5 ms·

Does anyone know why Google did this for .dev of all things? HSTS makes sense for any other domain, but specifically picking a tld that people are known to use

by xg15 4y ago

Does anyone know why Google did this for .dev of all things? HSTS makes sense for any other domain, but specifically picking a tld that people are known to use for internal testing, then shelling out the money to buy it only so you can force HSTS on it, comes out as a real dick move, honestly. Or was Google so caught up in their good guy complex that they felt justified to perform a pedagogical intervention on the entire industry?

soneil 4y ago
They did it for a good handful of TLD, including .app, .day, .dev, .page, and .new. I get the impression they're pushing for it to be absolutely everywhere, and "greenfield sites" are an easier place to start than to break things that already work.
lucasfcosta 4y ago
I think it's not that bad for this to be the default. To be honest, people should've never used `.dev` for testing in the first place, given that IANA has reserved the `.test` domain specifically for that. By making HTTPS the default for `.dev` they can save a few MS in rewriting the requests and a few bytes for the preload header. In any case, I think it'd be okay for it to be the default, but I think it's not okay for it to be immutable. I should be able to remove my .dev domain from the preload list if I want to. TL;DR: Ok default but IMO it should be possible to opt-out.
- zamnos 4y ago
  RFC 2606: https://www.rfc-editor.org/rfc/rfc2606.html https://www.rfc-editor.org/rfc/rfc2606.html The problem with standards is no one ever reads them. This was published in 1999.
  - amichal 4y ago
    And for local application env you should use .localhost .test was for testing DNS infra. "undefined behavioir" for you local resolver
    - suprfsat 4y ago
      You mean we’re not supposed to run our Active Directory on ‘corp.com’?
      - ArchOversight 4y ago
        No, you run it on .corp like everyone else. :P
- suprfsat 4y ago
  Also I was using TÜRKTRUST and it should be possible to opt out of whatever the security nerds thought was best for me too.
- account42 4y ago
  > To be honest, people should've never used `.dev` for testing in the first place, given that IANA has reserved the `.test` domain specifically for that. The TLD namespace was effectively frozen for a long time until ICANN got greedy and decided to sell parts of it off.
- chrismorgan 4y ago
  Why should you be able to opt out? I can’t think of any valid reason.
- toast0 4y ago
  I believe you can opt-out your domain, but in order to opt-out you need to serve HTTPS and serve a HSTS header with max-age=0. The blog post mentions turning off the HSTS header, but not setting it to max-age=0, which is probably what they needed to do (plus a redirect from https to http, for specific pages they want served via http)
hannob 4y ago
If you think about it what Google did was actually quite smart. By forcing HSTS for .dev they broke setups of people who hijacked a domain name they didn't own and that wasn't made for that purpose (and, as others pointed out, there are TLDs reserved for testing that you can use). So they forced those people to fix their stuff. If they hadn't done that .dev probably would have gained the reputation of the TLD that doesn't work, because all kinds of people redirected it to some testing hosts.
- sebstefan 4y ago
  Why does that affect the .dev TLD specifically?
  - acatton 4y ago
    Because Google manages the .dev TLD. https://en.wikipedia.org/wiki/.dev https://en.wikipedia.org/wiki/.dev It's their TLD, they do whatever they want.
  - matharmin 4y ago
    Because many people (myself included) used .dev for internal testing domains before it was a TLD, either by specifying the domains in my hosts file, or with a local DNS server. Now i use .test for that, which is actually a reserved suffix that would never be a real TLD.
    - chatmasta 4y ago
      Just to expand on why you should use .test for this, it's a reserved TLD according to RFC 2606 [0] and should therefore be guaranteed never to be issued by any registrar. Alternatively, you could use any of the other 11 reserved TLDs: .测试, .परीक्षा, .испытание, .테스트, .טעסט, .測試, .آزمایشی, .பரிட்சை, .δοκιμή, .إختبار, .テスト e.g. we use `https://www.splitgraph.test https://www.splitgraph.test` for local development, which is nice because we avoid a whole class of "works in dev" bugs that you get with `http://localhost:3001 http://localhost:3001` For the certificate, we use a self-signed certificate signed by a root cert generated by mkcert [1] locally on each developer's machine (to avoid sharing a root cert that could be used to MITM each other). [0] https://en.wikipedia.org/wiki/.test https://en.wikipedia.org/wiki/.test [1] https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert

by xg15 4y ago

soneil 4y ago

They did it for a good handful of TLD, including .app, .day, .dev, .page, and .new. I get the impression they're pushing for it to be absolutely everywhere, and "greenfield sites" are an easier place to start than to break things that already work.

lucasfcosta 4y ago

I think it's not that bad for this to be the default. To be honest, people should've never used `.dev` for testing in the first place, given that IANA has reserved the `.test` domain specifically for that. By making HTTPS the default for `.dev` they can save a few MS in rewriting the requests and a few bytes for the preload header. In any case, I think it'd be okay for it to be the default, but I think it's not okay for it to be immutable. I should be able to remove my .dev domain from the preload list if I want to. TL;DR: Ok default but IMO it should be possible to opt-out.

zamnos 4y ago
RFC 2606: https://www.rfc-editor.org/rfc/rfc2606.html https://www.rfc-editor.org/rfc/rfc2606.html The problem with standards is no one ever reads them. This was published in 1999.
- amichal 4y ago
  And for local application env you should use .localhost .test was for testing DNS infra. "undefined behavioir" for you local resolver
  - suprfsat 4y ago
    You mean we’re not supposed to run our Active Directory on ‘corp.com’?
    - ArchOversight 4y ago
      No, you run it on .corp like everyone else. :P
suprfsat 4y ago
Also I was using TÜRKTRUST and it should be possible to opt out of whatever the security nerds thought was best for me too.
account42 4y ago
> To be honest, people should've never used `.dev` for testing in the first place, given that IANA has reserved the `.test` domain specifically for that. The TLD namespace was effectively frozen for a long time until ICANN got greedy and decided to sell parts of it off.
chrismorgan 4y ago
Why should you be able to opt out? I can’t think of any valid reason.
toast0 4y ago
I believe you can opt-out your domain, but in order to opt-out you need to serve HTTPS and serve a HSTS header with max-age=0. The blog post mentions turning off the HSTS header, but not setting it to max-age=0, which is probably what they needed to do (plus a redirect from https to http, for specific pages they want served via http)

hannob 4y ago

If you think about it what Google did was actually quite smart. By forcing HSTS for .dev they broke setups of people who hijacked a domain name they didn't own and that wasn't made for that purpose (and, as others pointed out, there are TLDs reserved for testing that you can use). So they forced those people to fix their stuff. If they hadn't done that .dev probably would have gained the reputation of the TLD that doesn't work, because all kinds of people redirected it to some testing hosts.

sebstefan 4y ago
Why does that affect the .dev TLD specifically?
- acatton 4y ago
  Because Google manages the .dev TLD. https://en.wikipedia.org/wiki/.dev https://en.wikipedia.org/wiki/.dev It's their TLD, they do whatever they want.
- matharmin 4y ago
  Because many people (myself included) used .dev for internal testing domains before it was a TLD, either by specifying the domains in my hosts file, or with a local DNS server. Now i use .test for that, which is actually a reserved suffix that would never be a real TLD.
  - chatmasta 4y ago
    Just to expand on why you should use .test for this, it's a reserved TLD according to RFC 2606 [0] and should therefore be guaranteed never to be issued by any registrar. Alternatively, you could use any of the other 11 reserved TLDs: .测试, .परीक्षा, .испытание, .테스트, .טעסט, .測試, .آزمایشی, .பரிட்சை, .δοκιμή, .إختبار, .テスト e.g. we use `https://www.splitgraph.test https://www.splitgraph.test` for local development, which is nice because we avoid a whole class of "works in dev" bugs that you get with `http://localhost:3001 http://localhost:3001` For the certificate, we use a self-signed certificate signed by a root cert generated by mkcert [1] locally on each developer's machine (to avoid sharing a root cert that could be used to MITM each other). [0] https://en.wikipedia.org/wiki/.test https://en.wikipedia.org/wiki/.test [1] https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert