes the consequences much, much worse. It greatly increases the incentives for revoking TLS certs for political reasons due to increased effectiveness. The cert authority doesn't even have to be malicious. All they have to do is be "law abiding" relative to some country with a bad set of laws.
- birdman3131 6y agoHow does it behave when the site nominally supports https but only uses a self signed cert? Many local network items are like this. in most cases it might be better to fallback to http but I am not sure.
- ocdtrekkie 6y agoFWIW, it is rapidly becoming the right choice to operate an internal trusted certificate authority, as browsers aggressively push HTTPS. In part, because this is now needed to monitor your own network traffic at the edge.
- louis-lau 6y agoIt's mentioned in the blog post, the link to which you're commenting on.
- CGamesPlay 6y agoI think what will happen is that visiting `vcap.me` will open `https://vcap.me https://vcap.me`, which would fail with a cert error, so Chrome will automatically (without showing the error) open `http://vcap.me http://vcap.me`, which would issue a redirect to `https://vcap.me https://vcap.me`, which would fail with a cert error. If you were navigating to `localhost`, Chrome would directly open `http://localhost http://localhost` which would do the redirect. It's unclear if Chrome is smart enough to know that `vcap.me` is a localhost service, but we can imagine a remote host which would behave the same way.
- asplake 6y agoPotential source of frustration: naked domains on http that upgrade to https after redirect to www or some other subdomain. It’s a problem to me now - if I name my naked .org site in GMail it assumes https. At some point I will have to host my own redirection service, just for this one issue. Side note: it beats me why browsers couldn’t agree a way to specify at least the first redirect in DNS, no web server needed for that part.
- CodesInChaos 6y agoYou'd need to authenticate that redirect, so it isn't as easy as it looks. (something like DANE and DNSSEC) The benefit doesn't seem big to me. You're already running a http server for the original domain, and an https server for the target domain, so extending the http server for the original domain to https doesn't sound like a big step.
- asplake 6y agoI'm using AWS Elastic Beanstalk, and you're not supposed to point a naked domain at the load balancer. On reflection though, it's a problem Amazon could solve there. None of this is super hard but it is annoying, some complexity that feels removable.
- reaperducer 6y agoWhen the big push to HTTPS came around, I was all in favor of it. Now... I'm more skeptical. Not everything has to be HTTPS. And I've become aware that many of the sites I visit are HTTP only and will never become HTTPS because of their age, or the lack of technical ability of their owners. HTTPS also has the side effect of obsoleting older hardware for no real reason. I have devices that work perfectly fine, but can't be upgraded to the latest whiz-bang encryption du jour. A vintage computer software archive doesn't need to be HTTPS. A local historical society doesn't need to be HTTPS. A color picker doesn't need to be HTTPS. I still think HTTPS is a good thing, but I also see it as a way of marginalizing and eventually eliminating a very large portion of the content on the web. Much of it is the very content that made the web so popular in the first place. I think I first became skeptical when Google said it would rank HTTP sites lower. This fits in with Google's general direction of making any content older than 4 years inaccessible, and creating its own information ecosystem in which to corral people. Google can now delist a huge swath of the internet and shrug its shoulders and say, "because security!" I think a good compromise would be for browsers to make connecting to an HTTP web site a lot less scary. Yes, tell people the connection is old-fashioned, and may be public. But don't block the page and put up big red scary icons and make people enter the system password to view Aunt Harriet's Really Good Muffin Recipe. It just seems like the antithesis of what the web was built for.
- prepend 6y agoI like using http where appropriate and not wasting resources. I publish a blog and there’s no need for https. Adding https just adds a little more effort and provides no benefit to the user. I guess if you count the ISP not knowing, but Google knowing, that you’re visiting my blog, then that’s a reason. But that’s a user issue, not a server issue. Practically, my host does all the cert stuff for me and it’s not hard. I just don’t like the gradual complexification of the web when there’s not a good reason. Moving more stuff to ssl that doesn’t need to be just burns up extra compute. I hope someone calculates the carbon footprint of SSLing all the stuff that doesn’t need SSL. While each action it tiny, there’s trillions of cpu cycles wasted on encrypting stuff that doesn’t benefit from encrypting.
- 6y ago
- deleted 6y ago[deleted]
- harikb 6y ago#1 thing I want for my security is a browser that makes the address bar text box very large for typing (and only when I am typing that address). I am tired of tiny address bars. Also make it easy for me to cut and remove the path. Some bad sites don’t recover properly from a bad session or query argument
- maxk42 6y agoI've said it many times, but nobody seems concerned: Certificate authorities are being used as tools of censorship by oppressive regimes. Until a central-authority-free alternative exists, the move to HTTPS is bad for a free world.
- shadowgovt 6y agoIs it better for a free world to have the traffic be unencrypted? Feels like one head of the hydra is control of the cert-trust network, but another head is traffic-sniffing and monitoring one's online activity, yeah?
- maxk42 6y agoPlease do not bring a straw man argument to the table. I clearly said " Until a central-authority-free alternative exists". Such alternatives are readily available and already used to secure e.g. ssh connections, but are not without drawbacks. One alternative that might be less likely to suffer from the same weaknesses as a certifcate-free model is a distributed certificate authority that relies on a ledger like DNS.
- Spivak 6y agoThose are the same thing. The CA system is a distributed X.500 database. It's the most distributed database in the world since the entries that comprise it are the certs themselves. Moving the infrastructure to DNS wouldn't change the nature of the system, just which entities are at the root. Hell, the CA system right now delegates authority to domain registrars and the DNS system.
- bpye 6y agoI understand that centralised CAs are not ideal, but how is HTTPS by default any worse than plaintext?
- maxk42 6y agoSimple: The oppressive regime in question can deny you a certificate thereby censoring you. Some also require you to use a particular certificate, thereby creating the illusion of security while being able to intercept, interdict, or MiTM information any time they like or continually. Here's an article that touches upon it superficially from 2010, and also notes that private companies are already selling these capabilities to authoritarian governments: https://arstechnica.com/information-technology/2010/03/govts-certificate-authorities-conspire-to-spy-on-ssl-users/ https://arstechnica.com/information-technology/2010/03/govts...
- andrewfromx 6y agowhat about http://neverssl.com/ http://neverssl.com/ ? I use that all the time to force a wifi connect dialog to pop up.
- fireattack 6y agoYou have to type http:// http:// then.
- makeworld 6y agoNo, you don't. It will just load as always. All this change means is that HTTPS will be tried first.
- fireattack 6y agoThanks for the correction.
- CGamesPlay 6y agoLooks like it'll still work: > For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails (including when there are certificate errors, such as name mismatch or untrusted self-signed certificate, or connection errors, such as DNS resolution failure). The name mismatch is the key point for those captive wifi portals that respond on HTTPS with an invalid certificate.
- RIMR 6y agoPaul Graham (YC Founder) will finally have to install a valid certificate onto his website: https://www.paulgraham.com/ https://www.paulgraham.com/
- seisvelas 6y agoGoodbye, ssl stripping attacks, I'll miss you so much! We knew this day would come sooner or later
- grensley 6y ago> IP addresses, single label domains, and reserved hostnames such as test/ or localhost/ will continue defaulting to HTTP. Alright, phew. That would have gotten super annoying super fast.
- simias 6y agoI wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they decide to proceed, or just go with good old HTTP but then you hit all sorts of limitations, and obviously zero security. I wish there was a way to opt into a "TOFU" https mode for these use cases (which is how browser dealt with invalid HTTPS certificates for a long time), although I realize that doing that without compromising the security of the internet at large might be tricky. If somebody has a solution, I'm all ears. As far as I can tell the "solution" employed by many IoT vendors is simply to mandate an internet connection and have you access your own LAN devices through the cloud, which is obviously a privacy nightmare. But it's HTTPS so your browser will display a very reassuring padlock telling you all is fine!
- nahuel0x 6y agoThere is a (defunct?) W3C working group about this, see https://www.w3.org/community/httpslocal/ https://www.w3.org/community/httpslocal/ and https://github.com/httpslocal https://github.com/httpslocal
- liveoneggs 6y agolet's encrypt with *.lan.mydomain.com via DNS validation, installed all over where needed, and annoying to update every 90 days because it's in weird/internal/non-standard places :)
- simias 6y agoI develop broadcast TV equipments which are often rented all over the place for short amounts of time, often don't have any direct internet access etc... I simply cannot make any assumption about the network these devices will run, and can certainly not rely on any sort of DNS validation. Virtually 100% of the time the devices are addressed directly by IPv4. I really can't think of a solution for this situation. For network you control your solution makes a lot of sense though.
- wooptoo 6y agoIf you're using Firefox HTTPS-Only mode has been available since version 83 - https://support.mozilla.org/en-US/kb/https-only-prefs https://support.mozilla.org/en-US/kb/https-only-prefs
- zzo38computer 6y agoI dislike both behaviours. I prefer that if the scheme is not entered, it is treated as a relative URL. (I have managed to customize Firefox to do this.) I also dislike the way "secure contexts" work entirely. Whether or not those features are enabled should depend on whether or not the user enabled them, not on whether or not the site uses HTTPS. (I also think that a better web browser should be made, which would be mostly rewritten entirely rather than using the existing browsers, since they have so many problems.)
- jVinc 6y agoWhat a journey it has been. http://www.example.com http://www.example.com http://example.com http://example.com https://example.com https://example.com example.com We're finally getting there! Now just a decades to go and we'll reverse the order to get com.example After which we'll wait a couple of decades to decide we don't need TLDs as ICANN is instead just given a free pass to print any amount of money they want without that silly distraction. Then we'll be at just: example which is just one step from the final solution which is that no URLs will be needed because the browser will just open up to Amazon who after final approval of their purchase of Google will at that point own not just the internet but the entire world.
- cblconfederate 6y agoActually we should have switched to resource locators that are just plain strings ("ycombinator news threads 26558305" . It s what google has been pushing everyone to do anyway (readable URLs), and what the centralization of the web led to ( fb / twitter usernames). Its easy for people to parse and speak through the phone, and it would be a decentralized, natural revival of AOL keywords. It would also drop total google searches by a few tens of percent Not sure where the protocol would fit though
- SV_BubbleTime 6y ago> Not sure where the protocol would fit though A thousand twitchy heads just popped up, eyes narrowed then widened... a new protocol you say?!
- cblconfederate 6y agono just a new URL. closer to how most people use the address bar
- midasuni 6y agorfc1738 Defines urls, feel free to propose another one for whatever scheme you want. I for one am quite happy with urls and use them all the time. If I want to search I will use the separate search box.
- alberth 6y agoWill you still need HSTS Preload going forward (for Chrome)?
- Hackbraten 6y agoAbsolutely. You need the HSTS-preload list so that even when HTTPS fails on the first visit to a HSTS-protected domain, the browser will still refuse to fall back to plain HTTP.
- EamonnMR 6y agoI feel like something will be lost when the barrier of entry for the web goes from "Host an HTML site on a domain" to "Obtain a certificate, host an HTML site on a domain configured to use a certificate" but maybe it's not as bad as it sounds. I'm loathe to let a random script modify my nginx config.
- nightpool 6y agoThis is cool, I get tripped up every day by accidentally navigating to HTTP sites just because I typed them into the browser, and there's literally no downside—if the site doesn't support HTTPS, the redirect is transparent to the user.
- triangleman 6y agoCould we get it to stop searching Google from inside the datacenter though
- canadaduane 6y agoThe devcert tool (and its corresponding devcert-cli command-line interface) is very handy for creating a local root certificate authority that you control & your device trusts: https://github.com/davewasmer/devcert https://github.com/davewasmer/devcert https://github.com/davewasmer/devcert-cli https://github.com/davewasmer/devcert-cli Benefits include no scare-screen, and being able to switch off all of your personally-generated certs at once by revoking the root auth.
- jeroenhd 6y agoIP addresses and localhost are still exempt from these changes. For development purposes, nothing serious should change; localhost is already a secure context. I'd very much watch out for using automated tools like these. Many browsers do not check certificate revocation and this leaves your browser open to some extensive MitM attacks. If you use this, you should probably create a second profile (firefox /p to create and pick one) so your normal browsing won't be affected. In my opinion, it's easier to just type "thisisunsafe" into the warning page once if you use it for developing. If you're demoing your application, putting it on a server with a Let's Encrypt cert shouldn't be too hard either. I'm sure this has its uses, but I just can't figure out what they would be if you do not wish to take huge security risks.
- goodside 6y agoThis is a great instance of https://xkcd.com/1172/ https://xkcd.com/1172/ for me. "example.com" is the only domain name I intentionally load over HTTP in Chrome, so this change breaks my workflow. Many for-pay wifi networks (e.g. on airplanes) are designed to intercept all HTTP requests from guest users, redirecting the browser to a login/signup page. Until you log in HTTPS is blocked, so you have to try to open a domain Chrome doesn't recognize as requiring HTTPS. There are fewer of these every year, so I use "example.com" because it autocompletes easily and will be around forever. Now there's no domain that works, and you have to type every character of "http://a http://a" to get the same result.
- louis-lau 6y agoDid you read the blog post? It will now use http if https fails. So http only sites will still work for this.
- CGamesPlay 6y agoHey, take a look over the HN guidelines, specifically this one: > Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- goodside 6y agoThat's not the issue. Example.com is just distinctive for supporting both http and https, whereas modern sites redirect you to the https version. Chrome remembers which domains support https (which is nearly all of them) for when the domain is typed naked, and apparently won't fall back to http if it recalls https working in the past. So, until now, domains like "example.com" would sometimes let you get to an airplane's login page when domains like "facebook.com" wouldn't.
- CGamesPlay 6y agoYou're gonna want to switch to http://neverssl.com http://neverssl.com, with is designed precisely for this purpose. The new Chrome behavior will not break this site.
- pagade 6y agoDid anyone else thought: I want to be able to draw that kind of animation for architecture diagrams. No complex sequence diagrams, no numbering of the arrows, no confusion of arrow directions. Sorry for the off-topic
- mastre_ 6y agoI feel like I'm asking the obvious, but.. is it that hard to mention a date when you're going to break a bunch of stuff, so those affected at least know how long they have to look for contingency plans? For those who don't know how long it takes for a Chrome version to move from dev (v90 is there now) to prod it would be nice to have an idea, is it a week/month/90 days?
- vincentmarle 6y agoBut.. how are we now supposed to read Paul Graham's blog? /s
- spiantino 6y agoI.... thought this was already the case?
- iamkeyur 6y agoAnyone got commit link for this change?
- JulianMorrison 6y agoRegarding the complaints about IOT devices and LAN local services: I wonder if it would be possible, and reasonable, to define some sort of LAN certificate authority protocol, which behaves a bit like Let's Encrypt, but only for services that are on LAN local subnets. Normally, something like your WiFi router would fulfil this role, local services would poll it to obtain signed certs, and, browsers would poll it for a CA cert which they would apply as a trust root for LAN local subnets only.
- herpderperator 6y agoI've been prefixing https:// https:// to fast-track this for as long as I can remember. I probably will still continue to do it though since Chrome isn't the only browser in the world.
- hunter2_ 6y ago"Chrome will fall back to HTTP ... when there [is] ... DNS resolution failure" makes no sense to me. In what circumstance does DNS resolution succeed for HTTP after failing for HTTPS? DNS doesn't care what you're about to do with the IP address it provides.
- Netcob 6y agoThere is this recurring joke (to put it nicely) in pop culture where some clueless person will spell out a URL as "H T T P COLON SLASH SLASH W W W DOT...". Part of me now always goes "but we use https now..."
- numlock86 6y agoAnd here I am, thinking that this was already the case for the past few years ... Thinking about it, it's probably because "everyone" started using HSTS.
- h0nd 6y agoProblems with captive portals incoming. Even in the past I had troubles if I couldn't come up with a non-https site to be redirected to the captive portal successfully.