4 ms·

I think it's not that bad for this to be the default. To be honest, people should've never used `.dev` for testing in the first place, given that IANA has rese

I think it's not that bad for this to be the default. To be honest, people should've never used `.dev` for testing in the first place, given that IANA has reserved the `.test` domain specifically for that. By making HTTPS the default for `.dev` they can save a few MS in rewriting the requests and a few bytes for the preload header. In any case, I think it'd be okay for it to be the default, but I think it's not okay for it to be immutable. I should be able to remove my .dev domain from the preload list if I want to. TL;DR: Ok default but IMO it should be possible to opt-out.

zamnos 4y ago
RFC 2606: https://www.rfc-editor.org/rfc/rfc2606.html https://www.rfc-editor.org/rfc/rfc2606.html The problem with standards is no one ever reads them. This was published in 1999.
- amichal 4y ago
  And for local application env you should use .localhost .test was for testing DNS infra. "undefined behavioir" for you local resolver
  - suprfsat 4y ago
    You mean we’re not supposed to run our Active Directory on ‘corp.com’?
    - ArchOversight 4y ago
      No, you run it on .corp like everyone else. :P
suprfsat 4y ago
Also I was using TÜRKTRUST and it should be possible to opt out of whatever the security nerds thought was best for me too.
account42 4y ago
> To be honest, people should've never used `.dev` for testing in the first place, given that IANA has reserved the `.test` domain specifically for that. The TLD namespace was effectively frozen for a long time until ICANN got greedy and decided to sell parts of it off.
chrismorgan 4y ago
Why should you be able to opt out? I can’t think of any valid reason.
toast0 4y ago
I believe you can opt-out your domain, but in order to opt-out you need to serve HTTPS and serve a HSTS header with max-age=0. The blog post mentions turning off the HSTS header, but not setting it to max-age=0, which is probably what they needed to do (plus a redirect from https to http, for specific pages they want served via http)

zamnos 4y ago

RFC 2606: https://www.rfc-editor.org/rfc/rfc2606.html https://www.rfc-editor.org/rfc/rfc2606.html The problem with standards is no one ever reads them. This was published in 1999.

amichal 4y ago
And for local application env you should use .localhost .test was for testing DNS infra. "undefined behavioir" for you local resolver
- suprfsat 4y ago
  You mean we’re not supposed to run our Active Directory on ‘corp.com’?
  - ArchOversight 4y ago
    No, you run it on .corp like everyone else. :P

suprfsat 4y ago

Also I was using TÜRKTRUST and it should be possible to opt out of whatever the security nerds thought was best for me too.

account42 4y ago

> To be honest, people should've never used `.dev` for testing in the first place, given that IANA has reserved the `.test` domain specifically for that. The TLD namespace was effectively frozen for a long time until ICANN got greedy and decided to sell parts of it off.

chrismorgan 4y ago

Why should you be able to opt out? I can’t think of any valid reason.

toast0 4y ago

I believe you can opt-out your domain, but in order to opt-out you need to serve HTTPS and serve a HSTS header with max-age=0. The blog post mentions turning off the HSTS header, but not setting it to max-age=0, which is probably what they needed to do (plus a redirect from https to http, for specific pages they want served via http)