7 ms·

If you're using Chrome, right-click the URL bar and check "Always show full URLs", so you can see the https:// https:// prefix like it's 1999. This also fixes a

by p1mrx 4y ago

If you're using Chrome, right-click the URL bar and check "Always show full URLs", so you can see the https:// https:// prefix like it's 1999. This also fixes a variety of UX problems with editing URLs. By the way, does anyone know of a good alternative to http://neverssl.com http://neverssl.com ? I had been using this for years, but now it supports SSL for some unfathomable reason.

Dandy3556 3y ago
I use https://nonhttps.com/ https://nonhttps.com/
DiggyJohnson 4y ago
httpforever.com is my go to.
- p1mrx 4y ago
  Nice. I see that https://httpforever.com/ https://httpforever.com/ exists with a 301 redirect to http://httpforever.com/ http://httpforever.com/, but that's probably good enough for most practical purposes.
  - notatoad 4y ago
    that appears to also be what neverssl is doing - they support https only for the purposes of redirecting to a non-ssl domain
    - p1mrx 4y ago
      Nope, when I go to neverssl.com, it ultimately lands on an HTTPS url, e.g. https://shinyquietbrightsong.neverssl.com/online/ https://shinyquietbrightsong.neverssl.com/online/ Edit: I'm running Chrome OS 113 beta. Maybe they changed something recently, to automatically use HTTPS unless prohibited by the server? This also happens in Guest mode with no extensions.
      - 0xffff2 4y ago
        Do you have HTTPS Everywhere or a similar plugin installed? If you look at the page source, it's "redirecting" in a script with this line: window.location.href = 'http://' + prefix + '.neverssl.com/online' I get a plain http page on Firefox/Ubuntu.
      - marcosdumay 4y ago
        It is your browser doing that redirect, not the side. The http://neverssl.com http://neverssl.com ends up on an http page, and so does https://neverssl.com https://neverssl.com. But that final page (the one you posted) does not itself redirect from https to http.
    - 0xffff2 4y ago
      neverssl seems to be doing some weird thing where it uses Javascript to load a non-https link rather than an actual redirect. I can't for the life of me guess why that would be better than a simple 301 redirect.
      - re 4y ago
        https://news.ycombinator.com/item?id=35792149 https://news.ycombinator.com/item?id=35792149 The primary goal of NeverSSL is to be useful on networks with captive portals that intercept HTTP and block HTTPS (until you have signed in). The JavaScript redirect is at least browser cacheable, whereas a 301 redirect sent via HTTPS would be useless in that scenario as it would fail to load.
        shawnz 4y ago
        Isn't a 301 response cacheable?
        mh- 4y ago
        Depends on the cache control headers, but yes.
        re 4y ago
        Yes, sorry: the other piece is that NeverSSL wants to redirect to a new domain every time you visit to ensure that the page that you was actually loaded from the network and not from a cache, which a cached 301 to a fixed address wouldn't accomplish. https://twitter.com/NeverSSL/status/1136488879106666496 https://twitter.com/NeverSSL/status/1136488879106666496
  - pabs3 4y ago
    "Firefox has detected that the server is redirecting the request for this address in a way that will never complete."
jefftk 4y ago
> it supports SSL for some unfathomable reason. "neverssl.com now supports ssl, as some browsers and sites automatically use https even when you don't type that in. You get a browser-cacheable page that still helps you get online by forcing a request that ... never uses ssl." -- https://twitter.com/NeverSSL/status/1456310362551164928 https://twitter.com/NeverSSL/status/1456310362551164928 They're trying to solve the "how do log into this captive portal" problem, and they needed to make this change to handle that typing "neverssl.com" now often evaluates to "https://neverssl.com https://neverssl.com".
- chrismorgan 4y ago
  Wow. Unfathomable indeed; that action and that explanation make no sense to me, and they haven’t even updated the HTML served—it still makes the claim of “never SSL” they’ve reneged on.
  - lozenge 4y ago
    http://http.rip http://http.rip
    - pabs3 4y ago
      That isn't useful, because https://http.rip https://http.rip goes to a self-signed cert.
  - listenallyall 4y ago
    > they’ve reneged on. Damn straight. Demand your money back!
  - zeckalpha 4y ago
    TLS isn't SSL.
  - zamnos 4y ago
    In the escalation of security, some browsers or browsers with extensions only ever try https, so that change was necessary to handle those browsers.
deleted 4y ago
[deleted]
dmitrygr 4y ago
Example.com
runnerup 4y ago
Thank you. I searched and found a similar option in Safari settings but it doesn’t permanently show the protocol prefix. It also gets overridden on google searches where it just shows your search terms, not the URL.
rzzzt 4y ago
It should always be possible to reach http://example.com http://example.com (also .org and .net) over HTTP.
- p1mrx 4y ago
  Chrome redirects to https://example.com https://example.com, so that's no bueno for testing http:// http:// in your URL bar. Edit: I'm running Chrome OS 113 beta. Maybe they changed something recently, to automatically use HTTPS unless prohibited by the server? This also happens in Guest mode with no extensions.
  - dadrian 4y ago
    In (50%) of Beta, Chrome attempts HTTPS and silently falls back to HTTP on all HTTP links. We're still poking around with opt-outs, currently if you allow insecure content via Page Info / Site Controls, we stop upgrades.
    - mh- 4y ago
      If you're open to feedback: I'm not strictly opposed to that behavior, but it seems like a reasonable compromise to not do that for URLs explicitly entered in the Omnibox. It seems like that will provide the transport upgrade effect we want, without breaking some of the workflows mentioned in this thread.
    - noduerme 4y ago
      Somewhere in the past six months, on a page where we have to force users to HTTP, Chrome on Android has broken about 90% of the time with "too many redirects" and no way to even type "http:// http://" into the URL bar without Chrome changing it. Finally had to just give users a raw IP address. I would love if your team could fix this or provide some opt-out. For context, each of the retail locations of our company runs its own local MAMP server that serves a web app used all day by the employees on their tablets. It's accessible only on the LAN. Rather than have every employee need to know or type the local IP address for these (which change sometimes), we serve a centralized web page at http://ourcompany.com/employeeApp http://ourcompany.com/employeeApp that just keeps a live list of the local (192.x.x.x) IP addresses harvested from each server in each location, and opens a connection to the local server in an iFrame. Because of what's now a hard ban on loading insecure HTTP content within an HTTPS page, we must serve that central iFrame wrapper page over HTTP. Unfortunately, we now need to give Chrome users a raw IP address for ourcompany.com, to avoid them being redirected infinitely to HTTPS and back. [edit] I should add that the oddest thing is that it doesn't always overflow with redirects, and on a new device it often is able to go to the HTTP site. But once someone does type https:// https:// or leave out the http:// http:// by mistake, no level of cache clearing seems to remove Chrome's insistence on trying to force HTTPS on that page forever afterwards. [edit2] The rationale for not setting up local DNS and SSL is that these servers are on all kinds of different local networks in stores around the country, are switched on and off by non-technical managers onsite, and I'm the author of the web app and the only tech support for it. It needs to be as simple as possible so that I'm not spending all my time tunneling into those servers, walking them through router problems and stuff like that.
llimllib 4y ago
I used zombo.com for a long time before they finally, sadly, added https
- afandian 4y ago
  Seems you can't do absolutely everything.
zeven7 4y ago
For forever I used yahoo.com to login to a captive portal. I don't know why, but for some reason it worked for me when typing google.com, etc didn't work. Somehow I figured that out and stuck to it. I haven't done it in a while, though, not sure if it would still work.
- rippercushions 4y ago
  I always figured this was due to DNS caching: if you got a domain you never visit, it has to actually fetch it and that triggers the captive portal login .
  - zamnos 4y ago
    Exactly right - which is why neverssl.com now redirects to a randomly generated subdomain.
amluto 4y ago
I use example.org. An explicit http://example.org http://example.org does the trick when needed.
- aaronbrethorst 4y ago
  Me too. Visiting the aforementioned URL is the only way I can consistently get captive portal login WiFi networks to work on my Mac. Amazing how busted this experience is...
  - CarVac 4y ago
    Firefox always gives me a button that directly opens the portal login page.
- pabs3 4y ago
  That one supports https too :)
jbverschoor 4y ago
So they hid this setting in the address bar :D
- scrollaway 3y ago
  And I'm sure some googlers will look at the telemetry and happily remove the setting when they realize "It turns out nobody is enabling that!". Bloody hell. Thanks GP, enabled it.
MarkSweep 4y ago
http://captive.apple.com/ http://captive.apple.com/ is what iOS uses.
seanhunter 4y ago
Depending on what you're trying to do one of the "captive" ping urls works eg http://captive.apple.com http://captive.apple.com This is the url that apple devices ping to get the login box up for things like hotel wifi. There's a mozilla one also which is http://detectportal.firefox.com/canonical.html http://detectportal.firefox.com/canonical.html [1] , but that returns a redirect which may or may not work for your use case. [1] https://support.mozilla.org/en-US/kb/captive-portal https://support.mozilla.org/en-US/kb/captive-portal
- deleted 4y ago
  [deleted]
- pabs3 4y ago
  Those both support TLS, although they don't mandate it.
hgj4dfshgf43 4y ago
> By the way, does anyone know of a good alternative to http://neverssl.com http://neverssl.com ? http://http.rip/ http://http.rip/
cmckn 4y ago
http://www.alwayshttp.com http://www.alwayshttp.com
- pabs3 4y ago
  That one has some sort of weird forever-loading TLS unfortunately.
  - hddqsb 4y ago
    I believe that's the point! (Would probably be more user-friendly if it sent a RST instead of silently dropping the connection and letting it time out.)
    - pabs3 3y ago
      Getting connection refused would be the best way to do this.
hbn 4y ago
My latest annoyance with the Chrome URL bar is when certain things autofill (it might be bookmarks, but I think I see it in other frequently-visited addressed too), instead of it populating with the full URL so I can edit it, it just pops up as a piece of text to the right of where I'm typing, so I can see the URL that will fill if I hit enter but I can't edit it. It just started doing this a few months ago maybe?
- zbrozek 4y ago
  Firefox on Android does this and it drives me nuts. It also means that all of the search entries are now useless as it auto-populates something and excludes what would've been reasonable hits. I'm constantly deleting that content so I can select something else.
- Traubenfuchs 4y ago
  The responsible people must have a way of using chrome that is completely different to our way...
WrtCdEvrydy 4y ago
Same thing happened to ross-tech: https://www.ross-tech.com/ https://www.ross-tech.com/ Chrome adding HTTPS for whatever reason.
mattnewton 4y ago
I always use captive.apple.com
mgraczyk 4y ago
For some reason I remember reading that example.com will never have https, but I'm not sure that's true. It's what I use for now.
- Someone 4y ago
  It has https now. https://example.com/ https://example.com/ works for me.
luckystarr 3y ago
> By the way, does anyone know of a good alternative to http://neverssl.com http://neverssl.com ? I had been using this for years, but now it supports SSL for some unfathomable reason. http://http.rip/ http://http.rip/ was shared (here?) recently.

by p1mrx 4y ago

Dandy3556 3y ago

I use https://nonhttps.com/ https://nonhttps.com/

DiggyJohnson 4y ago

httpforever.com is my go to.

p1mrx 4y ago
Nice. I see that https://httpforever.com/ https://httpforever.com/ exists with a 301 redirect to http://httpforever.com/ http://httpforever.com/, but that's probably good enough for most practical purposes.
- notatoad 4y ago
  that appears to also be what neverssl is doing - they support https only for the purposes of redirecting to a non-ssl domain
  - p1mrx 4y ago
    Nope, when I go to neverssl.com, it ultimately lands on an HTTPS url, e.g. https://shinyquietbrightsong.neverssl.com/online/ https://shinyquietbrightsong.neverssl.com/online/ Edit: I'm running Chrome OS 113 beta. Maybe they changed something recently, to automatically use HTTPS unless prohibited by the server? This also happens in Guest mode with no extensions.
    - 0xffff2 4y ago
      Do you have HTTPS Everywhere or a similar plugin installed? If you look at the page source, it's "redirecting" in a script with this line: window.location.href = 'http://' + prefix + '.neverssl.com/online' I get a plain http page on Firefox/Ubuntu.
    - marcosdumay 4y ago
      It is your browser doing that redirect, not the side. The http://neverssl.com http://neverssl.com ends up on an http page, and so does https://neverssl.com https://neverssl.com. But that final page (the one you posted) does not itself redirect from https to http.
  - 0xffff2 4y ago
    neverssl seems to be doing some weird thing where it uses Javascript to load a non-https link rather than an actual redirect. I can't for the life of me guess why that would be better than a simple 301 redirect.
    - re 4y ago
      https://news.ycombinator.com/item?id=35792149 https://news.ycombinator.com/item?id=35792149 The primary goal of NeverSSL is to be useful on networks with captive portals that intercept HTTP and block HTTPS (until you have signed in). The JavaScript redirect is at least browser cacheable, whereas a 301 redirect sent via HTTPS would be useless in that scenario as it would fail to load.
      - shawnz 4y ago
        Isn't a 301 response cacheable?
        mh- 4y ago
        Depends on the cache control headers, but yes.
        re 4y ago
        Yes, sorry: the other piece is that NeverSSL wants to redirect to a new domain every time you visit to ensure that the page that you was actually loaded from the network and not from a cache, which a cached 301 to a fixed address wouldn't accomplish. https://twitter.com/NeverSSL/status/1136488879106666496 https://twitter.com/NeverSSL/status/1136488879106666496
- pabs3 4y ago
  "Firefox has detected that the server is redirecting the request for this address in a way that will never complete."

jefftk 4y ago

> it supports SSL for some unfathomable reason. "neverssl.com now supports ssl, as some browsers and sites automatically use https even when you don't type that in. You get a browser-cacheable page that still helps you get online by forcing a request that ... never uses ssl." -- https://twitter.com/NeverSSL/status/1456310362551164928 https://twitter.com/NeverSSL/status/1456310362551164928 They're trying to solve the "how do log into this captive portal" problem, and they needed to make this change to handle that typing "neverssl.com" now often evaluates to "https://neverssl.com https://neverssl.com".

chrismorgan 4y ago
Wow. Unfathomable indeed; that action and that explanation make no sense to me, and they haven’t even updated the HTML served—it still makes the claim of “never SSL” they’ve reneged on.
- lozenge 4y ago
  http://http.rip http://http.rip
  - pabs3 4y ago
    That isn't useful, because https://http.rip https://http.rip goes to a self-signed cert.
- listenallyall 4y ago
  > they’ve reneged on. Damn straight. Demand your money back!
- zeckalpha 4y ago
  TLS isn't SSL.
- zamnos 4y ago
  In the escalation of security, some browsers or browsers with extensions only ever try https, so that change was necessary to handle those browsers.

deleted 4y ago

[deleted]

dmitrygr 4y ago

Example.com

runnerup 4y ago

Thank you. I searched and found a similar option in Safari settings but it doesn’t permanently show the protocol prefix. It also gets overridden on google searches where it just shows your search terms, not the URL.

rzzzt 4y ago

It should always be possible to reach http://example.com http://example.com (also .org and .net) over HTTP.

p1mrx 4y ago
Chrome redirects to https://example.com https://example.com, so that's no bueno for testing http:// http:// in your URL bar. Edit: I'm running Chrome OS 113 beta. Maybe they changed something recently, to automatically use HTTPS unless prohibited by the server? This also happens in Guest mode with no extensions.
- dadrian 4y ago
  In (50%) of Beta, Chrome attempts HTTPS and silently falls back to HTTP on all HTTP links. We're still poking around with opt-outs, currently if you allow insecure content via Page Info / Site Controls, we stop upgrades.
  - mh- 4y ago
    If you're open to feedback: I'm not strictly opposed to that behavior, but it seems like a reasonable compromise to not do that for URLs explicitly entered in the Omnibox. It seems like that will provide the transport upgrade effect we want, without breaking some of the workflows mentioned in this thread.
  - noduerme 4y ago
    Somewhere in the past six months, on a page where we have to force users to HTTP, Chrome on Android has broken about 90% of the time with "too many redirects" and no way to even type "http:// http://" into the URL bar without Chrome changing it. Finally had to just give users a raw IP address. I would love if your team could fix this or provide some opt-out. For context, each of the retail locations of our company runs its own local MAMP server that serves a web app used all day by the employees on their tablets. It's accessible only on the LAN. Rather than have every employee need to know or type the local IP address for these (which change sometimes), we serve a centralized web page at http://ourcompany.com/employeeApp http://ourcompany.com/employeeApp that just keeps a live list of the local (192.x.x.x) IP addresses harvested from each server in each location, and opens a connection to the local server in an iFrame. Because of what's now a hard ban on loading insecure HTTP content within an HTTPS page, we must serve that central iFrame wrapper page over HTTP. Unfortunately, we now need to give Chrome users a raw IP address for ourcompany.com, to avoid them being redirected infinitely to HTTPS and back. [edit] I should add that the oddest thing is that it doesn't always overflow with redirects, and on a new device it often is able to go to the HTTP site. But once someone does type https:// https:// or leave out the http:// http:// by mistake, no level of cache clearing seems to remove Chrome's insistence on trying to force HTTPS on that page forever afterwards. [edit2] The rationale for not setting up local DNS and SSL is that these servers are on all kinds of different local networks in stores around the country, are switched on and off by non-technical managers onsite, and I'm the author of the web app and the only tech support for it. It needs to be as simple as possible so that I'm not spending all my time tunneling into those servers, walking them through router problems and stuff like that.

llimllib 4y ago

I used zombo.com for a long time before they finally, sadly, added https

afandian 4y ago
Seems you can't do absolutely everything.

zeven7 4y ago

For forever I used yahoo.com to login to a captive portal. I don't know why, but for some reason it worked for me when typing google.com, etc didn't work. Somehow I figured that out and stuck to it. I haven't done it in a while, though, not sure if it would still work.

rippercushions 4y ago
I always figured this was due to DNS caching: if you got a domain you never visit, it has to actually fetch it and that triggers the captive portal login .
- zamnos 4y ago
  Exactly right - which is why neverssl.com now redirects to a randomly generated subdomain.

amluto 4y ago

I use example.org. An explicit http://example.org http://example.org does the trick when needed.

aaronbrethorst 4y ago
Me too. Visiting the aforementioned URL is the only way I can consistently get captive portal login WiFi networks to work on my Mac. Amazing how busted this experience is...
- CarVac 4y ago
  Firefox always gives me a button that directly opens the portal login page.
pabs3 4y ago
That one supports https too :)

jbverschoor 4y ago

So they hid this setting in the address bar :D

scrollaway 3y ago
And I'm sure some googlers will look at the telemetry and happily remove the setting when they realize "It turns out nobody is enabling that!". Bloody hell. Thanks GP, enabled it.

MarkSweep 4y ago

http://captive.apple.com/ http://captive.apple.com/ is what iOS uses.

seanhunter 4y ago

Depending on what you're trying to do one of the "captive" ping urls works eg http://captive.apple.com http://captive.apple.com This is the url that apple devices ping to get the login box up for things like hotel wifi. There's a mozilla one also which is http://detectportal.firefox.com/canonical.html http://detectportal.firefox.com/canonical.html [1] , but that returns a redirect which may or may not work for your use case. [1] https://support.mozilla.org/en-US/kb/captive-portal https://support.mozilla.org/en-US/kb/captive-portal

deleted 4y ago
[deleted]
pabs3 4y ago
Those both support TLS, although they don't mandate it.

hgj4dfshgf43 4y ago

> By the way, does anyone know of a good alternative to http://neverssl.com http://neverssl.com ? http://http.rip/ http://http.rip/

cmckn 4y ago

http://www.alwayshttp.com http://www.alwayshttp.com

pabs3 4y ago
That one has some sort of weird forever-loading TLS unfortunately.
- hddqsb 4y ago
  I believe that's the point! (Would probably be more user-friendly if it sent a RST instead of silently dropping the connection and letting it time out.)
  - pabs3 3y ago
    Getting connection refused would be the best way to do this.

hbn 4y ago

My latest annoyance with the Chrome URL bar is when certain things autofill (it might be bookmarks, but I think I see it in other frequently-visited addressed too), instead of it populating with the full URL so I can edit it, it just pops up as a piece of text to the right of where I'm typing, so I can see the URL that will fill if I hit enter but I can't edit it. It just started doing this a few months ago maybe?

zbrozek 4y ago
Firefox on Android does this and it drives me nuts. It also means that all of the search entries are now useless as it auto-populates something and excludes what would've been reasonable hits. I'm constantly deleting that content so I can select something else.
Traubenfuchs 4y ago
The responsible people must have a way of using chrome that is completely different to our way...

WrtCdEvrydy 4y ago

Same thing happened to ross-tech: https://www.ross-tech.com/ https://www.ross-tech.com/ Chrome adding HTTPS for whatever reason.

mattnewton 4y ago

I always use captive.apple.com

mgraczyk 4y ago

For some reason I remember reading that example.com will never have https, but I'm not sure that's true. It's what I use for now.

Someone 4y ago
It has https now. https://example.com/ https://example.com/ works for me.

luckystarr 3y ago

> By the way, does anyone know of a good alternative to http://neverssl.com http://neverssl.com ? I had been using this for years, but now it supports SSL for some unfathomable reason. http://http.rip/ http://http.rip/ was shared (here?) recently.